4

So basically I am using objdump to disassemble a binary from GNU Coreutils, on 32-bit Linux x86.

In the disassembled code, I found one "broken" instruction like this:

 804b4db:       ff 24 85 e4 09 05 08    jmp    *0x80509e4(,%eax,4)

It seems like a disassemble error?

And, by digging into the section info, I figure out that 0x80509e4 inside the .rodata section.

So does it mean that 0x80509e4 is a jump table?

4
  • What are the opcodes of this instruction ?
    – perror
    May 7, 2014 at 21:04
  • @perror Hello, I update my question May 8, 2014 at 2:35
  • @perror Basically I think it should be a typical jump table instruction, am I right? May 8, 2014 at 2:36
  • So, Igor answered, but the instruction is not broken at all. It just follow a strange syntax. When left empty, the argument is assumed to be 1 in memory addressing. And, yes, this is most likely a jump table.
    – perror
    May 9, 2014 at 7:48

1 Answer 1

7

This is just the ugly AT&T syntax. In Intel syntax it's:

jmp dword ptr [eax*4+0x80509e4]

And yes, it's most likely a jump table.

You can switch objdump to Intel syntax by adding -M intel to the command line.

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.