小编给大家分享一下Linux下如何使用objdump进行反汇编,希望大家阅读完这篇文章之后都有所收获,下面让我们一起去探讨吧!
objdump命令是Linux下的反汇编目标文件或者可执行文件的命令,它以一种可阅读的格式让你更多地了解二进制文件可能带有的附加信息。
1 objdump反汇编示例
源文件main.c
:
#include void swap(int* first, int* second){ int temp = *first; *first = *second; *second = temp;}int main(void){ int a = 10; int b = 20; printf("a = %d; b = %d;\n", a, b); swap(&a, &b); printf("a = %d; b = %d;\n", a, b); return 0;}123456789101112131415161718192021
1.1 显示main.c的汇编代码
gcc -S -o main.s main.c1
汇编文件main.s
.file "main.c" .text .globl swap .type swap, @functionswap:.LFB0: .cfi_startproc pushq %rbp .cfi_def_cfa_offset 16 .cfi_offset 6, -16 movq %rsp, %rbp .cfi_def_cfa_register 6 movq %rdi, -24(%rbp) movq %rsi, -32(%rbp) movq -24(%rbp), %rax ...12345678910111213141516
1.2 目标文件反汇编
gcc -c -o main.o main.cobjdump -s -d main.o > main.o.txt12
目标文件main.o
的反汇编结果输出到文件main.o.txt
反汇编同时显示源代码
gcc -g -c -o main.o main.cobjdump -S -d main.o > main.o.txt12
显示源代码同时显示行号
objdump -j .text -ld -C -S main.o > main.o.txt1
1.3 可执行文件反汇编
gcc -o main main.cobjdump -s -d main > main.txt12
反汇编同时显示源代码
gcc -g -o main main.cobjdump -S -d main > main.txt12
1.4 objdump反汇编常用参数
objdump -d
: 将代码段反汇编;objdump -S
: 将代码段反汇编的同时,将反汇编代码与源代码交替显示,编译时需要使用-g
参数,即需要调试信息;objdump -C
: 将C++符号名逆向解析objdump -l
: 反汇编代码中插入文件名和行号objdump -j section
: 仅反汇编指定的section
2 objdump帮助信息
输出objdump帮助信息: objdump --help
或者 man objdump
Usage: objdump Display information from object . At least one of the following switches must be given: -a, --archive-headers Display archive header information -f, --file-headers Display the contents of the overall file header -p, --private-headers Display object format specific file header contents -P, --private=OPT,OPT... Display object format specific contents -h, --[section-]headers Display the contents of the section headers -x, --all-headers Display the contents of all headers -d, --disassemble Display assembler contents of executable sections -D, --disassemble-all Display assembler contents of all sections -S, --source Intermix source code with disassembly -s, --full-contents Display the full contents of all sections requested -g, --debugging Display debug information in object file -e, --debugging-tags Display debug information using ctags style -G, --stabs Display (in raw form) any STABS info in the file -W[lLiaprmfFsoRt] or --dwarf[=rawline,=decodedline,=info,=abbrev,=pubnames,=aranges,=macro,=frames, =frames-interp,=str,=loc,=Ranges,=pubtypes, =gdb_index,=trace_info,=trace_abbrev,=trace_aranges, =addr,=cu_index] Display DWARF info in the file -t, --syms Display the contents of the symbol table(s) -T, --dynamic-syms Display the contents of the dynamic symbol table -r, --reloc Display the relocation entries in the file -R, --dynamic-reloc Display the dynamic relocation entries in the file @ Read options from -v, --version Display this program's version number -i, --info List object formats and architectures supported -H, --help Display this informationThe following switches are optional: -b, --target=BFDNAME Specify the target object format as BFDNAME -m, --architecture=MACHINE Specify the target architecture as MACHINE -j, --section=NAME Only display information for section NAME -M, --disassembler-options=OPT Pass text OPT on to the disassembler -EB --endian=big Assume big endian format when disassembling -EL --endian=little Assume little endian format when disassembling --file-start-context Include context from start of file (with -S) -I, --include=DIR Add DIR to search list for source files -l, --line-numbers Include line numbers and filenames in output -F, --file-offsets Include file offsets when displaying information -C, --demangle[=STYLE] Decode mangled/processed symbol names The STYLE, if specified, can be `auto', `gnu', `lucid', `arm', `hp', `edg', `gnu-v3', `java' or `gnat' -w, --wide Format output for more than 80 columns -z, --disassemble-zeroes Do not skip blocks of zeroes when disassembling --start-address=ADDR Only process data whose address is >= ADDR --stop-address=ADDR Only process data whose address is for -d --adjust-vma=OFFSET Add OFFSET to all displayed section addresses --special-syms Include special symbols in symbol dumps --prefix=PREFIX Add PREFIX to absolute paths for -S --prefix-strip=LEVEL Strip initial directory names for -S --dwarf-depth=N Do not display DIEs at depth N or greater --dwarf-start=N Display DIEs starting with N, at the same depth or deeper --dwarf-check Make additional dwarf internal consistency checks. objdump: supported targets: elf64-x86-64 elf32-i386 elf32-x86-64 a.out-i386-linux pei-i386 pei-x86-64 elf64-l1om elf64-k1om elf64-little elf64-big elf32-little elf32-big plugin srec symbolsrec verilog tekhex binary ihexobjdump: supported architectures: i386 i386:x86-64 i386:x64-32 i8086 i386:intel i386:x86-64:intel i386:x64-32:intel l1om l1om:intel k1om k1om:intel pluginThe following i386/x86-64 specific disassembler options are supported for usewith the -M switch (multiple options should be separated by commas): x86-64 Disassemble in 64bit mode i386 Disassemble in 32bit mode i8086 Disassemble in 16bit mode att Display instruction in AT&T syntax intel Display instruction in Intel syntax att-mnemonic Display instruction in AT&T mnemonic intel-mnemonic Display instruction in Intel mnemonic addr64 Assume 64bit address size addr32 Assume 32bit address size addr16 Assume 16bit address size data32 Assume 32bit data size data16 Assume 16bit data size suffix Always display instruction suffix in AT&T syntaxReport bugs to .12345678910111213141516171819202122232425262728293031323334353637383940414243444546474849505152535455565758596061626364656667686970717273747576777879808182
看完了这篇文章,相信你对“Linux下如何使用objdump进行反汇编”有了一定的了解,如果想了解更多相关知识,欢迎关注编程网行业资讯频道,感谢各位的阅读!