How to disassemble a binary executable in Linux to get the assembly code

Question

I was told to use a disassembler  Does gcc have anything built in  What is the easiest way to do this

User · Answer

ht editor can disassemble binaries in many formats  It is similar to Hiew  but open source   To disassemble  open a binary  then press F6 and then select elf image

User · Answer

This answer is specific to x86   Portable tools that can disassemble AArch64  MIPS  or whatever machine code include objdump and llvm-objdump     Agner Fog s disassembler  objconv  is quite nice   It will add comments to the disassembly output for performance problems  like the dreaded LCP stall from instructions with 16bit immediate constants  for example    objconv  -fyasm a out  dev stdout   less    It doesn t recognize - as shorthand for stdout  and defaults to outputting to a file of similar name to the input file  with  asm tacked on    It also adds branch targets to the code   Other disassemblers usually disassemble jump instructions with just a numeric destination  and don t put any marker at a branch target to help you find the top of loops and so on   It also indicates NOPs more clearly than other disassemblers  making it clear when there s padding  rather than disassembling it as just another instruction    It s open source  and easy to compile for Linux   It can disassemble into NASM  YASM  MASM  or GNU  AT amp T  syntax   Sample output     Filling space  0FH   Filler type  Multi-byte NOP         db 0FH  1FH  44H  00H  00H  66H  2EH  0FH         db 1FH  84H  00H  00H  00H  00H  00H  ALIGN   16  foo       Function begin         cmp     rdi  1                                    00400620   48  83  FF  01         jbe       026                                     00400624   0F 86  00000084         mov     r11d  1                                   0040062A   41  BB  00000001   020   mov     r8  r11                                   00400630   4D  89  D8         imul    r8  r11                                   00400633   4D  0F AF  C3         add     r8  rdi                                   00400637   49  01  F8         cmp     r8  3                                     0040063A   49  83  F8  03         jbe       029                                     0040063E   0F 86  00000097         mov     esi  1                                    00400644   BE  00000001   Filling space  7H   Filler type  Multi-byte NOP         db 0FH  1FH  80H  00H  00H  00H  00H  ALIGN   8   021   add     rsi  rsi                                  00400650   48  01  F6         mov     rax  rsi                                  00400653   48  89  F0         imul    rax  rsi                                  00400656   48  0F AF  C6         shl     rax  2                                    0040065A   48  C1  E0  02         cmp     r8  rax                                   0040065E   49  39  C0         jnc       021                                     00400661   73  ED         lea     rcx   rsi rsi                             00400663   48  8D  0C 36       Note that this output is ready to be assembled back into an object file  so you can tweak the code at the asm source level  rather than with a hex-editor on the machine code    So you aren t limited to keeping things the same size    With no changes  the result should be near-identical   It might not be  though  since disassembly of stuff like     from  lib x86 64-linux-gnu libc so 6   SECTION  plt    align 16 execute                          section number 11  code    00001   Local function         push    qword  rel   37996                        0001F420   FF  35  003A4BE2 rel          jmp     near  rel   37997                         0001F426   FF  25  003A4BE4 rel           ALIGN   8   00002 jmp     near  rel   37998                         0001F430   FF  25  003A4BE2 rel     Note  Immediate operand could be made smaller by sign extension         push    11                                        0001F436   68  0000000B   Note  Immediate operand could be made smaller by sign extension         jmp       00001                                   0001F43B   E9  FFFFFFE0   doesn t have anything in the source to make sure it assembles to the longer encoding that leaves room for relocations to rewrite it with a 32bit offset     If you don t want to install it objconv  GNU binutils objdump -Mintel -d is very usable  and will already be installed if you have a normal Linux gcc setup

User · Answer

You can come pretty damn close  but no cigar  to generating assembly that will reassemble  if that s what you are intending to do  using this rather crude and tediously long pipeline trick  replace  bin bash with the file you intend to disassemble and bash S with what you intend to send the output to    objdump --no-show-raw-insn -Matt att-mnemonic -Dz  bin bash   grep -v  file format    grep -v   bad     sed  1 4d    cut -d    -f2-   cut -d   lt   -f2   tr -d   gt     cut -f2-   sed -e  s of  section  Disassembly  of  section     grep -v           gt  bash S   Note how long this is  however  I really wish there was a better way  or  for that matter  a disassembler capable of outputting code that an assembler will recognize   but unfortunately there isn t

User · Answer

there s also ndisasm  which has some quirks  but can be more useful if you use nasm  I agree with Michael Mrozek that objdump is probably best    later  you might also want to check out Albert van der Horst s ciasdis  http   home hccnet nl a w m van der horst forthassembler html  it can be hard to understand  but has some interesting features you won t likely find anywhere else

User · Answer

Let s say that you have    include  lt iostream gt   double foo double x      asm    MyTag BEGIN        lt - asm comment                                used later to locate piece of code   double y   2   x   1     asm    MyTag END       return y     int main       std  cout  lt  lt  foo 2       To get assembly code using gcc you can do    g   prog cpp -c -S -o - -masm intel   c  filt   grep -vE   s       c  filt demangles symbols  grep -vE   s     removes some useless information  Now if you want to visualize the tagged part  simply use   g   prog cpp -c -S -o - -masm intel   c  filt   grep -vE   s       grep  MyTag BEGIN  -A 20   With my computer I get         MyTag BEGIN   0    2  NO APP     movsd   xmm0  QWORD PTR -24 rbp      movapd  xmm1  xmm0     addsd   xmm1  xmm0     addsd   xmm0  xmm1     movsd   QWORD PTR -8 rbp   xmm0  APP   9  poub cpp  1       MyTag END   0    2  NO APP     movsd   xmm0  QWORD PTR -8 rbp      pop rbp     ret  LFE1814  main   LFB1815      push    rbp     mov rbp  rsp     A more friendly approach is to use  Compiler Explorer

User · Answer

An interesting alternative to objdump is gdb   You don t have to run the binary or have debuginfo     gdb -q   a out  Reading symbols from   a out    no debugging symbols found    done   gdb  info functions  All defined functions   Non-debugging symbols  0x00000000004003a8   init 0x00000000004003e0    libc start main plt 0x00000000004003f0    gmon start   plt 0x0000000000400400   start 0x0000000000400430  deregister tm clones 0x0000000000400460  register tm clones 0x00000000004004a0    do global dtors aux 0x00000000004004c0  frame dummy 0x00000000004004f0  fce 0x00000000004004fb  main 0x0000000000400510    libc csu init 0x0000000000400580    libc csu fini 0x0000000000400584   fini  gdb  disassemble main Dump of assembler code for function main     0x00000000004004fb  lt  0 gt       push    rbp    0x00000000004004fc  lt  1 gt       mov     rsp  rbp    0x00000000004004ff  lt  4 gt       sub     0x10  rsp    0x0000000000400503  lt  8 gt       callq  0x4004f0  lt fce gt     0x0000000000400508  lt  13 gt      mov     eax -0x4  rbp     0x000000000040050b  lt  16 gt      mov    -0x4  rbp   eax    0x000000000040050e  lt  19 gt      leaveq     0x000000000040050f  lt  20 gt      retq    End of assembler dump   gdb  disassemble fce Dump of assembler code for function fce     0x00000000004004f0  lt  0 gt       push    rbp    0x00000000004004f1  lt  1 gt       mov     rsp  rbp    0x00000000004004f4  lt  4 gt       mov     0x2a  eax    0x00000000004004f9  lt  9 gt       pop     rbp    0x00000000004004fa  lt  10 gt      retq    End of assembler dump   gdb    With full debugging info it s even better    gdb  disassemble  m main Dump of assembler code for function main  9            0x00000000004004fb  lt  0 gt       push    rbp    0x00000000004004fc  lt  1 gt       mov     rsp  rbp    0x00000000004004ff  lt  4 gt       sub     0x10  rsp  10        int x   fce        0x0000000000400503  lt  8 gt       callq  0x4004f0  lt fce gt     0x0000000000400508  lt  13 gt      mov     eax -0x4  rbp   11        return x     0x000000000040050b  lt  16 gt      mov    -0x4  rbp   eax  12           0x000000000040050e  lt  19 gt      leaveq     0x000000000040050f  lt  20 gt      retq     End of assembler dump   gdb    objdump has a similar option  -S

User · Answer

Use IDA Pro and the Decompiler

User · Answer

I don t think gcc has a flag for it  since it s primarily a compiler  but another of the GNU development tools does  objdump takes a -d --disassemble flag     objdump -d  path to binary   The disassembly looks like this   080483b4  lt main gt    80483b4    8d 4c 24 04             lea    0x4  esp   ecx  80483b8    83 e4 f0                and     0xfffffff0  esp  80483bb    ff 71 fc                pushl  -0x4  ecx   80483be    55                      push    ebp  80483bf    89 e5                   mov     esp  ebp  80483c1    51                      push    ecx  80483c2    b8 00 00 00 00          mov     0x0  eax  80483c7    59                      pop     ecx  80483c8    5d                      pop     ebp  80483c9    8d 61 fc                lea    -0x4  ecx   esp  80483cc    c3                      ret      80483cd    90                      nop  80483ce    90                      nop  80483cf    90                      nop

User · Answer

You might find ODA useful   It s a web-based disassembler that supports tons of architectures   http   onlinedisassembler com

[c++] How to disassemble a binary executable in Linux to get the assembly code?

Examples related to c++

Examples related to linux

Examples related to assembly

Examples related to executable

Examples related to disassembly