0x00 objdump命令是Linux下的反汇编目标文件或者可执行文件的命令
0x01 objdump -f 显示test的文件头信息
$ objdump -f level
level: file format elf32-i386 architecture: i386, flags 0x00000112: EXEC_P, HAS_SYMS, D_PAGED start address 0x08048350
0x02 objdump -d 反汇编test中的需要执行指令的那些section
$ objdump -d level
level2: file format elf32-i386 Disassembly of section .init: 080482d4 <_init>: 80482d4: 53 push %ebx 80482d5: 83 ec 08 sub $0x8,%esp 80482d8: e8 a3 00 00 00 call 8048380 <__x86.get_pc_thunk.bx> 80482dd: 81 c3 23 1d 00 00 add $0x1d23,%ebx 80482e3: 8b 83 fc ff ff ff mov -0x4(%ebx),%eax 80482e9: 85 c0 test %eax,%eax 80482eb: 74 05 je 80482f2 <_init+0x1e> 80482ed: e8 3e 00 00 00 call 8048330 <__gmon_start__@plt> 80482f2: 83 c4 08 add $0x8,%esp 80482f5: 5b pop %ebx 80482f6: c3 ret Disassembly of section .plt: 08048300 <read@plt-0x10>: 8048300: ff 35 04 a0 04 08 pushl 0x804a004 8048306: ff 25 08 a0 04 08 jmp *0x804a008 804830c: 00 00 add %al,(%eax) ... 08048310 <read@plt>: 8048310: ff 25 0c a0 04 08 jmp *0x804a00c 8048316: 68 00 00 00 00 push $0x0 804831b: e9 e0 ff ff ff jmp 8048300 <_init+0x2c> 08048320 <system@plt>: 8048320: ff 25 10 a0 04 08 jmp *0x804a010 8048326: 68 08 00 00 00 push $0x8 804832b: e9 d0 ff ff ff jmp 8048300 <_init+0x2c> 08048330 <__gmon_start__@plt>: 8048330: ff 25 14 a0 04 08 jmp *0x804a014 8048336: 68 10 00 00 00 push $0x10 804833b: e9 c0 ff ff ff jmp 8048300 <_init+0x2c> 08048340 <__libc_start_main@plt>: 8048340: ff 25 18 a0 04 08 jmp *0x804a018 8048346: 68 18 00 00 00 push $0x18 804834b: e9 b0 ff ff ff jmp 8048300 <_init+0x2c> Disassembly of section .text: 08048350 <_start>: 8048350: 31 ed xor %ebp,%ebp 8048352: 5e pop %esi 8048353: 89 e1 mov %esp,%ecx 8048355: 83 e4 f0 and $0xfffffff0,%esp 8048358: 50 push %eax 8048359: 54 push %esp 804835a: 52 push %edx 804835b: 68 20 85 04 08 push $0x8048520 8048360: 68 c0 84 04 08 push $0x80484c0 8048365: 51 push %ecx 8048366: 56 push %esi 8048367: 68 80 84 04 08 push $0x8048480 804836c: e8 cf ff ff ff call 8048340 <__libc_start_main@plt> 8048371: f4 hlt 8048372: 66 90 xchg %ax,%ax 8048374: 66 90 xchg %ax,%ax 8048376: 66 90 xchg %ax,%ax 8048378: 66 90 xchg %ax,%ax 804837a: 66 90 xchg %ax,%ax 804837c: 66 90 xchg %ax,%ax 804837e: 66 90 xchg %ax,%ax 08048380 <__x86.get_pc_thunk.bx>: 8048380: 8b 1c 24 mov (%esp),%ebx 8048383: c3 ret 8048384: 66 90 xchg %ax,%ax 8048386: 66 90 xchg %ax,%ax 8048388: 66 90 xchg %ax,%ax 804838a: 66 90 xchg %ax,%ax 804838c: 66 90 xchg %ax,%ax 804838e: 66 90 xchg %ax,%ax 08048390 <deregister_tm_clones>: 8048390: b8 2f a0 04 08 mov $0x804a02f,%eax 8048395: 2d 2c a0 04 08 sub $0x804a02c,%eax 804839a: 83 f8 06 cmp $0x6,%eax 804839d: 76 1a jbe 80483b9 <deregister_tm_clones+0x29> 804839f: b8 00 00 00 00 mov $0x0,%eax 80483a4: 85 c0 test %eax,%eax 80483a6: 74 11 je 80483b9 <deregister_tm_clones+0x29> 80483a8: 55 push %ebp 80483a9: 89 e5 mov %esp,%ebp 80483ab: 83 ec 14 sub $0x14,%esp 80483ae: 68 2c a0 04 08 push $0x804a02c 80483b3: ff d0 call *%eax 80483b5: 83 c4 10 add $0x10,%esp 80483b8: c9 leave 80483b9: f3 c3 repz ret 80483bb: 90 nop 80483bc: 8d 74 26 00 lea 0x0(%esi,%eiz,1),%esi 080483c0 <register_tm_clones>: 80483c0: b8 2c a0 04 08 mov $0x804a02c,%eax 80483c5: 2d 2c a0 04 08 sub $0x804a02c,%eax 80483ca: c1 f8 02 sar $0x2,%eax 80483cd: 89 c2 mov %eax,%edx 80483cf: c1 ea 1f shr $0x1f,%edx 80483d2: 01 d0 add %edx,%eax 80483d4: d1 f8 sar %eax 80483d6: 74 1b je 80483f3 <register_tm_clones+0x33> 80483d8: ba 00 00 00 00 mov $0x0,%edx 80483dd: 85 d2 test %edx,%edx 80483df: 74 12 je 80483f3 <register_tm_clones+0x33> 80483e1: 55 push %ebp 80483e2: 89 e5 mov %esp,%ebp 80483e4: 83 ec 10 sub $0x10,%esp 80483e7: 50 push %eax 80483e8: 68 2c a0 04 08 push $0x804a02c 80483ed: ff d2 call *%edx 80483ef: 83 c4 10 add $0x10,%esp 80483f2: c9 leave 80483f3: f3 c3 repz ret 80483f5: 8d 74 26 00 lea 0x0(%esi,%eiz,1),%esi 80483f9: 8d bc 27 00 00 00 00 lea 0x0(%edi,%eiz,1),%edi 08048400 <__do_global_dtors_aux>: 8048400: 80 3d 2c a0 04 08 00 cmpb $0x0,0x804a02c 8048407: 75 13 jne 804841c <__do_global_dtors_aux+0x1c> 8048409: 55 push %ebp 804840a: 89 e5 mov %esp,%ebp 804840c: 83 ec 08 sub $0x8,%esp 804840f: e8 7c ff ff ff call 8048390 <deregister_tm_clones> 8048414: c6 05 2c a0 04 08 01 movb $0x1,0x804a02c 804841b: c9 leave 804841c: f3 c3 repz ret 804841e: 66 90 xchg %ax,%ax 08048420 <frame_dummy>: 8048420: b8 10 9f 04 08 mov $0x8049f10,%eax 8048425: 8b 10 mov (%eax),%edx 8048427: 85 d2 test %edx,%edx 8048429: 75 05 jne 8048430 <frame_dummy+0x10> 804842b: eb 93 jmp 80483c0 <register_tm_clones> 804842d: 8d 76 00 lea 0x0(%esi),%esi 8048430: ba 00 00 00 00 mov $0x0,%edx 8048435: 85 d2 test %edx,%edx 8048437: 74 f2 je 804842b <frame_dummy+0xb> 8048439: 55 push %ebp 804843a: 89 e5 mov %esp,%ebp 804843c: 83 ec 14 sub $0x14,%esp 804843f: 50 push %eax 8048440: ff d2 call *%edx 8048442: 83 c4 10 add $0x10,%esp 8048445: c9 leave 8048446: e9 75 ff ff ff jmp 80483c0 <register_tm_clones> 0804844b <vulnerable_function>: 804844b: 55 push %ebp 804844c: 89 e5 mov %esp,%ebp 804844e: 81 ec 88 00 00 00 sub $0x88,%esp 8048454: 83 ec 0c sub $0xc,%esp 8048457: 68 40 85 04 08 push $0x8048540 804845c: e8 bf fe ff ff call 8048320 <system@plt> 8048461: 83 c4 10 add $0x10,%esp 8048464: 83 ec 04 sub $0x4,%esp 8048467: 68 00 01 00 00 push $0x100 804846c: 8d 85 78 ff ff ff lea -0x88(%ebp),%eax 8048472: 50 push %eax 8048473: 6a 00 push $0x0 8048475: e8 96 fe ff ff call 8048310 <read@plt> 804847a: 83 c4 10 add $0x10,%esp 804847d: 90 nop 804847e: c9 leave 804847f: c3 ret 08048480 <main>: 8048480: 8d 4c 24 04 lea 0x4(%esp),%ecx 8048484: 83 e4 f0 and $0xfffffff0,%esp 8048487: ff 71 fc pushl -0x4(%ecx) 804848a: 55 push %ebp 804848b: 89 e5 mov %esp,%ebp 804848d: 51 push %ecx 804848e: 83 ec 04 sub $0x4,%esp 8048491: e8 b5 ff ff ff call 804844b <vulnerable_function> 8048496: 83 ec 0c sub $0xc,%esp 8048499: 68 4c 85 04 08 push $0x804854c 804849e: e8 7d fe ff ff call 8048320 <system@plt> 80484a3: 83 c4 10 add $0x10,%esp 80484a6: b8 00 00 00 00 mov $0x0,%eax 80484ab: 8b 4d fc mov -0x4(%ebp),%ecx 80484ae: c9 leave 80484af: 8d 61 fc lea -0x4(%ecx),%esp 80484b2: c3 ret 80484b3: 66 90 xchg %ax,%ax 80484b5: 66 90 xchg %ax,%ax 80484b7: 66 90 xchg %ax,%ax 80484b9: 66 90 xchg %ax,%ax 80484bb: 66 90 xchg %ax,%ax 80484bd: 66 90 xchg %ax,%ax 80484bf: 90 nop 080484c0 <__libc_csu_init>: 80484c0: 55 push %ebp 80484c1: 57 push %edi 80484c2: 31 ff xor %edi,%edi 80484c4: 56 push %esi 80484c5: 53 push %ebx 80484c6: e8 b5 fe ff ff call 8048380 <__x86.get_pc_thunk.bx> 80484cb: 81 c3 35 1b 00 00 add $0x1b35,%ebx 80484d1: 83 ec 0c sub $0xc,%esp 80484d4: 8b 6c 24 20 mov 0x20(%esp),%ebp 80484d8: 8d b3 0c ff ff ff lea -0xf4(%ebx),%esi 80484de: e8 f1 fd ff ff call 80482d4 <_init> 80484e3: 8d 83 08 ff ff ff lea -0xf8(%ebx),%eax 80484e9: 29 c6 sub %eax,%esi 80484eb: c1 fe 02 sar $0x2,%esi 80484ee: 85 f6 test %esi,%esi 80484f0: 74 23 je 8048515 <__libc_csu_init+0x55> 80484f2: 8d b6 00 00 00 00 lea 0x0(%esi),%esi 80484f8: 83 ec 04 sub $0x4,%esp 80484fb: ff 74 24 2c pushl 0x2c(%esp) 80484ff: ff 74 24 2c pushl 0x2c(%esp) 8048503: 55 push %ebp 8048504: ff 94 bb 08 ff ff ff call *-0xf8(%ebx,%edi,4) 804850b: 83 c7 01 add $0x1,%edi 804850e: 83 c4 10 add $0x10,%esp 8048511: 39 f7 cmp %esi,%edi 8048513: 75 e3 jne 80484f8 <__libc_csu_init+0x38> 8048515: 83 c4 0c add $0xc,%esp 8048518: 5b pop %ebx 8048519: 5e pop %esi 804851a: 5f pop %edi 804851b: 5d pop %ebp 804851c: c3 ret 804851d: 8d 76 00 lea 0x0(%esi),%esi 08048520 <__libc_csu_fini>: 8048520: f3 c3 repz ret Disassembly of section .fini: 08048524 <_fini>: 8048524: 53 push %ebx 8048525: 83 ec 08 sub $0x8,%esp 8048528: e8 53 fe ff ff call 8048380 <__x86.get_pc_thunk.bx> 804852d: 81 c3 d3 1a 00 00 add $0x1ad3,%ebx 8048533: 83 c4 08 add $0x8,%esp 8048536: 5b pop %ebx 8048537: c3 ret
0x03 objdump -D 与-d类似，但反汇编test中的所有section
0x04 objdump -h 显示test的Section Header信息
$ objdump -h level
Sections: Idx Name Size VMA LMA File off Algn 0 .interp 00000013 08048154 08048154 00000154 2**0 CONTENTS, ALLOC, LOAD, READONLY, DATA 1 .note.ABI-tag 00000020 08048168 08048168 00000168 2**2 CONTENTS, ALLOC, LOAD, READONLY, DATA 2 .note.gnu.build-id 00000024 08048188 08048188 00000188 2**2 CONTENTS, ALLOC, LOAD, READONLY, DATA 3 .gnu.hash 00000020 080481ac 080481ac 000001ac 2**2 CONTENTS, ALLOC, LOAD, READONLY, DATA 4 .dynsym 00000060 080481cc 080481cc 000001cc 2**2 CONTENTS, ALLOC, LOAD, READONLY, DATA 5 .dynstr 00000051 0804822c 0804822c 0000022c 2**0 CONTENTS, ALLOC, LOAD, READONLY, DATA 6 .gnu.version 0000000c 0804827e 0804827e 0000027e 2**1 CONTENTS, ALLOC, LOAD, READONLY, DATA 7 .gnu.version_r 00000020 0804828c 0804828c 0000028c 2**2 CONTENTS, ALLOC, LOAD, READONLY, DATA 8 .rel.dyn 00000008 080482ac 080482ac 000002ac 2**2 CONTENTS, ALLOC, LOAD, READONLY, DATA 9 .rel.plt 00000020 080482b4 080482b4 000002b4 2**2 CONTENTS, ALLOC, LOAD, READONLY, DATA 10 .init 00000023 080482d4 080482d4 000002d4 2**2 CONTENTS, ALLOC, LOAD, READONLY, CODE 11 .plt 00000050 08048300 08048300 00000300 2**4 CONTENTS, ALLOC, LOAD, READONLY, CODE 12 .text 000001d2 08048350 08048350 00000350 2**4 CONTENTS, ALLOC, LOAD, READONLY, CODE 13 .fini 00000014 08048524 08048524 00000524 2**2 CONTENTS, ALLOC, LOAD, READONLY, CODE 14 .rodata 00000028 08048538 08048538 00000538 2**2 CONTENTS, ALLOC, LOAD, READONLY, DATA 15 .eh_frame_hdr 00000034 08048560 08048560 00000560 2**2 CONTENTS, ALLOC, LOAD, READONLY, DATA 16 .eh_frame 000000ec 08048594 08048594 00000594 2**2 CONTENTS, ALLOC, LOAD, READONLY, DATA 17 .init_array 00000004 08049f08 08049f08 00000f08 2**2 CONTENTS, ALLOC, LOAD, DATA 18 .fini_array 00000004 08049f0c 08049f0c 00000f0c 2**2 CONTENTS, ALLOC, LOAD, DATA 19 .jcr 00000004 08049f10 08049f10 00000f10 2**2 CONTENTS, ALLOC, LOAD, DATA 20 .dynamic 000000e8 08049f14 08049f14 00000f14 2**2 CONTENTS, ALLOC, LOAD, DATA 21 .got 00000004 08049ffc 08049ffc 00000ffc 2**2 CONTENTS, ALLOC, LOAD, DATA 22 .got.plt 0000001c 0804a000 0804a000 00001000 2**2 CONTENTS, ALLOC, LOAD, DATA 23 .data 00000010 0804a01c 0804a01c 0000101c 2**2 CONTENTS, ALLOC, LOAD, DATA 24 .bss 00000004 0804a02c 0804a02c 0000102c 2**0 ALLOC 25 .comment 00000052 00000000 00000000 0000102c 2**0 CONTENTS, READONLY
0x05 objdump -x 显示test的全部Header信息
0x06 objdump -s 除了显示test的全部Header信息，还显示他们对应的十六进制文件代
0x07 CTF PWN中主要用到 -d 寻找gadgets进行rop,-h 确定.bss段位置
.