How to Use the Command 'objdump' (with examples)

The objdump command is a powerful tool used by developers and programmers to analyze object files. Object files can include anything from compiled source code to libraries and fully linked executables. By using objdump, users can extract different information from these files, making it an invaluable tool for debugging, reverse engineering, and various architectural studies. It provides a wide array of functionalities, such as displaying headers, disassembling code, and dumping binary data in a readable format.

Use case 1: Display the File Header Information

Code:

objdump -f path/to/binary

Motivation:

When working with object files, you might want to start by looking at the file header information. This provides a high-level overview of the file, such as its architecture, entry point, along with other flags and attributes. This is useful during initial investigations to quickly understand the basic properties of an object file.

Explanation:

• objdump: This is the main command for running the tool.
• -f: This option tells objdump to display the file header information. This includes metadata about the object file.
• path/to/binary: This is the path to the binary or object file that you want to examine.

Example Output:

architecture: i386:x86-64, flags 0x00000012:
EXEC_P, HAS_SYMS
start address 0x00400420

Use case 2: Display All Header Information

Code:

objdump -x path/to/binary

Motivation:

To gain a deeper understanding of the binary, developers might need to view all header information. This includes section headers and more detailed metadata. Such detailed header information is crucial during debugging or when performing thorough investigations on the composition of the binary.

Explanation:

• objdump: The primary command utilized to explore the object file.
• -x: This option causes objdump to display all available header information, which can cover various sections and their properties.
• path/to/binary: Similar to the previous example, this is the path to the target binary or object file.

Example Output:

path/to/binary:     file format elf64-x86-64
architecture: i386:x86-64, flags 0x00000011:
HAS_RELOC, HAS_SYMS
start address 0x0000000000000630

Program Header:
...
Section Headers:
...
SYMBOL TABLE:
...

Use case 3: Display the Disassembled Output of Executable Sections

Code:

objdump -d path/to/binary

Motivation:

By disassembling the executable sections of a binary, developers gain access to the machine code instructions in an assembly language syntax. This is particularly useful for reverse engineering or understanding the execution flow of a program at a low level.

Explanation:

• objdump: The essential command used for examining the file.
• -d: This instructs objdump to disassemble the executable sections of the object file, displaying the assembly instructions.
• path/to/binary: This refers to the binary file whose executable sections you want to disassemble.

Example Output:

0000000000000640 <_start>:
  640:   b8 02 00 00 00          mov    $0x2,%eax
  645:   bf 01 00 00 00          mov    $0x1,%edi
...

Use case 4: Display the Disassembled Executable Sections in Intel Syntax

Code:

objdump -M intel -d path/to/binary

Motivation:

IT professionals and developers who favor Intel syntax over the default AT&T syntax might prefer disassembled output in this format. Intel syntax is commonly used due to its readability and similarity to high-level languages, making it more intuitive for many users.

Explanation:

• objdump: The command to access object file data.
• -M intel: This option specifies that the output should be in Intel syntax. The -M flag modifies the output style based on the given argument.
• -d: Like in the previous example, this option disassembles executable sections.
• path/to/binary: The path indicating which binary file to process.

Example Output:

0000000000000640 <_start>:
  640:   mov    eax,0x2
  645:   mov    edi,0x1
...

Use case 5: Display a Complete Binary Hex Dump of All Sections

Code:

objdump -s path/to/binary

Motivation:

Examining the entire binary in hex format is necessary in certain contexts, such as when you want to analyze raw binary data, search for specific byte patterns, or check the contents of different sections. This can be useful in educational contexts or forensic investigations.

Explanation:

• objdump: The base command for analyzing object files.
• -s: This option dumps the complete hex representation of all object file sections, enabling users to explore raw data.
• path/to/binary: This specifies the target binary or object file.

Example Output:

Contents of section .text:
 00401000 554889e5 4883ec20 48896df8 488b0541   UH..H.. H.m.H..A
...
Contents of section .data:
 00603020 00000000 00000000 00000000 00000000   ...............
...

Conclusion:

The objdump command is a versatile tool for examining and understanding the internals of object files. Whether you’re debugging, reverse engineering, or simply exploring under-the-hood operations of binaries, objdump provides a suite of options to fit various analytical needs. With these illustrated examples, you should have a better understanding of how objdump can be employed to meet your specific requirements.