Objdump - Revision history

Multimedia Mike: /* Common Usage */ more useful objdump options

2007-03-13T21:10:37Z

Common Usage: more useful objdump options

@@ Line 22: / Line 22: @@
 objdump requires that you supply at least some parameter. Here are some of the more interesting options for RE:
-   -d, --disassemble        Display assembler contents of executable sections
+   -d, --disassemble         Display assembler contents of executable sections
-   -D, --disassemble-all    Display assembler contents of all sections
+   -D, --disassemble-all     Display assembler contents of all sections
-   -T, --dynamic-syms       Display the contents of the dynamic symbol table
+   -T, --dynamic-syms        Display the contents of the dynamic symbol table
-   -r, --reloc              Display the relocation entries in the file
+   -r, --reloc               Display the relocation entries in the file
-   -R, --dynamic-reloc      Display the dynamic relocation entries in the file
+   -R, --dynamic-reloc       Display the dynamic relocation entries in the file
 To disassemble an executable ELF file:
@@ Line 56: / Line 61: @@
 Note the difference in the mov instruction syntax.
 [[Category:RE Tools]]

VAG: windows has similar tool too

2006-10-28T22:38:16Z

windows has similar tool too

← Older revision		Revision as of 15:38, 28 October 2006
Line 1:		Line 1:
	objdump is a standard component of the GNU binutils. It is useful for obtaining all kinds of information from an ELF file. This page describes some of its more common reverse engineering applications		objdump is a standard component of the GNU binutils. It is useful for obtaining all kinds of information from an ELF file. This page describes some of its more common reverse engineering applications

			''(If you prefer win32 platform, you may find tool [[dumpbin]].exe there (shipped with visual studio) offering similar functionality)''

	== Installation ==		== Installation ==

Multimedia Mike: /* Common Usage */ big 'R' vs. little 'r'

2006-10-28T20:30:45Z

Common Usage: big 'R' vs. little 'r'

← Older revision		Revision as of 13:30, 28 October 2006
Line 32:		Line 32:
	To disassemble a shared object (.so) ELF file:		To disassemble a shared object (.so) ELF file:

	objdump -dr <library.so>		objdump -dR <library.so>

	The -r option is invaluable for dealing with relocatable code. Without it, there will be a lot of calls that appear to call back to the same location, e.g.:		The -R option is invaluable for dealing with relocatable code. Without it, there will be a lot of calls that appear to call back to the same location, e.g.:

	5752: e8 fc ff ff ff call 5753 <free@plt+0xb3>		5752: e8 fc ff ff ff call 5753 <free@plt+0xb3>
	5757: 89 c3 mov %eax,%ebx		5757: 89 c3 mov %eax,%ebx

	The actual address will be patched in by the OS when the file is loaded. However, the -r option asks objdump to insert information about the relocation:		The actual address will be patched in by the OS when the file is loaded. However, the -R option asks objdump to insert information about the dynamic relocation:

	5752: e8 fc ff ff ff call 5753 <free@plt+0xb3>		5752: e8 fc ff ff ff call 5753 <free@plt+0xb3>
Line 47:		Line 47:
	Another useful option available for x86-targeted builds of objdump is the -Mintel option. This asks objdump to use Intel ASM syntax vs. AT&T syntax:		Another useful option available for x86-targeted builds of objdump is the -Mintel option. This asks objdump to use Intel ASM syntax vs. AT&T syntax:

	objdump -dr -Mintel <library.so>		objdump -dR -Mintel <library.so>

	5752: e8 fc ff ff ff call 5753 <free@plt+0xb3>		5752: e8 fc ff ff ff call 5753 <free@plt+0xb3>

Multimedia Mike: /* Installation */ typo

2006-10-28T20:25:09Z

Installation: typo

← Older revision		Revision as of 13:25, 28 October 2006
Line 15:		Line 15:
	* <arch> is the architecture to build for. Examine the file bfd/config.bfd to get an idea of what targets are available. As an example of what the target should look like, the target for PowerPC processor code stored in an ELF file is powerpc-elf.		* <arch> is the architecture to build for. Examine the file bfd/config.bfd to get an idea of what targets are available. As an example of what the target should look like, the target for PowerPC processor code stored in an ELF file is powerpc-elf.
	* <directory> is the base directory for the new binutils toolchain to be stored in. It helps to keep this separate from the native toolchain.		* <directory> is the base directory for the new binutils toolchain to be stored in. It helps to keep this separate from the native toolchain.
	* <prefix> indicates the prefix string that should be prepended to each of the ~~binutils tool~~ on installation. For example, if the program prefix is "powerpc-" then the built objdump tool will be named powerpc-objdump.		* <prefix> indicates the prefix string that should be prepended to each of the tools on installation. For example, if the program prefix is "powerpc-" then the built objdump tool will be named powerpc-objdump.

	== Common Usage ==		== Common Usage ==

Multimedia Mike: /* Common Usage */

2006-10-28T20:22:01Z

Common Usage

← Older revision		Revision as of 13:22, 28 October 2006
Line 18:		Line 18:

	== Common Usage ==		== Common Usage ==
			objdump requires that you supply at least some parameter. Here are some of the more interesting options for RE:

			-d, --disassemble Display assembler contents of executable sections
			-D, --disassemble-all Display assembler contents of all sections
			-T, --dynamic-syms Display the contents of the dynamic symbol table
			-r, --reloc Display the relocation entries in the file
			-R, --dynamic-reloc Display the dynamic relocation entries in the file

			To disassemble an executable ELF file:

			objdump -d <binary>

			To disassemble a shared object (.so) ELF file:

			objdump -dr <library.so>

			The -r option is invaluable for dealing with relocatable code. Without it, there will be a lot of calls that appear to call back to the same location, e.g.:

			5752: e8 fc ff ff ff call 5753 <free@plt+0xb3>
			5757: 89 c3 mov %eax,%ebx

			The actual address will be patched in by the OS when the file is loaded. However, the -r option asks objdump to insert information about the relocation:

			5752: e8 fc ff ff ff call 5753 <free@plt+0xb3>
			5753: R_386_PC32 malloc
			5757: 89 c3 mov %eax,%ebx

			Another useful option available for x86-targeted builds of objdump is the -Mintel option. This asks objdump to use Intel ASM syntax vs. AT&T syntax:

			objdump -dr -Mintel <library.so>

			5752: e8 fc ff ff ff call 5753 <free@plt+0xb3>
			5753: R_386_PC32 malloc
			5757: 89 c3 mov ebx,eax

			Note the difference in the mov instruction syntax.

	[[Category:RE Tools]]		[[Category:RE Tools]]

Multimedia Mike: installation

2006-10-28T19:53:12Z

installation

@@ Line 2: / Line 2: @@
 == Installation ==
 == Common Usage ==
 [[Category:RE Tools]]

Multimedia Mike at 19:40, 28 October 2006

2006-10-28T19:40:51Z

New page

objdump is a standard component of the GNU binutils. It is useful for obtaining all kinds of information from an ELF file. This page describes some of its more common reverse engineering applications

== Installation ==

== Common Usage ==

[[Category:RE Tools]]