Can a ELF binary be disassembled using objdump?
Only sections with instructions (.text, for example) should be disassembled using objdump.The -D argument to objdump will result in all sections of an ELF binary being disassembled, even non-code sections like .data and .rodata.
How to disassemble parts of Linux ELF binaries?
It is assumed here that Linux ELF32 binaries are being analyzed. Code and data such as strings are stored in separate parts of ELF binaries. To disassemble the parts containing code, use objdump -dj .text .
What does the text section do in Elf?
In ELF binaries, the .text section holds the executable instructions of the program. The bytes the instructions are composed of are being treated as ASCII in this hexdump, so there are meaningless sequences of characters being printed.
Where are the hardcoded strings located in Elf?
Code and hardcoded strings are not intermingled in x86 or x86-64 ELF binaries. When the compiler toolchain generates a binary, hardcoded strings are placed in a separate area of the binary from the executable code and are referenced/accessed by their virtual memory address.
How does objdump manage to display source code with?
objdump uses the DWARF debugging information compiled into the binary, which references the source file name. If the binary isn’t compiled with debugging information, or objdump can’t find the source file, then you don’t get source code in your output – only assembly.
How does arguments-b binary work in objdump?
Furthermore, the arguments -b binary result in objdump treating the binary as a blob with a single section, obliterating any distinction between code and data within the binary, resulting in the entire contents of the binary being treated as code. Thanks for contributing an answer to Reverse Engineering Stack Exchange!
What does demangle do in objdump ( 1 )?
-C –demangle [=style] Decode ( demangle) low-level symbol names into user-level names. Besides removing any initial underscore prepended by the system, this makes C++ function names readable. Different compilers have different mangling styles.