Skip to main content
36 votes

Objdump - How to output text (eg ASCII strings) alongside assembly code?

It is assumed here that Linux ELF32 binaries are being analyzed. Code and data such as strings are stored in separate parts of ELF binaries. To disassemble the parts containing code, use objdump -...
julian's user avatar
  • 7,158
18 votes

How to reverse engineer a Linux executable to find the parameters?

It is possible to determine what command line arguments or options can be passed to a Linux executable. Of course, how this can be done will depend on the type and design of the program and on factors ...
julian's user avatar
  • 7,158
4 votes
Accepted

Why does objdump show dot dot dot?

... are printed for repeated zero bytes, since that is usually filler data and not interesting. You can use -z, --disassemble-zeroes switch to force their disassembly anyway.
Igor Skochinsky's user avatar
  • 36.7k
3 votes

Use GCC and objdump to disassemble any hex to assembly code

Linux binutils tools, such as objdump, gdb etc. rely on the BFD library, meaning they take well-formed ELF files, not arbitrary byte values or ASCII hex strings, as input. If you want to create your ...
julian's user avatar
  • 7,158
3 votes
Accepted

How can I objdump the assembler code of dynamically linked functions in a dynamically linked executable?

The point of dynamic linking a library is not including the library in the object, so the sections you want to disassemble just aren't there. You could even replace the dynamic library (the .so object)...
Guntram Blohm's user avatar
3 votes
Accepted

IDA plugin to view hex bytes similar to objdump

There is no need for plugins. Just enter a non-zero value in "Number of opcode bytes" in Options-General-... Disassembly.
Igor Skochinsky's user avatar
  • 36.7k
3 votes
Accepted

How can I export only the opcodes from objdump (or any other program)

If you want to extract all the opcode you can try to run this command: objdump -d ./your_program|grep '[0-9a-f]:'|grep -v 'file'|cut -f2 -d:|cut -f1-6 -d' '|tr -s ' '|tr '\t' ' '|sed 's/ $//g'|paste -...
invictus85's user avatar
3 votes

Difference between objdump -r and -R switches

Ordinary object file As the notes say, the -R is only meaningful for dynamic objects. For ordinary .o files from simple programs, the -r will show the relocation entries. As an example, this simple ...
Edward's user avatar
  • 2,521
3 votes
Accepted

(bad) opcodes of objdump

You are correct, and objdump is actually wrong to disassemble such instruction, only to mark it as (bad) in a later stage. Here is how it works: db a5 4e 9c 95 68 lock (bad) [rbp+0x68959c4e] db ...
Jongware's user avatar
  • 2,364
2 votes
Accepted

disassemble elf file created by msfvenom

Use a disassembler which supports ELF files with no sections (objdump is based on BFD library which cannot handle sectionless ELFs). Alternatively, disassemble it as plain binary, not ELF (objdump -...
Igor Skochinsky's user avatar
  • 36.7k
2 votes

Stuck in x87 FLD instruction

So this answer only focuses on the second question of @Efe: How is +eax*8 constructed. You can determine the SIB-offsets with the following steps. We analyze the first two bytes 04 c5 of the whole ...
knx's user avatar
  • 1,257
2 votes
Accepted

Weird instruction identified on disassembler produced assembly code

What's these instruction sequences for? They are for code optimization. CPU cache To optimize memory accesses, the CPU uses its own (small) internal memory called cache. It usually consists of ...
bart1e's user avatar
  • 3,399
2 votes

newbie trying to understand disassembled code

The stack is for data storage, not code I figured it out. It looks like the sub statement is allocating space for the entire program rounded to the nearest qword. Program 1 requires only 0x17 bytes ...
julian's user avatar
  • 7,158
2 votes

How should I approach a basic CTF exploitation challenge?

As OP's question is a bit vague and it seems he's more interested in general tips rather than an actual solution, I'm intentionally not focusing on answering the question at hand. If the vulnerable ...
NirIzr's user avatar
  • 11.8k
2 votes

Generate c like pseudo code from objdump output

No. IDA generates C-like pseudo code from object code. That is, the input to the decompiler is object code - not assembly language, which is represented in ASCII - and the output is a high-level ...
julian's user avatar
  • 7,158
2 votes

What does objdump -b binary means?

The -b switch specifies the format as binary, telling objdump to ignore the header and treat everything as instructions. The -D switch is also present in your question and this one means that objdump ...
Yotamz's user avatar
  • 1,227
2 votes

Use GCC and objdump to disassemble any hex to assembly code

You can do this using objdump: echo 0000: b0 55 15 de ad f1 55 | xxd -r > x.bin objdump -D -m i386 -b binary x.bin
Willem Hengeveld's user avatar
2 votes

How do tools like objdump find names of functions and their start address in ELF binaries?

In order to accomplish that you need some knowledge about ELF files. I'm not going explain every detail about ELF files since is a lot to cover so I'll try to be as precise as I can. NOTE #01: I will ...
Ricardo's user avatar
  • 501
2 votes

Find functions names in .init_array section in unstripped library

This can easily be achieved with radare2. I have this version installed [rese] r2 -v radare2 4.6.0-git 25072 @ linux-x86-64 git.4.4.0-486-ga5e8cf0c9 commit: a5e8cf0c9bd94e5f8d679e281c486584f23251e3 ...
sudhackar's user avatar
  • 2,709
2 votes

How can I export only the opcodes from objdump (or any other program)

you can use the multiple spaces pattern to rip the opcodes out $ objdump -d c:/windows/system32/calc.exe | sed s/.*:[[:space:]]//g | sed s/[[:space:]][[:space:]].*//g | head -n 10 Disassembly of ...
blabb's user avatar
  • 16.4k
2 votes

Difference between objdump -r and -R switches

Dynamic relocations are relocations applied by the dynamic linker (usually ld.so or equivalent), as opposed to the link editor (e.g. ld) for the object files' relocations. They are pointed to by the ...
Igor Skochinsky's user avatar
  • 36.7k
1 vote
Accepted

Understanding disassembly information from Visual Studio's dumpbin and GNU's objdump

Let's break it down. The first and most obvious difference is Intel syntax (dumpbin) vs. AT&T syntax (objdump) for the output you give. That's be the part of your question: Also why is the ...
0xC0000022L's user avatar
  • 10.9k
1 vote

Objdump -S without assembly

If you don't need assembly, just read the source file (main.c). objdump is a debug tool and by using it you can check what assembly instructions correspond to source lines. If you don't need this ...
Igor Skochinsky's user avatar
  • 36.7k
1 vote
Accepted

Link decompiled C code to Assembly (retdec decompiled object into C code, but with many errors, i found the kill switch which i need to edit)

Assuming, that executable is not packed, and if you got to the killswitch already, just select some asm commands and look for them in debugger. then you can change necessary bytes with NOP. No ...
Zurab's user avatar
  • 26
1 vote

How to get address or symbol of the usage of a constant located in rodata?

It cannot be solved in all cases. Some string (start) is not referenced in the whole text at all, even if you turned on all optimizations. Let's see the following example. #define _FILE strrchr(...
betontalpfa's user avatar
1 vote
Accepted

What does objdump -b binary means?

So, objdump's -d will only disassemble known code sections, usually .text and possibly other sections marked executable. If the section table is corrupted or missing, this will fail. However, the ...
Igor Skochinsky's user avatar
  • 36.7k
1 vote
Accepted

How can I export only the mnemonics from objdump (or any other program)?

getting start address objdump.exe -f calc.exe | grep start start address 0x01012d6c arguments passed to objdump via @File syntax where @File is disopt.txt containing arguments as below C:\>...
blabb's user avatar
  • 16.4k
1 vote

How can I export only the opcodes from objdump (or any other program)

This works best for me (and looks easier to understand IMO) objdump -r -j .text -d test | cut -d: -f2 | cut -d$'\t' -f 2 shellcode is best extracted via hexdump -v -e '"\\""x" 1/1 "%02x" ""' test
skyfire's user avatar
  • 111
1 vote

How to reverse engineer a Linux executable to find the parameters?

As I don't know much about your executable, I would first run strings with your program to see if anything comes up: this work if the binary has a description. (I'm stuck on a Windows now, but strings ...
shxdow's user avatar
  • 164

Only top scored, non community-wiki answers of a minimum length are eligible