Questions tagged [objdump]
A well known disassembler from the GNU `binutils` package. Only based on the linear sweep techniques and a few more heuristics when symbols can help.
58 questions
1
vote
1
answer
119
views
binwalk guess wrong LZ4 compressed data format
I have a stock Netgear switch firmware file:
https://www.downloads.netgear.com/files/GDC/GS316EP/GS316EP_GS316EPP_V1.0.3.7.zip
When I do binwalk, it gives me at position 0x769BDC a description as &...
- 35
0
votes
0
answers
86
views
Find offset to parameter not listed in objdump in vmlinux (which contains debug symbols)
I have a series of address offsets for ubuntu that are used in a custom toolset. I'd like to build a set of offsets for another kernel, but I can't find some ubuntu offset addresses in the debug ...
- 1
1
vote
1
answer
229
views
PowerPC disassemble with objdump
I am trying to disassemble PowerPC dump with objdump. I have only raw binary dump, not ELF or any other 'container'.
Unfortunately, I cannot find any option to force VLE mode (my binary definitely ...
- 168
0
votes
1
answer
108
views
ELF - Why does objdump provide a wrong byte value in the .got?
I seriously can't tell if I'm misunderstanding something grossly or if this is a bug in objdump. Newbie alert.
$ objdump -s --start-address=0x3fc0 --stop-address=0x3fc1 test
test: file format ...
0
votes
0
answers
975
views
How to get global variables with objdump from ELF files
I have compiled this program with gcc
#include <stdio.h>
const char* message = "Outside defined";
int a = 1337;
int b = 10;
int c = 9;
int d = 8;
int e = 7;
int main () {return 0;}
...
- 115
2
votes
0
answers
63
views
Bin format of H8300
I am trying to analyze some binary files that are supposedly from a H8300 processor. I found this question that mentioned objdump supports H8300 but when I use the command I get the following error:
...
- 141
1
vote
0
answers
2k
views
How can i get the address of a function in memory?
I am currently completing a CTF exercise where i must attempt to overwrite a function pointer on the stack through a buffer overflow here is the code:
#include <err.h>
#include <stdio.h>
#...
0
votes
1
answer
569
views
Output from gcc containing all included source code?
Right now, I'm using a combination of gcc -g and the objdump -S modes to generate assembly code with debug source code interleaved. However, I'm having trouble correlating some of the functions that ...
- 1,026
2
votes
1
answer
813
views
Disassemble specific mach-o function
I have a mach-o binary and using llvm-objdump version 9 I can disassemble it. I would like to disassemble only a single function though.
If I display the symbol table with --syms I can see the ...
- 187
2
votes
1
answer
2k
views
Understanding disassembly information from Visual Studio's dumpbin and GNU's objdump
I usually write my code on Windows, and there are two different types of development environments, each providing their own tools to view the assembly code of an object file(*.obj) or executable (*....
- 143
1
vote
0
answers
152
views
inspecting the .hex file generated by gpasm
To answer my own question here, I wrote a small sample program, example.asm:
var_1 equ H'0001'
constant var_2=H'0002'
#define var_3 H'0003'
cblock H'0004'
var_4
endc
END
and compiled ...
- 189
1
vote
0
answers
221
views
Confusing objdump with data as code
I am trying to confuse objdump to solve the first exercise of chapter 6 in Practical Binary Analysis. Admittedly I am super weak with inline assembler but I made a best-effort attempt and tried to get ...
- 111
2
votes
0
answers
680
views
Tool/parser for symbol tables produced with objdump -t to be used with IDA / Ghidra?
Working with a binary (arm64) file that seems to be some sort of a broken ELF file. The header data is missing and for some reason it contains a symbol table in a format that to me seem to be equal to ...
- 121
0
votes
1
answer
95
views
Objdump -S without assembly
I compiled my c source code and got an elf.
I use "objdump -Sl" but don't need the assembly instructions.
Is there a way to use objdump without the assembly part (or other tool)?
for example,...
- 1
0
votes
0
answers
155
views
objdump says "64-bit address is disabled"
I've run into an issue with the MinGW build of objdump on Windows. Consider this very simple input file:
48 bf 88 77 66 55 44 33 22 11
I want to disassemble this as Intel x86-64 raw machine code. I ...
- 101
0
votes
1
answer
227
views
Link decompiled C code to Assembly (retdec decompiled object into C code, but with many errors, i found the kill switch which i need to edit)
I am using retdec to decompile a piece of software. It has a "kill switch" to detect if it's being run in an untrusted environment, in the decompiled code it just a simple
if (env_untrusted()...
1
vote
0
answers
415
views
How to parse objdump output data?
I'm somehow newbe in reverse engineering and currently I'm reading RE4B book.
In the image above:
I can't figure out the role of s in the functions f1 and f2. As far as I know, based on the last ...
- 207
1
vote
0
answers
185
views
Lexer and parser for .asm file produced by objdump
Is there any existing project that parses the x86 disassembly file or .asm produced by the objdump or IDA pro using the lexer and parser library in python or any other programming language?
- 11
0
votes
2
answers
3k
views
How to get address or symbol of the usage of a constant located in rodata?
I have an elf executable. I found a string (awesome string) in my .rodata section:
$ mb-readelf -p 10 a.out
String dump of section '.rodata':
[ 0] Hello world
...
[ ab12] awesome string
......
- 111
3
votes
0
answers
1k
views
disassembly - bad results generated with ghidra but not with objdump and IDA
I am using Ghidra to analyze libpng-compat.1.5.10.so (downloaded from Fedora mirrors).
But it didn't load the expected disassembly. Then I used Objdump and IDA to check the code and they get the same ...
- 51
1
vote
2
answers
4k
views
What does objdump -b binary means?
So I have started to digging in malware analysis and I came across with some malware samples that I couldn't disassembly with objdump. More specifically I use
objdump -dS /path/to/malware
and I got ...
- 23
2
votes
1
answer
705
views
How can I objdump the assembler code of dynamically linked functions in a dynamically linked executable?
Compiling a minimal C++ program:
g++ -g -Wall -Wextra -std=c++17 -o prog main.cpp
int main()
{
}
Performing an objdump -C -D prog of all sections I am given the following output:
prog: file ...
- 123
2
votes
0
answers
475
views
How to use arm-none-eabi-objcopy to extract texts, translate, and rebuild ELF file
I have this arm elf file: https://www20.zippyshare.com/v/2yLS1H8D/file.html
I want to extract the user-interface texts to translate them to my local language.
I found the section containing the texts ...
- 21
1
vote
3
answers
16k
views
Use GCC and objdump to disassemble any hex to assembly code
What would be the best way (also fewer steps) to generate assembly code for a given hex code ? For e.g., if we know the architecture is x86, and given hex value 0x55, what is the best way to generate ...
- 111
1
vote
1
answer
11k
views
How do tools like objdump find names of functions and their start address in ELF binaries?
I have written a ELF parser that disassmbles the .text section using capstone
my problem is that i dont know how can i segment the text section based on functions and print the name of the function ...
- 207
1
vote
1
answer
946
views
Find functions names in .init_array section in unstripped library
Is it possible to find out all instances of static initialization in a elf dynamic library.
I can dump the array of function pointers in .init_array section via objdump command like this.
objdump -s -...
- 111
1
vote
1
answer
199
views
IDA plugin to view hex bytes similar to objdump
Is there a plugin or option in IDA that interleavs the hex bytes for
each instruction similar to the output of objdump? I.e. like this:
1800035f1: ff 15 19 5a 00 00 callq *0x5a19(%rip) ...
- 289
1
vote
0
answers
130
views
Missing Map from Java Native Method to C Code
When writing a C implementation for a native Java method in Android, the rule is to name the C function according to the convention "Java_com_...". But I encountered an APK in which there are no such ...
- 121
0
votes
1
answer
2k
views
Generate c like pseudo code from objdump output
Ida has a feature which generates pseudo code from assembly.
Is there a tool under Linux that make the same job, from objdump output for example ?
- 787
-2
votes
2
answers
2k
views
How can I export only the mnemonics from objdump (or any other program)?
I want to do an analysis with the mnemonics. I can export everything to text but I only need the last column. Any idea on how can I solve this?
In other words of this output of objdump (objdump -d ...
- 103
1
vote
3
answers
7k
views
How can I export only the opcodes from objdump (or any other program)
I have multiple malware files, I want to do an analysis with the opcodes. Im able to export everything to text but I only need the middle column. Any idea on how can I solve this?
In other words of ...
1
vote
2
answers
3k
views
newbie trying to understand disassembled code
I have been writing small C programs and then disassembling them to try to understand what is actually happening under the hood.
I am using mingw-w64 on Windows 7 for my work, and I have run into a ...
- 379
25
votes
1
answer
61k
views
Objdump - How to output text (eg ASCII strings) alongside assembly code?
Aim: I want to take hex and ascii data (derived from a binary file using xxd) and use Objdump (or a suitable other tool that Linux comes with) to output the memory addresses / offsets, assembly code, ...
- 375
3
votes
1
answer
852
views
How should I approach a basic CTF exploitation challenge?
Complete newbie alert so apologies on what you're about to read.
I've an executable I'm working with to achieve buffer overflow on. This is for an old CTF that has been and gone but I chose it to ...
- 221
9
votes
2
answers
27k
views
How to reverse engineer a Linux executable to find the parameters? [closed]
So I am on a Linux box with an executable.Vague - I know. This is what happens when I try and run it with an argument/parameter:
me@there:~$ ./theFile theOption -a
./theFile : option requires an ...
- 221
5
votes
2
answers
4k
views
Difference between objdump -r and -R switches
objdump man page says,
-r
--reloc
Print the relocation entries of the file. If used with -d or -D,
the relocations are printed interspersed with the disassembly.
-R
--dynamic-reloc
...
- 1,381
6
votes
1
answer
5k
views
(bad) opcodes of objdump
I'm trying to write my own disassembler for PE,PE+ and ELF executables but I'm stuck with a big problem on PE and PE+ executables.
I'm checking my work by comparing my output with objdump, and I ...
- 85
2
votes
1
answer
3k
views
disassemble elf file created by msfvenom
i create elf with this command: (Dowanlod file - is elf32)
msfvenom -p linux/x86/meterpreter/reverse_tcp LHOST=127.0.0.1 LPORT=5150 -f elf -o ./rt
and it works nicely, and i want disassemble it but ...
- 197
2
votes
2
answers
740
views
Stuck in x87 FLD instruction
I've been working for my final project which is a disassembler for AMD64 instruction set, and i was trying to disassemble machine code by hand to understand it correctly. But i got stuck at a x87 ...
- 85
4
votes
1
answer
2k
views
Why does objdump show dot dot dot?
I have an (ARM) object file that I want to inspect. There are some instructions that load addresses pointing to another area in the object file. I would like to see the contents of the area, but ...
user187
4
votes
1
answer
1k
views
Different disassembly for the same function?
I have this code:
#include <stdio.h>
int main()
{
printf("a=%d; b=%d; c=%d", 1, 2, 3);
return 0;
};
I compile it with gcc -g 3arg.cpp. Disassemble with objdump -d -M intel a.out. In the output ...
- 41
2
votes
1
answer
157
views
func_name.part.# in objdump disassembly
I was looking at an executable having GMP linked statically to it. The following seems weird.
Disassembly of section .text:
0000000000400e60 <refmpn_fill.part.4>:
400e60: 50 ...
- 1,381
2
votes
1
answer
1k
views
Set Breakpoint at Entry point fails (GDB)
I'm currently practicing some RE w/ GDB and am having issues simply stopping the run/start on the first/second instruction. I am new to GDB/RE and have a limited knowledge of some of GDB's inner ...
0
votes
1
answer
335
views
Mapping a high level statement back in assembly dump
Say, I have compiled a large code base, e.g. gzip/gmp/python/php etc. on Linux. Is there any means to map a high level C construct, e.g. assignment/if-else/for/while/Math expression back in the ...
- 1,381
3
votes
1
answer
178
views
Connecting a Motion Simulator to GTA
I'm trying to connect a real-life motion simulator to my pc gaming rig one game at a time. Since all the GTA games are super hackable (with respect to physics, map, & texture hacking), AND the ...
- 33
4
votes
1
answer
3k
views
How to find the size of an array in binary?
I'm currently learning RE and try to understand some basic c programs.
I've almost figure out some concepts, but right now i've no idea how to find the size of an array when i use objdump or gdb.
...
- 143
3
votes
1
answer
5k
views
Unable to dump malware assembly using objdump
I'm trying to dump assembly code of a ShellShock malware explained in this blog post:
MMD-0027-2014 - Linux ELF bash 0day (shellshock): The fun has only just begun... .
After dumping using objdump -...
3
votes
1
answer
500
views
Weird instruction identified on disassembler produced assembly code
Test is on x86 32bit Linux, Ubuntu 12.04, GCC 4.6.3 objdump 2.22
Basically when I use gcc to produce assembly code of function foo like this:
gcc -S foo.c -O2
At the end of function foo, I can get ...
- 2,485
3
votes
1
answer
889
views
conflict function name using objdump to disassemble
So basically when I am using objdump and readelf to disassemble some GNU Coreutils, I find a very weird situation like this:
readelf -s pr | grep bkm_scale
....
176: 08050620 118 FUNC LOCAL ...
- 2,485
3
votes
2
answers
2k
views
How to deal with this “lea” instructions generated by objdump?
So basically I am using objdump to disassemble a binary from `GNU Coreutils", on 32 bit Linux x86.
In the disassembled code, I found one "broken" instruction like this:
804bb49: 8d 04 ed 00 00 00 ...
- 2,485