3

So basically I am using objdump to disassemble a binary from GNU Coreutils, on 32-bit Linux x86.

In the disassembled code, I found one "broken" instruction like this:

 804b4db:       ff 24 85 e4 09 05 08    jmp    *0x80509e4(,%eax,4)

It seems like a disassemble error?

And, by digging into the section info, I figure out that 0x80509e4 inside the .rodata section.

So does it mean that 0x80509e4 is a jump table?

  • What are the opcodes of this instruction ? – perror May 7 '14 at 21:04
  • @perror Hello, I update my question – lllllllllllll May 8 '14 at 2:35
  • @perror Basically I think it should be a typical jump table instruction, am I right? – lllllllllllll May 8 '14 at 2:36
  • So, Igor answered, but the instruction is not broken at all. It just follow a strange syntax. When left empty, the argument is assumed to be 1 in memory addressing. And, yes, this is most likely a jump table. – perror May 9 '14 at 7:48
6

This is just the ugly AT&T syntax. In Intel syntax it's:

jmp dword ptr [eax*4+0x80509e4]

And yes, it's most likely a jump table.

You can switch objdump to Intel syntax by adding -M intel to the command line.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.