Write a basic C program which prints a message on the screen.
Compile the program using the GCC compiler.
Examine the binary produced using the objdump program.
Using the command objdump $flag $program with the flags -f -s -d and --source provides information related to the binary file created and shows which sections of memory are associated with which sections of the code.
The actual code is located within the .text section as ween below.
======================================================================
Disassembly of section .text:
0000000000400400 <_start>:
400400: 31 ed xor %ebp,%ebp
400402: 49 89 d1 mov %rdx,%r9
400405: 5e pop %rsi
400406: 48 89 e2 mov %rsp,%rdx
400409: 48 83 e4 f0 and $0xfffffffffffffff0,%rsp
40040d: 50 push %rax
40040e: 54 push %rsp
40040f: 49 c7 c0 60 05 40 00 mov $0x400560,%r8
400416: 48 c7 c1 00 05 40 00 mov $0x400500,%rcx
40041d: 48 c7 c7 e6 04 40 00 mov $0x4004e6,%rdi
400424: ff 15 c6 0b 20 00 callq *0x200bc6(%rip) # 600ff0 <__libc_start_main@GLIBC_2.2.5>
40042a: f4 hlt
40042b: 0f 1f 44 00 00 nopl 0x0(%rax,%rax,1)
0000000000400430 <_dl_relocate_static_pie>:
400430: c3 retq
400431: 66 2e 0f 1f 84 00 00 nopw %cs:0x0(%rax,%rax,1)
400438: 00 00 00
40043b: 0f 1f 44 00 00 nopl 0x0(%rax,%rax,1)
0000000000400440 <deregister_tm_clones>:
400440: b8 28 10 60 00 mov $0x601028,%eax
400445: 48 3d 28 10 60 00 cmp $0x601028,%rax
40044b: 74 13 je 400460 <deregister_tm_clones+0x20>
40044d: b8 00 00 00 00 mov $0x0,%eax
400452: 48 85 c0 test %rax,%rax
400455: 74 09 je 400460 <deregister_tm_clones+0x20>
400457: bf 28 10 60 00 mov $0x601028,%edi
40045c: ff e0 jmpq *%rax
40045e: 66 90 xchg %ax,%ax
400460: c3 retq
400461: 0f 1f 44 00 00 nopl 0x0(%rax,%rax,1)
400466: 66 2e 0f 1f 84 00 00 nopw %cs:0x0(%rax,%rax,1)
40046d: 00 00 00
0000000000400470 <register_tm_clones>:
400470: be 28 10 60 00 mov $0x601028,%esi
400475: 48 81 ee 28 10 60 00 sub $0x601028,%rsi
40047c: 48 c1 fe 03 sar $0x3,%rsi
400480: 48 89 f0 mov %rsi,%rax
400483: 48 c1 e8 3f shr $0x3f,%rax
400487: 48 01 c6 add %rax,%rsi
40048a: 48 d1 fe sar %rsi
40048d: 74 11 je 4004a0 <register_tm_clones+0x30>
40048f: b8 00 00 00 00 mov $0x0,%eax
400494: 48 85 c0 test %rax,%rax
400497: 74 07 je 4004a0 <register_tm_clones+0x30>
400499: bf 28 10 60 00 mov $0x601028,%edi
40049e: ff e0 jmpq *%rax
4004a0: c3 retq
4004a1: 0f 1f 44 00 00 nopl 0x0(%rax,%rax,1)
4004a6: 66 2e 0f 1f 84 00 00 nopw %cs:0x0(%rax,%rax,1)
4004ad: 00 00 00
00000000004004b0 <__do_global_dtors_aux>:
4004b0: f3 0f 1e fa endbr64
4004b4: 80 3d 69 0b 20 00 00 cmpb $0x0,0x200b69(%rip) # 601024 <_edata>
4004bb: 75 13 jne 4004d0 <__do_global_dtors_aux+0x20>
4004bd: 55 push %rbp
4004be: 48 89 e5 mov %rsp,%rbp
4004c1: e8 7a ff ff ff callq 400440 <deregister_tm_clones>
4004c6: c6 05 57 0b 20 00 01 movb $0x1,0x200b57(%rip) # 601024 <_edata>
4004cd: 5d pop %rbp
4004ce: c3 retq
4004cf: 90 nop
4004d0: c3 retq
4004d1: 0f 1f 44 00 00 nopl 0x0(%rax,%rax,1)
4004d6: 66 2e 0f 1f 84 00 00 nopw %cs:0x0(%rax,%rax,1)
4004dd: 00 00 00
00000000004004e0 <frame_dummy>:
4004e0: f3 0f 1e fa endbr64
4004e4: eb 8a jmp 400470 <register_tm_clones>
00000000004004e6 <main>:
4004e6: 55 push %rbp
4004e7: 48 89 e5 mov %rsp,%rbp
4004ea: bf 80 05 40 00 mov $0x400580,%edi
4004ef: b8 00 00 00 00 mov $0x0,%eax
4004f4: e8 f7 fe ff ff callq 4003f0 <printf@plt>
4004f9: b8 00 00 00 00 mov $0x0,%eax
4004fe: 5d pop %rbp
4004ff: c3 retq
0000000000400500 <__libc_csu_init>:
400500: 41 57 push %r15
400502: 49 89 d7 mov %rdx,%r15
400505: 41 56 push %r14
400507: 49 89 f6 mov %rsi,%r14
40050a: 41 55 push %r13
40050c: 41 89 fd mov %edi,%r13d
40050f: 41 54 push %r12
400511: 4c 8d 25 f8 08 20 00 lea 0x2008f8(%rip),%r12 # 600e10 <__frame_dummy_init_array_entry>
400518: 55 push %rbp
400519: 48 8d 2d f8 08 20 00 lea 0x2008f8(%rip),%rbp # 600e18 <__init_array_end>
400520: 53 push %rbx
400521: 4c 29 e5 sub %r12,%rbp
400524: 48 83 ec 08 sub $0x8,%rsp
400528: e8 9b fe ff ff callq 4003c8 <_init>
40052d: 48 c1 fd 03 sar $0x3,%rbp
400531: 74 1b je 40054e <__libc_csu_init+0x4e>
400533: 31 db xor %ebx,%ebx
400535: 0f 1f 00 nopl (%rax)
400538: 4c 89 fa mov %r15,%rdx
40053b: 4c 89 f6 mov %r14,%rsi
40053e: 44 89 ef mov %r13d,%edi
400541: 41 ff 14 dc callq *(%r12,%rbx,8)
400545: 48 83 c3 01 add $0x1,%rbx
400549: 48 39 dd cmp %rbx,%rbp
40054c: 75 ea jne 400538 <__libc_csu_init+0x38>
40054e: 48 83 c4 08 add $0x8,%rsp
400552: 5b pop %rbx
400553: 5d pop %rbp
400554: 41 5c pop %r12
400556: 41 5d pop %r13
400558: 41 5e pop %r14
40055a: 41 5f pop %r15
40055c: c3 retq
40055d: 0f 1f 00 nopl (%rax)
0000000000400560 <__libc_csu_fini>:
400560: c3 retq
======================================================================
======================================================================
The section which holds the string to be printed can be found in the .rodata section as seen below
contents of section .rodata:
400570 01000200 00000000 00000000 00000000 ................
400580 48656c6c 6f20576f 726c640a 00 Hello World..
Comments