Hot answers tagged

32

It is assumed here that Linux ELF32 binaries are being analyzed. Code and data such as strings are stored in separate parts of ELF binaries. To disassemble the parts containing code, use objdump -dj .text <binary_name>. To examine hard-coded string data, use readelf -x .rodata <binary_name> Instructions and Data are located in separate areas ...


17

It is possible to determine what command line arguments or options can be passed to a Linux executable. Of course, how this can be done will depend on the type and design of the program and on factors such as obfuscation, encryption, compression, etc. Hardcoded Documentation Linux executables designed to be easily usable by humans and whose behavior ...


10

To arrive to your _init function just continue execution. This will stop once again in the intended place. gdb -q test.out Reading symbols from test.out...done. (gdb) b _init Breakpoint 1 at 0x4003e0 (gdb) run Starting program: /home/[censored]/stk/test.out Breakpoint 1, _init (argc=1, argv=0x7fffffffe008, envp=0x7fffffffe018) ...


9

Most tools don't support a 'ignore that byte for disassembly' feature, only IDA, Hopper and a few others do. The only alternative is to patch the byte at 8049444 with a 90 NOP, or change your mind and not rely on basic tools.


8

use nm instead of strings. Undefined symbols (indicated by a U) will be resolved externally (by the libc or whatever), and T (or t) symbols are locally defined. Lowercase indicates a local symbol, uppercase a global symbol. Of course, this assumes there's a symbol table present. In your example, it's been stripped. In that case, you can do objdump -T file ...


8

The surprising part for me is objdump can recognize anything in a PE file. According to Wikipedia, .. PE is a modified version of the Unix COFF file format. PE/COFF is an alternative term in Windows development. so apparently there is just enough overlap in the headers to make it work (at least partially). The basic design of one is clearly based on the ...


8

That's not obfuscation, that's just the output of a lousy disassembler engine. Use IDA Pro instead. You can download an evaluation version for Linux from here.


7

This is just the ugly AT&T syntax. In Intel syntax it's: jmp dword ptr [eax*4+0x80509e4] And yes, it's most likely a jump table. You can switch objdump to Intel syntax by adding -M intel to the command line.


6

A call to malloc returns the address of the allocated memory in the eax register on x86, rax on x86_64, and r0 on ARM. Nothing is pushed on the stack. Check the line following the call to malloc & you'll understand ! You should check the calling conventions of your platform too. Suppose you have this in your code : int *p = malloc(sizeof(int) * ...


6

There's no easy way to do this, C doesn't have a concept of array sizes (at execute time), so the size isn't stored anywhere. You'll have to read the assembly code and (try to) understand it. Take the following program extern void *malloc(int); extern char *strcpy(char *dst, char *src); char firstname[80]; char lastname[80]; int main(void) { int ...


6

Strictly speaking it's not an instruction. It's the segment override prefix (prefixes are considered to be part of the instruction). Most memory accesses use DS segment selector by default except those involving ESP or EBP register (they default to SS) and some "string" instructions (movs, scas etc). Segment override prefixes allow you to use another ...


6

I see you're mixing up sections with functions. What you have provided in your question are functions necessary to an ELF binary to execute. For example, the _start function is usually the entry point of a binary and it will probably call the main function at some point. You can get the address of the entry of a binary using readelf -h on the binary file ...


6

This problem comes from the way objdump disassemble a binary. The technique used here is called linear sweep, it is done by starting at the beginning of each symbol in all the sections that are flagged as CODE and disassemble instruction after instruction, supposing that what follow an instruction is also an instruction. The problem with this disassembly ...


5

From http://www.delorie.com/gnu/docs/gdb/gdb_29.html: GDB normally ignores breakpoints when it resumes execution, until at least one instruction has been executed. If it did not do this, you would be unable to proceed past a breakpoint without first disabling the breakpoint. This rule applies whether or not the breakpoint already existed when your program ...


5

The answer to your question is fairly easy. You can either use the nm command with the -D switch (or --dynamic), or use objdump with the -T switch. Both commands will output the dynamic symbol table entries and the libraries they originate from.


5

what does broken mean the instruction in either this post or in your earlier post do not seem to be broken if you are confused with AT&T syntax then you can ask objdump to disassemble in intel syntax a better explanation of broken can get a better answer root@box:/home/dsl/gcctests/test# cat testjt.c void naked (void) { asm( ".globl ...


5

I don't know what makes you think this instruction is "broken" - the fact that there is a comma right after a bracket, without a parameter in between? In this case, the disassembler just doesn't show the parameter because it's "zero" (more precisely, it specifies "no register" where "any processor register" would be allowed). What happens here is: when ...


5

Normally, return values are stored in eax. Structures and Floats/Doubles may be exceptions, depending on the ABI & the compiler used, but for malloc, eax is the return value. So nowhere on the stack. In your specific case: 8048553: e8 78 fe ff ff call 80483d0 <malloc@plt> 8048558: 89 44 24 18 mov %eax,0x18(%esp) ...


4

Address of main is the first argument to the __libc_start_main function. Let's look at the entrypoint code: xor %ebp,%ebp pop %esi mov %esp,%ecx and $0xfffffff0,%esp push %eax push %esp push %edx push $0x80486a0 push $0x8048630 push %ecx push %esi push $0x804853e call 8048410 <__libc_start_main@plt> hlt ...


4

-d only disassembles what objdump considers to be code sections. You can use -D to force disassembly of all sections. However, it still doesn't work for this file because it doesn't have a section table: fu4k: file format elf32-i386 fu4k architecture: i386, flags 0x00000102: EXEC_P, D_PAGED start address 0x08048054 Program Header: LOAD off ...


4

As everybody else is saying, in this case it is due to linear sweep. However, I would like to add that even IDA can be fooled with Junk Bytes and you can only trust the disassembly while debugging a sample. As encoders can change the code on the run, only trust the value on the EIP and nothing else to be correct code.


4

Looks like those are LOCAL definitions, perhaps defined in two places to allow slightly different versions to be used. They're not global functions, which would be constrained to only appear (or be defined) once. Perhaps defined in several files, statically, so they're only used (or scoped to) in that particular file. I don't see those functions in the ...


3

... are printed for repeated zero bytes, since that is usually filler data and not interesting. You can use -z, --disassemble-zeroes switch to force their disassembly anyway.


3

It's called partial inlining: Partial inlining is closely related to function outlining. Rather than inlining the entire body into a call site, the compiler may choose to inline part of the called function (typically a hot fragment at the start of the function with an early return).


3

Those are not sections, those are different functions in your binary. These are called in various times during process' lifetime. What you are interested in is function main. objdump -d disassembles the whole binary, but if you are trying to understand what's going on in main only, at this point , you don't have to look at the rest of those. When you use ...


3

There is no need for plugins. Just enter a non-zero value in "Number of opcode bytes" in Options-General-... Disassembly.


3

The point of dynamic linking a library is not including the library in the object, so the sections you want to disassemble just aren't there. You could even replace the dynamic library (the .so object) with something else, which could result in different code being run by your same main program. So you first need to identify which dynamic objects are ...


2

What's these instruction sequences for? They are for code optimization. CPU cache To optimize memory accesses, the CPU uses its own (small) internal memory called cache. It usually consists of several levels named L1, L2 etc. A lower suffix number means that the memory is located closer to the CPU core, thus is faster to access, but it's smaller as well. ...


2

Well, from the objdump listing you provided it's pretty obvious that this binary file has been stripped out of all symbols. This is why you won't be able to find the main symbol or any other function's symbol but those originating from an external library. But, given that this binary file is an ELF, you can run the readelf -h command on it and get the Entry ...


2

Not sure if I get this the right way but want to create physical feedback of the simulated car in game to your real seat/cockpit and also drive it from there. (something like Plane HW simulators) Driving that should be pretty easy just use joystick and some keyboard messages inserter (or real hacked keyboard). I assume you already know how to do this part ...


Only top voted, non community-wiki answers of a minimum length are eligible