Defining case values ​​when using objdump

Question

So, I'm trying to use the objdump utility to build a control flow graph from the assembly, and I am having a problem. Basically, whenever a branch arises and the destination address is relative, I'm not sure how to find out where the next base block starts. I am not sure if I will be clean, so I will add an example. Say my program goes through the objdump output and writes the start address for the first base block. He then turns to the branch command, which uses relative addressing to point to the correct address for the branch. I know that the end of my first base unit happens right there, but how can I get the correct address to start the next base unit? Any guidance that anyone can provide will be appreciated, I start x86 at best, and last week I hit my head about it.

Answer 1

Assuming I understand the question, maybe this will help you get started. Relative leaps are pc based.

  d: eb 04 jmp 13 

0xEB is an opcode for relative transition based on 8-bit immediate. The instruction address is in the output of objdump, in this case d or 0xD. this is a two-byte command (x86 - variable length). it tells you at the output that the destination address is jmp 13 in this case. Therefore, searching for a line in the objdump output that starts at 13, and the colon is the beginning of the next code fragment.

To understand how this address is calculated. The PC is at 0xD, when it starts to retrieve the instruction, it takes two bytes, so the pc is at 0xD + 2 = 0xF when it is ready to execute this instruction. The offset is 0x4, so 0xF + ​​0x4 = 0x13 is the destination address.

  20: 75 ed jne f

The same thing happens for the back. pc plus number of bytes = 0x20 + 2 = 0x22. 0xED is a signed and negative number, so the sign is increased to 0xED to 0xFFFFFFF ... FFFFED, however your address is large. Add 0x22 + 0xFFFFFF ... FFFED and you will get 0x0F destination address. You can also take 0xED, invert and add 1 to cancel it. ~ 0xED = 0x12, 0x12 + 1 = 0x13. So 0xED means subtracting 0x13. 0x22-0x13 = 0x0F.

Here are a few more, in each case it gives you the destination address, which you can simply search for in objdump output.

To understand how he calculates this value. In the same story, starting with opcode 0x400A81, in this case 6 bytes are required for a variable-length instruction. Thus, by the time you are ready to execute pc, at 0x400A81 + 6 = 0x400A87. The offset is 0x107, so if the condition is met, the destination address is 0x400A87 + 0x107 = 0x400B8E.

Note that this grepped from a larger program, rather than sequential code, is just a collection of isolated examples.

  400a81: 0f 8f 07 01 00 00 jg 400b8e 
   400a8f: 0f 8f e6 00 00 00 jg 400b7b 
   400a9d: 0f 8f c5 00 00 00 jg 400b68 
   400aab: 0f 8f a4 00 00 00 jg 400b55 
   400ab9: 0f 8f 83 00 00 00 jg 400b42 
   401d76: 0f 8f 31 01 00 00 jg 401ead