1

I have a mach-o binary and using llvm-objdump version 9 I can disassemble it. I would like to disassemble only a single function though.

If I display the symbol table with --syms I can see the function I would like to disassemble:

0000000100005a54 l     F __TEXT,__text -[ViewController isValidPin:]

however I cannot work out the proper command to do this.

I have tried the following options which all just result in the usage being displayed and no indication what the issue is with the command:

  • llvm-objdump-9 --dis-symname "-[ViewController isValidPin:]"
  • llvm-objdump-9 --macho --dis-symname "-[ViewController isValidPin:]"
  • llvm-objdump-9 --macho --dis-symname "isValidPin"
  • llvm-objdump-9 --macho --dis-symname "- isValidPin"
  • llvm-objdump-9 --macho --dis-symname "- isValidPin:"
  • llvm-objdump-9 --macho --dis-symname "-isValidPin:"

If I use --disassemble-functions with all of the above variations on the command name it just shows all the disassembly and not just isValidPin, including if I add the --demangle flag.

If I try and do it using --start address, i.e.:

llvm-objdump-9 --macho --start-address=100005a54

or 0x100005a54 I get the following error:

llvm-objdump-9: for the   --start-address option: '100005a54' value invalid for ulong argument!

If I convert that to decimal instead it just shows the usage again. If I add a stop address as well it shows the usage regardless of whether that is in hex or dec.

I came across this similar question however it is trying to do this on macOS and also the answer there is just suggesting what I have tried.

The only other mention I can find of llvm-objdump on here is me answering another question.

Googling just seems to lead me to different versions of the man page or discussion on commits to the source.

1 Answer 1

0

I just tested this on a sample binary using single quotes around the sym name:

0000d2a0 l F __TEXT,__text -[MasterViewController managedObjectContext]

$ llvm-objdump-9.0 -m -d --dis-symname '-[MasterViewController managedObjectContext]' MachO-iOS-armv7s-Helloworld 
MachO-iOS-armv7s-Helloworld:
(__TEXT,__text) section
-[MasterViewController managedObjectContext]:
    d2a0:   82 b0   sub sp, #8
    d2a2:   43 f6 2a 12 movw    r2, #14634
    d2a6:   c0 f2 00 02 movt    r2, #0
    d2aa:   7a 44   add r2, pc
    d2ac:   01 90   str r0, [sp, #4]
    d2ae:   00 91   str r1, [sp]
    d2b0:   01 98   ldr r0, [sp, #4]
    d2b2:   11 68   ldr r1, [r2]
    d2b4:   08 44   add r0, r1
    d2b6:   00 68   ldr r0, [r0]
    d2b8:   02 b0   add sp, #8
    d2ba:   70 47   bx  lr

Maybe single quotes are the missing piece.

1
  • Thank you Mega Tonnage! The problem was that I had not included -d. As the description for --dis-symname is "disassemble just this symbol's instructions (requires -macho)" I wrongfully assumed you wouldn't also have to tell the command to disassemble with -d but that was pretty much the only combination I hadn't tried. It works with " or ' as long as you include -d. Thanks again.
    – Jon
    Jul 5 at 8:49

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.