Disassemble specific mach-o function

Question

I have a mach-o binary and using llvm-objdump version 9 I can disassemble it. I would like to disassemble only a single function though.

If I display the symbol table with --syms I can see the function I would like to disassemble:

0000000100005a54 l     F __TEXT,__text -[ViewController isValidPin:]

however I cannot work out the proper command to do this.

I have tried the following options which all just result in the usage being displayed and no indication what the issue is with the command:

• llvm-objdump-9 --dis-symname "-[ViewController isValidPin:]"
• llvm-objdump-9 --macho --dis-symname "-[ViewController isValidPin:]"
• llvm-objdump-9 --macho --dis-symname "isValidPin"
• llvm-objdump-9 --macho --dis-symname "- isValidPin"
• llvm-objdump-9 --macho --dis-symname "- isValidPin:"
• llvm-objdump-9 --macho --dis-symname "-isValidPin:"

If I use --disassemble-functions with all of the above variations on the command name it just shows all the disassembly and not just isValidPin, including if I add the --demangle flag.

If I try and do it using --start address, i.e.:

llvm-objdump-9 --macho --start-address=100005a54

or 0x100005a54 I get the following error:

llvm-objdump-9: for the   --start-address option: '100005a54' value invalid for ulong argument!

If I convert that to decimal instead it just shows the usage again. If I add a stop address as well it shows the usage regardless of whether that is in hex or dec.

I came across this similar question however it is trying to do this on macOS and also the answer there is just suggesting what I have tried.

The only other mention I can find of llvm-objdump on here is me answering another question.

Googling just seems to lead me to different versions of the man page or discussion on commits to the source.

Answer 1

I just tested this on a sample binary using single quotes around the sym name:

0000d2a0 l F __TEXT,__text -[MasterViewController managedObjectContext]

$ llvm-objdump-9.0 -m -d --dis-symname '-[MasterViewController managedObjectContext]' MachO-iOS-armv7s-Helloworld 
MachO-iOS-armv7s-Helloworld:
(__TEXT,__text) section
-[MasterViewController managedObjectContext]:
    d2a0:   82 b0   sub sp, #8
    d2a2:   43 f6 2a 12 movw    r2, #14634
    d2a6:   c0 f2 00 02 movt    r2, #0
    d2aa:   7a 44   add r2, pc
    d2ac:   01 90   str r0, [sp, #4]
    d2ae:   00 91   str r1, [sp]
    d2b0:   01 98   ldr r0, [sp, #4]
    d2b2:   11 68   ldr r1, [r2]
    d2b4:   08 44   add r0, r1
    d2b6:   00 68   ldr r0, [r0]
    d2b8:   02 b0   add sp, #8
    d2ba:   70 47   bx  lr

Maybe single quotes are the missing piece.