Questions tagged [objdump]

A well known disassembler from the GNU `binutils` package. Only based on the linear sweep techniques and a few more heuristics when symbols can help.

Filter by
Sorted by
Tagged with
1 vote
1 answer
31 views

Disassemble specific mach-o function

I have a mach-o binary and using llvm-objdump version 9 I can disassemble it. I would like to disassemble only a single function though. If I display the symbol table with --syms I can see the ...
user avatar
  • 107
1 vote
1 answer
68 views

Understanding disassembly information from Visual Studio's dumpbin and GNU's objdump

I usually write my code on Windows, and there are two different types of development environments, each providing their own tools to view the assembly code of an object file(*.obj) or executable (*....
user avatar
  • 123
0 votes
0 answers
35 views

inspecting the .hex file generated by gpasm

To answer my own question here, I wrote a small sample program, example.asm: var_1 equ H'0001' constant var_2=H'0002' #define var_3 H'0003' cblock H'0004' var_4 endc END and compiled ...
user avatar
  • 159
1 vote
0 answers
103 views

Confusing objdump with data as code

I am trying to confuse objdump to solve the first exercise of chapter 6 in Practical Binary Analysis. Admittedly I am super weak with inline assembler but I made a best-effort attempt and tried to get ...
user avatar
  • 111
1 vote
0 answers
287 views

Tool/parser for symbol tables produced with objdump -t to be used with IDA / Ghidra?

Working with a binary (arm64) file that seems to be some sort of a broken ELF file. The header data is missing and for some reason it contains a symbol table in a format that to me seem to be equal to ...
user avatar
0 votes
1 answer
48 views

Objdump -S without assembly

I compiled my c source code and got an elf. I use "objdump -Sl" but don't need the assembly instructions. Is there a way to use objdump without the assembly part (or other tool)? for example,...
user avatar
  • 1
0 votes
0 answers
60 views

objdump says "64-bit address is disabled"

I've run into an issue with the MinGW build of objdump on Windows. Consider this very simple input file: 48 bf 88 77 66 55 44 33 22 11 I want to disassemble this as Intel x86-64 raw machine code. I ...
user avatar
0 votes
1 answer
106 views

Link decompiled C code to Assembly (retdec decompiled object into C code, but with many errors, i found the kill switch which i need to edit)

I am using retdec to decompile a piece of software. It has a "kill switch" to detect if it's being run in an untrusted environment, in the decompiled code it just a simple if (env_untrusted()...
user avatar
1 vote
0 answers
163 views

How to parse objdump output data?

I'm somehow newbe in reverse engineering and currently I'm reading RE4B book. In the image above: I can't figure out the role of s in the functions f1 and f2. As far as I know, based on the last ...
user avatar
0 votes
0 answers
75 views

Lexer and parser for .asm file produced by objdump

Is there any existing project that parses the x86 disassembly file or .asm produced by the objdump or IDA pro using the lexer and parser library in python or any other programming language?
user avatar
  • 1
0 votes
2 answers
812 views

How to get address or symbol of the usage of a constant located in rodata?

I have an elf executable. I found a string (awesome string) in my .rodata section: $ mb-readelf -p 10 a.out String dump of section '.rodata': [ 0] Hello world ... [ ab12] awesome string ......
user avatar
3 votes
0 answers
832 views

disassembly - bad results generated with ghidra but not with objdump and IDA

I am using Ghidra to analyze libpng-compat.1.5.10.so (downloaded from Fedora mirrors). But it didn't load the expected disassembly. Then I used Objdump and IDA to check the code and they get the same ...
user avatar
1 vote
2 answers
2k views

What does objdump -b binary means?

So I have started to digging in malware analysis and I came across with some malware samples that I couldn't disassembly with objdump. More specifically I use objdump -dS /path/to/malware and I got ...
user avatar
  • 23
2 votes
1 answer
267 views

How can I objdump the assembler code of dynamically linked functions in a dynamically linked executable?

Compiling a minimal C++ program: g++ -g -Wall -Wextra -std=c++17 -o prog main.cpp int main() { } Performing an objdump -C -D prog of all sections I am given the following output: prog: file ...
user avatar
2 votes
0 answers
205 views

How to use arm-none-eabi-objcopy to extract texts, translate, and rebuild ELF file

I have this arm elf file: https://www20.zippyshare.com/v/2yLS1H8D/file.html I want to extract the user-interface texts to translate them to my local language. I found the section containing the texts ...
user avatar
  • 21
1 vote
3 answers
8k views

Use GCC and objdump to disassemble any hex to assembly code

What would be the best way (also fewer steps) to generate assembly code for a given hex code ? For e.g., if we know the architecture is x86, and given hex value 0x55, what is the best way to generate ...
user avatar
  • 11
1 vote
1 answer
7k views

How do tools like objdump find names of functions and their start address in ELF binaries?

I have written a ELF parser that disassmbles the .text section using capstone my problem is that i dont know how can i segment the text section based on functions and print the name of the function ...
user avatar
  • 197
1 vote
1 answer
566 views

Find functions names in .init_array section in unstripped library

Is it possible to find out all instances of static initialization in a elf dynamic library. I can dump the array of function pointers in .init_array section via objdump command like this. objdump -s -...
user avatar
1 vote
1 answer
138 views

IDA plugin to view hex bytes similar to objdump

Is there a plugin or option in IDA that interleavs the hex bytes for each instruction similar to the output of objdump? I.e. like this: 1800035f1: ff 15 19 5a 00 00 callq *0x5a19(%rip) ...
user avatar
1 vote
0 answers
85 views

Missing Map from Java Native Method to C Code

When writing a C implementation for a native Java method in Android, the rule is to name the C function according to the convention "Java_com_...". But I encountered an APK in which there are no such ...
user avatar
0 votes
1 answer
1k views

Generate c like pseudo code from objdump output

Ida has a feature which generates pseudo code from assembly. Is there a tool under Linux that make the same job, from objdump output for example ?
user avatar
  • 593
-2 votes
2 answers
1k views

How can I export only the mnemonics from objdump (or any other program)?

I want to do an analysis with the mnemonics. I can export everything to text but I only need the last column. Any idea on how can I solve this? In other words of this output of objdump (objdump -d ...
user avatar
  • 103
1 vote
3 answers
5k views

How can I export only the opcodes from objdump (or any other program)

I have multiple malware files, I want to do an analysis with the opcodes. Im able to export everything to text but I only need the middle column. Any idea on how can I solve this? In other words of ...
user avatar
1 vote
2 answers
2k views

newbie trying to understand disassembled code

I have been writing small C programs and then disassembling them to try to understand what is actually happening under the hood. I am using mingw-w64 on Windows 7 for my work, and I have run into a ...
user avatar
  • 379
23 votes
1 answer
52k views

Objdump - How to output text (eg ASCII strings) alongside assembly code?

Aim: I want to take hex and ascii data (derived from a binary file using xxd) and use Objdump (or a suitable other tool that Linux comes with) to output the memory addresses / offsets, assembly code, ...
user avatar
3 votes
1 answer
687 views

How should I approach a basic CTF exploitation challenge?

Complete newbie alert so apologies on what you're about to read. I've an executable I'm working with to achieve buffer overflow on. This is for an old CTF that has been and gone but I chose it to ...
user avatar
  • 221
9 votes
2 answers
23k views

How to reverse engineer a Linux executable to find the parameters? [closed]

So I am on a Linux box with an executable.Vague - I know. This is what happens when I try and run it with an argument/parameter: me@there:~$ ./theFile theOption -a ./theFile : option requires an ...
user avatar
  • 221
5 votes
2 answers
3k views

Difference between objdump -r and -R switches

objdump man page says, -r --reloc Print the relocation entries of the file. If used with -d or -D, the relocations are printed interspersed with the disassembly. -R --dynamic-reloc ...
user avatar
  • 1,261
5 votes
1 answer
4k views

(bad) opcodes of objdump

I'm trying to write my own disassembler for PE,PE+ and ELF executables but I'm stuck with a big problem on PE and PE+ executables. I'm checking my work by comparing my output with objdump, and I ...
user avatar
  • 75
2 votes
1 answer
3k views

disassemble elf file created by msfvenom

i create elf with this command: (Dowanlod file - is elf32) msfvenom -p linux/x86/meterpreter/reverse_tcp LHOST=127.0.0.1 LPORT=5150 -f elf -o ./rt and it works nicely, and i want disassemble it but ...
user avatar
  • 177
2 votes
2 answers
631 views

Stuck in x87 FLD instruction

I've been working for my final project which is a disassembler for AMD64 instruction set, and i was trying to disassemble machine code by hand to understand it correctly. But i got stuck at a x87 ...
user avatar
  • 75
3 votes
1 answer
1k views

Why does objdump show dot dot dot?

I have an (ARM) object file that I want to inspect. There are some instructions that load addresses pointing to another area in the object file. I would like to see the contents of the area, but ...
user avatar
4 votes
1 answer
1k views

Different disassembly for the same function?

I have this code: #include <stdio.h> int main() { printf("a=%d; b=%d; c=%d", 1, 2, 3); return 0; }; I compile it with gcc -g 3arg.cpp. Disassemble with objdump -d -M intel a.out. In the output ...
user avatar
2 votes
1 answer
149 views

func_name.part.# in objdump disassembly

I was looking at an executable having GMP linked statically to it. The following seems weird. Disassembly of section .text: 0000000000400e60 <refmpn_fill.part.4>: 400e60: 50 ...
user avatar
  • 1,261
2 votes
1 answer
822 views

Set Breakpoint at Entry point fails (GDB)

I'm currently practicing some RE w/ GDB and am having issues simply stopping the run/start on the first/second instruction. I am new to GDB/RE and have a limited knowledge of some of GDB's inner ...
user avatar
0 votes
1 answer
298 views

Mapping a high level statement back in assembly dump

Say, I have compiled a large code base, e.g. gzip/gmp/python/php etc. on Linux. Is there any means to map a high level C construct, e.g. assignment/if-else/for/while/Math expression back in the ...
user avatar
  • 1,261
3 votes
1 answer
164 views

Connecting a Motion Simulator to GTA

I'm trying to connect a real-life motion simulator to my pc gaming rig one game at a time. Since all the GTA games are super hackable (with respect to physics, map, & texture hacking), AND the ...
user avatar
4 votes
1 answer
3k views

How to find the size of an array in binary?

I'm currently learning RE and try to understand some basic c programs. I've almost figure out some concepts, but right now i've no idea how to find the size of an array when i use objdump or gdb. ...
user avatar
  • 143
3 votes
1 answer
4k views

Unable to dump malware assembly using objdump

I'm trying to dump assembly code of a ShellShock malware explained in this blog post: MMD-0027-2014 - Linux ELF bash 0day (shellshock): The fun has only just begun... . After dumping using objdump -...
user avatar
3 votes
1 answer
439 views

Weird instruction identified on disassembler produced assembly code

Test is on x86 32bit Linux, Ubuntu 12.04, GCC 4.6.3 objdump 2.22 Basically when I use gcc to produce assembly code of function foo like this: gcc -S foo.c -O2 At the end of function foo, I can get ...
user avatar
3 votes
1 answer
726 views

conflict function name using objdump to disassemble

So basically when I am using objdump and readelf to disassemble some GNU Coreutils, I find a very weird situation like this: readelf -s pr | grep bkm_scale .... 176: 08050620 118 FUNC LOCAL ...
user avatar
3 votes
2 answers
2k views

How to deal with this “lea” instructions generated by objdump?

So basically I am using objdump to disassemble a binary from `GNU Coreutils", on 32 bit Linux x86. In the disassembled code, I found one "broken" instruction like this: 804bb49: 8d 04 ed 00 00 00 ...
user avatar
4 votes
1 answer
427 views

How to deal with this "error" instructions generated by objdump?

So basically I am using objdump to disassemble a binary from GNU Coreutils, on 32-bit Linux x86. In the disassembled code, I found one "broken" instruction like this: 804b4db: ff 24 85 e4 09 ...
user avatar
2 votes
2 answers
3k views

At which address on the stack or in memory is eax stored after the malloc call? [closed]

Here is my objdump -d snippet with the malloc call and surrounding code. This binary is stripped. dbgLab.bin: file format elf32-i386 080483d0 <malloc@plt>: 80483d0: ff 25 04 a0 04 08 ...
user avatar
  • 385
1 vote
2 answers
638 views

What is the address of main() and how many bytes does it allocate on the stack for its frame size?

Here is my objdump -d output but I do not know where to look. I understand assembly but it is a little confusing trying to find out what the values of registers are at certain points. If anyone knows ...
user avatar
  • 385
7 votes
2 answers
7k views

How do I view external function calls in dynamically linked ELF binary in linux?

I used the file command in Linux to get information about a binary file. I am also looking for the addresses that these calls are located at. I think I can get this information from GDB or objdump but ...
user avatar
  • 385
5 votes
2 answers
2k views

What are the sections of a x86 linux binary?

I want to learn reverse engineering so I was starting to try compiling simple (to start with) C programs and then reading the disassembly. The following file int main(void) { return 0; } compiled ...
user avatar
11 votes
1 answer
26k views

Looking for exported symbols in a DLL with objdump?

I am a man full of contradictions, I am using Unix and, yet, I want to analyze a Microsoft Windows DLL. Usually, when looking for symbols in a dynamic or static library in the ELF World, one can ...
user avatar
  • 18.1k
7 votes
4 answers
2k views

Deal with obfuscated assembly

When using objdump I see the following disassembled code: 8049436: 89 04 24 mov DWORD PTR [esp],eax 8049439: e8 52 f7 ff ff call 8048b90 <gtk_entry_get_text@plt&...
user avatar
  • 173
7 votes
1 answer
891 views

GAS/x86 disassembled a bare gs register as an instruction, is it a bug?

I encountered a strange x86-32 instruction (opcode 0x65) decoded by objdump as gs (not %gs but gs). I found it while a full linear sweep of a binary (objdump -D), so the decoding was surely incorrect. ...
user avatar
  • 18.1k