Wednesday, May 9, 2007

Disassembing an elf binary on x86 Linux

An ELF binary can be disassembled on an x86 Linux machine using objdump .

1. compile your file using gcc

> gcc test.c -o test

2. get the objdump

>objdump test -f -D --disassembler-options intel

This would print the assembly equivalent of the elf binary test .

The -f option displays summary information from the section headers of the object file. This displays the starting address from where the program would begin execution.

--disassembler-options intel prints the output assembly in intel format

See the man pages of objdump for a comprehensive explanation of the options.

The target of instructions like

jmp DWORD PTR ds:0x80496b0

can be obtained by

>objdump -R test

I will post more information about disassembling in a future post.

0 comments: