Logo Questions Linux Laravel Mysql Ubuntu Git Menu
 

Which section does objdump disassemble by default

I am currently building a bare metal executeable, which contains some special sections containing code. However, when I do objdump -d I only get the code for the .text and .init.text sections. The manpage for objdump only says that it "only disassembles those sections which are expected to contain instructions" when using the -d option. What sections are these, and how does objdump tell which sections to decode? I know I can also use the -D option to get a full decoding of all sections, but this is usually much more than I need.

like image 217
LiKao Avatar asked Mar 28 '15 19:03

LiKao


People also ask

How do you take apart an ELF file?

Disassembling an ELF-formatted fileUse the --disassemble option to display a disassembled version of the image to stdout . If you use this option with the --output destination option, you can reassemble the output file with armasm. You can use this option to disassemble either an ELF image or an ELF object file.

What does objdump do in Linux?

objdump is a command-line program for displaying various information about object files on Unix-like operating systems. For instance, it can be used as a disassembler to view an executable in assembly form. It is part of the GNU Binutils for fine-grained control over executables and other binary data.

Which command is used to disassemble code?

The DISASM command attempts to disassemble code from a given start address.

What is disassembly code?

In programming terminology, to disassemble is to convert a program in its executable (ready-to-run) form (sometimes called object code ) into a representation in some form of assembler language so that it is readable by a human.


1 Answers

objdump internally uses libbfd to get section information. objdump passes a callback to bfd_map_over_sections() which calls the callback on each section. When called, libbfd passes a asection * to the callback, which has a member type. If the type contains the flags SEC_CONTENTS | SEC_CODE it gets disassembled by objdump when the -d option is passed.

Getting into libbfd is quite harder, I expect that the type detection depends on architecture, but I hope I gave you at least the right pointer. (Probably when having more time I'll dig more into this and extend the answer)..


Btw, if you need a script to filter out the sections of interest from objdump -D you might use sed, like this:

# ------------Place section names here ---------------vvv 
objdump -D object.o | sed -rn '/Disassembly of.*\.(comment|text)/{:a;p;n;/Disassembly of/!ba}'
like image 66
hek2mgl Avatar answered Oct 01 '22 22:10

hek2mgl