建站
咨詢
售后
建站咨詢
新聞中心
這里有您想知道的互聯(lián)網(wǎng)營銷解決方案
Linux下使用objdump進(jìn)行反匯編
objdump命令是Linux下的反匯編目標(biāo)文件或者可執(zhí)行文件的命令，它以一種可閱讀的格式讓你更多地了解二進(jìn)制文件可能帶有的附加信息，下面為大家講解一下Linux下使用objdump進(jìn)行反匯編方法。
1 objdump反匯編示例
源文件main.c：
/* main.c */
#include
void swap(int* first, int* second)
{
int temp = *first;
*first = *second;
*second = temp;
}
int main(void)
{
int a = 10;
int b = 20;
printf("a = %d; b = %d;\n", a, b);
swap(&a, &b);
printf("a = %d; b = %d;\n", a, b);
return 0;
}123456789101112131415161718192021
1.1 顯示main.c的匯編代碼
gcc -S -o main.s main.c1
匯編文件main.s
.file "main.c"
.text
.globl swap
.type swap, @function
swap:
.LFB0:
.cfi_startproc
pushq %rbp
.cfi_def_cfa_offset 16
.cfi_offset 6, -16
movq %rsp, %rbp
.cfi_def_cfa_register 6
movq %rdi, -24(%rbp)
movq %rsi, -32(%rbp)
movq -24(%rbp), %rax
...12345678910111213141516
1.2 目標(biāo)文件反匯編
gcc -c -o main.o main.c
objdump -s -d main.o > main.o.txt12
目標(biāo)文件main.o的反匯編結(jié)果輸出到文件main.o.txt 反匯編同時(shí)顯示源代碼
gcc -g -c -o main.o main.c
objdump -S -d main.o > main.o.txt12
顯示源代碼同時(shí)顯示行號
objdump -j .text -ld -C -S main.o > main.o.txt1
1.3 可執(zhí)行文件反匯編
gcc -o main main.c
objdump -s -d main > main.txt12
反匯編同時(shí)顯示源代碼
gcc -g -o main main.c
objdump -S -d main > main.txt12
1.4 objdump反匯編常用參數(shù)
-
objdump -d: 將代碼段反匯編；
-
objdump -S: 將代碼段反匯編的同時(shí)，將反匯編代碼與源代碼交替顯示，編譯時(shí)需要使用
-g參數(shù)，即需要調(diào)試信息；
-
objdump -C: 將C++符號名逆向解析
-
objdump -l: 反匯編代碼中插入文件名和行號
-
objdump -j section: 僅反匯編指定的section
2 objdump幫助信息
輸出objdump幫助信息： objdump --help 或者 man objdump
Usage: objdump
Display information from object
. At least one of the following switches must be given: -a, --archive-headers Display archive header information -f, --file-headers Display the contents of the overall file header -p, --private-headers Display object format specific file header contents -P, --private=OPT,OPT... Display object format specific contents -h, --[section-]headers Display the contents of the section headers -x, --all-headers Display the contents of all headers -d, --disassemble Display assembler contents of executable sections -D, --disassemble-all Display assembler contents of all sections -S, --
source Intermix
source code with disassembly -s, --full-contents Display the full contents of all sections requested -g, --debugging Display debug information
in object file -e, --debugging-tags Display debug information using ctags style -G, --stabs Display (
in raw form) any STABS info
in the file -W[lLiaprmfFsoRt] or --dwarf[=rawline,=decodedline,=info,=abbrev,=pubnames,=aranges,=macro,=frames, =frames-interp,=str,=loc,=Ranges,=pubtypes, =gdb_index,=trace_info,=trace_abbrev,=trace_aranges, =addr,=cu_index] Display DWARF info
in the file -t, --syms Display the contents of the symbol table(s) -T, --dynamic-syms Display the contents of the dynamic symbol table -r, --reloc Display the relocation entries
in the file -R, --dynamic-reloc Display the dynamic relocation entries
in the file @
Read options from
-v, --version Display this program
's version number -i, --info List object formats and architectures supported -H, --help Display this information The following switches are optional: -b, --target=BFDNAME Specify the target object format as BFDNAME -m, --architecture=MACHINE Specify the target architecture as MACHINE -j, --section=NAME Only display information for section NAME -M, --disassembler-options=OPT Pass text OPT on to the disassembler -EB --endian=big Assume big endian format when disassembling -EL --endian=little Assume little endian format when disassembling --file-start-context Include context from start of file (with -S) -I, --include=DIR Add DIR to search list for source files -l, --line-numbers Include line numbers and filenames in output -F, --file-offsets Include file offsets when displaying information -C, --demangle[=STYLE] Decode mangled/processed symbol names The STYLE, if specified, can be `auto', `gnu
', `lucid', `arm
', `hp', `edg
', `gnu-v3', `java
' or `gnat' -w, --wide Format output
for more than 80 columns -z, --disassemble-zeroes Do not skip blocks of zeroes when disassembling --start-address=ADDR Only process data whose address is >= ADDR --stop-address=ADDR Only process data whose address is for -d --adjust-vma=OFFSET Add OFFSET to all displayed section addresses --special-syms Include special symbols
in symbol dumps --prefix=PREFIX Add PREFIX to absolute paths
for -S --prefix-strip=LEVEL Strip initial directory names
for -S --dwarf-depth=N Do not display DIEs at depth N or greater --dwarf-start=N Display DIEs starting with N, at the same depth or deeper --dwarf-check Make additional dwarf internal consistency checks. objdump: supported targets: elf64-x86-64 elf32-i386 elf32-x86-64 a.out-i386-linux pei-i386 pei-x86-64 elf64-l1om elf64-k1om elf64-little elf64-big elf32-little elf32-big plugin srec symbolsrec verilog tekhex binary ihex objdump: supported architectures: i386 i386:x86-64 i386:x64-32 i8086 i386:intel i386:x86-64:intel i386:x64-32:intel l1om l1om:intel k1om k1om:intel plugin The following i386/x86-64 specific disassembler options are supported
for use with the -M switch (multiple options should be separated by commas): x86-64 Disassemble
in 64bit mode i386 Disassemble
in 32bit mode i8086 Disassemble
in 16bit mode att Display instruction
in AT&T syntax intel Display instruction
in Intel syntax att-mnemonic Display instruction
in AT&T mnemonic intel-mnemonic Display instruction
in Intel mnemonic addr64 Assume 64bit address size addr32 Assume 32bit address size addr16 Assume 16bit address size data32 Assume 32bit data size data16 Assume 16bit data size suffix Always display instruction suffix
in AT&T syntax Report bugs to
.12345678910111213141516171819202122232425262728293031323334353637383940414243444546474849505152535455565758596061626364656667686970717273747576777879808182
網(wǎng)頁標(biāo)題：Linux下使用objdump進(jìn)行反匯編
URL地址：http://www.dlmjj.cn/article/djejsdp.html
