反汇编工具objdump

1.obj命令

Usage: objdump <option(s)> <file(s)>
 Display information from object <file(s)>.
 At least one of the following switches must be given:
  -a, --archive-headers    Display archive header information
  -f, --file-headers       Display the contents of the overall file header
  -p, --private-headers    Display object format specific file header contents
  -h, --[section-]headers  Display the contents of the section headers
  -x, --all-headers        Display the contents of all headers
  -d, --disassemble        Display assembler contents of executable sections
  -D, --disassemble-all    Display assembler contents of all sections
  -S, --source             Intermix source code with disassembly
  -s, --full-contents      Display the full contents of all sections requested
  -g, --debugging          Display debug information in object file
  -e, --debugging-tags     Display debug information using ctags style
  -G, --stabs              Display (in raw form) any STABS info in the file
  -W[lLiaprmfFsoR] or
  --dwarf[=rawline,=decodedline,=info,=abbrev,=pubnames,=aranges,=macro,=frames,=str,=loc,=Ranges]
                           Display DWARF info in the file
  -t, --syms               Display the contents of the symbol table(s)
  -T, --dynamic-syms       Display the contents of the dynamic symbol table
  -r, --reloc              Display the relocation entries in the file
  -R, --dynamic-reloc      Display the dynamic relocation entries in the file
  @<file>                  Read options from <file>
  -v, --version            Display this program's version number
  -i, --info               List object formats and architectures supported
  -H, --help               Display this information

 The following switches are optional:
  -b, --target=BFDNAME           Specify the target object format as BFDNAME
  -m, --architecture=MACHINE     Specify the target architecture as MACHINE
  -j, --section=NAME             Only display information for section NAME
  -M, --disassembler-options=OPT Pass text OPT on to the disassembler
  -EB --endian=big               Assume big endian format when disassembling
  -EL --endian=little            Assume little endian format when disassembling
      --file-start-context       Include context from start of file (with -S)
  -I, --include=DIR              Add DIR to search list for source files
  -l, --line-numbers             Include line numbers and filenames in output
  -F, --file-offsets             Include file offsets when displaying information
  -C, --demangle[=STYLE]         Decode mangled/processed symbol names
                                  The STYLE, if specified, can be `auto', `gnu',
                                  `lucid', `arm', `hp', `edg', `gnu-v3', `java'
                                  or `gnat'
  -w, --wide                     Format output for more than 80 columns
  -z, --disassemble-zeroes       Do not skip blocks of zeroes when disassembling
      --start-address=ADDR       Only process data whose address is >= ADDR
      --stop-address=ADDR        Only process data whose address is <= ADDR
      --prefix-addresses         Print complete address alongside disassembly
      --[no-]show-raw-insn       Display hex alongside symbolic disassembly
      --insn-width=WIDTH         Display WIDTH bytes on a signle line for -d
      --adjust-vma=OFFSET        Add OFFSET to all displayed section addresses
      --special-syms             Include special symbols in symbol dumps
      --prefix=PREFIX            Add PREFIX to absolute paths for -S
      --prefix-strip=LEVEL       Strip initial directory names for -S

*test为二进制文件

常用命令：

objdump -f test 输出文件header信息

objdump -h test/test.o 输出全部section header信息

objdump -x test 输出全部header信息

objdump -S test.o 输出反汇编

objdump -S test.o 

test.o:     file format elf32-littlearm


Disassembly of section .text:

00000000 <main>:
   0:   e92d4800        push    {fp, lr}
   4:   e28db004        add     fp, sp, #4
   8:   e24dd008        sub     sp, sp, #8
   c:   e50b0008        str     r0, [fp, #-8]
  10:   e50b100c        str     r1, [fp, #-12]
  14:   e59f2024        ldr     r2, [pc, #36]   ; 40 <main+0x40>
  18:   e59f3024        ldr     r3, [pc, #36]   ; 44 <main+0x44>
  1c:   e5933000        ldr     r3, [r3]
  20:   e1a00002        mov     r0, r2
  24:   e1a01003        mov     r1, r3
  28:   ebfffffe        bl      0 <printf>
  2c:   e3a03000        mov     r3, #0
  30:   e1a00003        mov     r0, r3
  34:   e24bd004        sub     sp, fp, #4
  38:   e8bd4800        pop     {fp, lr}
  3c:   e12fff1e        bx      lr

2.查看.bss和.data段

使用objdump -h可查看内存信息

如：

VMA(Virtual Memory Address):段在虚拟内存地址的位置

LMA(Local Memory Address):段在存储地址中的位置

Size: 段的大小，字节为单位

File off： File offset，段的起始位置
Algn：字节对齐方式，2**2表示2的平方即为4，2**3表示2的3次方即为8

这里面重要的有：
.text（代码段）
.data（数据段）
.bss （bss段，静态变量未初始化）

test_test:     file format elf32-little

Sections:
Idx Name          Size      VMA       LMA       File off  Algn
  0 .interp       00000013  00008134  00008134  00000134  2**0
                  CONTENTS, ALLOC, LOAD, READONLY, DATA
  1 .note.ABI-tag 00000020  00008148  00008148  00000148  2**2
                  CONTENTS, ALLOC, LOAD, READONLY, DATA
  2 .hash         00000028  00008168  00008168  00000168  2**2
                  CONTENTS, ALLOC, LOAD, READONLY, DATA
  3 .dynsym       00000050  00008190  00008190  00000190  2**2
                  CONTENTS, ALLOC, LOAD, READONLY, DATA
  4 .dynstr       00000043  000081e0  000081e0  000001e0  2**0
                  CONTENTS, ALLOC, LOAD, READONLY, DATA
  5 .gnu.version  0000000a  00008224  00008224  00000224  2**1
                  CONTENTS, ALLOC, LOAD, READONLY, DATA
  6 .gnu.version_r 00000020  00008230  00008230  00000230  2**2
                  CONTENTS, ALLOC, LOAD, READONLY, DATA
  7 .rel.dyn      00000008  00008250  00008250  00000250  2**2
                  CONTENTS, ALLOC, LOAD, READONLY, DATA
  8 .rel.plt      00000020  00008258  00008258  00000258  2**2
                  CONTENTS, ALLOC, LOAD, READONLY, DATA
  9 .init         0000000c  00008278  00008278  00000278  2**2
                  CONTENTS, ALLOC, LOAD, READONLY, CODE
 10 .plt          00000044  00008284  00008284  00000284  2**2
                  CONTENTS, ALLOC, LOAD, READONLY, CODE
 11 .text         0000015c  000082c8  000082c8  000002c8  2**2
                  CONTENTS, ALLOC, LOAD, READONLY, CODE
 12 .fini         00000008  00008424  00008424  00000424  2**2
                  CONTENTS, ALLOC, LOAD, READONLY, CODE
 13 .rodata       0000000c  0000842c  0000842c  0000042c  2**2
                  CONTENTS, ALLOC, LOAD, READONLY, DATA
 14 .ARM.exidx    00000008  00008438  00008438  00000438  2**2
                  CONTENTS, ALLOC, LOAD, READONLY, DATA
 15 .init_array   00000004  00010440  00010440  00000440  2**2
                  CONTENTS, ALLOC, LOAD, DATA
 16 .fini_array   00000004  00010444  00010444  00000444  2**2
                  CONTENTS, ALLOC, LOAD, DATA
 17 .jcr          00000004  00010448  00010448  00000448  2**2
                  CONTENTS, ALLOC, LOAD, DATA
 18 .dynamic      000000e8  0001044c  0001044c  0000044c  2**2
                  CONTENTS, ALLOC, LOAD, DATA
 19 .got          00000020  00010534  00010534  00000534  2**2
                  CONTENTS, ALLOC, LOAD, DATA
 20 .data         00000010  00010554  00010554  00000554  2**2
                  CONTENTS, ALLOC, LOAD, DATA
 21 .bss          00000004  00010564  00010564  00000564  2**0
                  ALLOC
 22 .ARM.attributes 00000031  00000000  00000000  00000564  2**0
                  CONTENTS, READONLY
 23 .comment      00000027  00000000  00000000  00000595  2**0
                  CONTENTS, READONLY
 24 .debug_aranges 00000020  00000000  00000000  000005bc  2**0
                  CONTENTS, READONLY, DEBUGGING
 25 .debug_pubnames 0000005f  00000000  00000000  000005dc  2**0
                  CONTENTS, READONLY, DEBUGGING
 26 .debug_info   000001bd  00000000  00000000  0000063b  2**0
                  CONTENTS, READONLY, DEBUGGING
 27 .debug_abbrev 0000011a  00000000  00000000  000007f8  2**0
                  CONTENTS, READONLY, DEBUGGING
 28 .debug_line   00000467  00000000  00000000  00000912  2**0
                  CONTENTS, READONLY, DEBUGGING
 29 .debug_frame  00000044  00000000  00000000  00000d7c  2**2
                  CONTENTS, READONLY, DEBUGGING
 30 .debug_str    00000162  00000000  00000000  00000dc0  2**0
                  CONTENTS, READONLY, DEBUGGING
 31 .debug_loc    00000099  00000000  00000000  00000f22  2**0
                  CONTENTS, READONLY, DEBUGGING
 32 .debug_macinfo 000093c3  00000000  00000000  00000fbb  2**0
                  CONTENTS, READONLY, DEBUGGING
 33 .debug_pubtypes 0000002f  00000000  00000000  0000a37e  2**0
                  CONTENTS, READONLY, DEBUGGING
 34 .debug_ranges 00000018  00000000  00000000  0000a3ad  2**0
                  CONTENTS, READONLY, DEBUGGING

1.obj命令

猜你喜欢