I have an object file fact.o
, which is a binary file. To examine the disassembly of the object file, I ran the following command: objdump -d fact.o
. I get the following output:
fact.o: file format elf64-x86-64
Disassembly of section .text:
0000000000000000 <factorial>:
0: ba 01 00 00 00 mov $0x1,%edx
5: b8 00 00 00 00 mov $0x0,%eax
a: 39 f8 cmp %edi,%eax
c: 7f 08 jg 16 <factorial+0x16>
e: 0f af d0 imul %eax,%edx
11: 83 c0 01 add $0x1,%eax
14: eb f4 jmp a <factorial+0xa>
16: 89 d0 mov %edx,%eax
18: c3 retq
0000000000000019 <main>:
19: 48 83 ec 08 sub $0x8,%rsp
1d: bf 05 00 00 00 mov $0x5,%edi
22: e8 00 00 00 00 callq 27 <main+0xe>
27: 89 c2 mov %eax,%edx
29: be 05 00 00 00 mov $0x5,%esi
2e: bf 00 00 00 00 mov $0x0,%edi
33: b8 00 00 00 00 mov $0x0,%eax
38: e8 00 00 00 00 callq 3d <main+0x24>
3d: b8 00 00 00 00 mov $0x0,%eax
42: 48 83 c4 08 add $0x8,%rsp
46: c3 retq
I know the output is given in three columns: the instruction "address", the machine code (actual bytes stored in the object file), and the disassembly (assembly instructions interpreted from the machine code). My question is how can I find a byte of data located at a certain address? For example: how would I find the byte of data located at the address 0x10? I initially assumed it to be 0x89 from the output, but I'm pretty sure I'm incorrect. Any help is appreciated in helping me figure this out. I'm still trying to get used to assembly and any info will help me out a lot.
Note: I'm using gcc 9.2 if that is relevant for this question.
I believe it should just take a bit of counting.
So for example finding 0x10
, first you find, on the leftmost column, the number closest to 0x10
but lower than that. Here, it's 0xe
:
e: 0f af d0 imul %eax,%edx
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Then we just count a bit. We know that at 0xe
, the byte is 0x0f
. 0xf will be 0xaf
, the byte right after 0x0f
, and 0x10 will be 0xd0
.
e: 0f af d0 imul %eax,%edx
e f 10
However, these addresses are only relative to the start of the section, not sure if that's what you want. See Peter Cordes's comment.