Parsing a flat binary using objdump

Question

Is it possible to parse a flat binary using objdump?

I am familiar with disassembling a structured executable such as an ELF file using:

objdump -d file.elf 

But if I have a flat binary that I know should be loaded, for example, the address 0xabcd1000, can I ask objdump to parse it? I tried to provide options like "--start-address = 0xabcd1000", but objdump simply states that it does not recognize the format.

I have other ideas on how to parse a file, but I wanted to know if objdump could provide a simple solution.

Answer 1

I found a solution to my question in another forum. It looks something like this:

 objdump -b binary --adjust-vma=0xabcd1000 -D file.bin 

I tested this and it works.

Answer 2

starblue and hłddal have portions of the canonical answer. If you want to parse the raw i8086 code, you usually need Intel syntax, not AT & T syntax, so use:

 objdump -D -Mintel,i8086 -b binary -m i386 mbr.bin objdump -D -Mintel,i386 -b binary -m i386 foo.bin # for 32-bit code objdump -D -Mintel,x86-64 -b binary -m i386 foo.bin # for 64-bit code 

If your code is ELF (or a.out (or (E) COFF)), you can use the short form:

 objdump -D -Mintel,i8086 a.out # disassembles the entire file objdump -d -Mintel,i8086 a.out # disassembles only code sections 

For 32-bit or 64-bit code, omit ,8086 ; The ELF header already includes this information.

ndisasm , as suggested by jameslin , is also a good choice, but objdump usually comes with the OS and can work with all architectures supported by GNU binutils (superset of the supported, supported by GCC), and its output can usually be served in GNU as (ndisasms can usually be type in nasm , though of course).

Peter Cordes suggests that “ Agner Fog objconv is very nice. It puts tags on the branch targets, which makes code definition much easier. It can understand the syntax of NASM, YASM, MASM, or AT & T (GNU).

Multimedia Mike has already learned about --adjust-vma ; the ndisasm equivalent is the -o option.

To parse, say, sh4 code (I used one bit from Debian for testing), use it with GNU binutils (almost all other disassemblers are limited to one platform, such as x86 with ndisasm and objconv ):

 objdump -D -b binary -m sh -EL x 

-m is a machine, and -EL means Little Endian (instead of sh4eb , sh4eb used), which is important for architectures that exist either in endianness.

Answer 3

No, you cannot if it does not move, for example if it contains "ljmp" (or "jmp far [addr]") OPCODE.