Question

如何在gdb中使用strip命令后反汇编文件？

Answer 1

您可以使用GDB x/i命令，例如

(gdb) x/4i 0x400390
   0x400390:    xor    %ebp,%ebp
   0x400392:    mov    %rdx,%r9
   0x400395:    pop    %rsi
   0x400396:    mov    %rsp,%rdx

但您可能寻找的是objdump -d a.out

Answer 2

您也可以使用disassemble命令。它的工作方式与x /i类似，但它有可选的r和m标志，分别显示指令的原始编码和源代码行号对应。

使用disassemble /rm：

(gdb) p free
$1 = {void (void *)} 0x7ffff7df0980 <free>
(gdb) disassemble /rm free,+13
Dump of assembler code from 0x7ffff7df0980 to 0x7ffff7df098d:
121 in dl-minimal.c
   0x00007ffff7df0987 <free+7>: 53                      push   %rbx
   0x00007ffff7df0988 <free+8>: 48 89 fb                mov    %rdi,%rbx

122 in dl-minimal.c
123 in dl-minimal.c
   0x00007ffff7df0980 <free+0>: 48 3b 3d 49 d8 20 00    cmp    0x20d849(%rip),%rdi        # 0x7ffff7ffe1d0 <alloc_last_block>
   0x00007ffff7df098b <free+11>:    74 03               je     0x7ffff7df0990 <free+16>

End of assembler dump

使用x /i：

(gdb) p free
$3 = {void (void *)} 0x7ffff7df0980 <free>
(gdb) x /4i free
   0x7ffff7df0980 <free>:   cmp    0x20d849(%rip),%rdi        # 0x7ffff7ffe1d0 <alloc_last_block>
   0x7ffff7df0987 <free+7>: push   %rbx
   0x7ffff7df0988 <free+8>: mov    %rdi,%rbx
   0x7ffff7df098b <free+11>:    je     0x7ffff7df0990 <free+16>

x /i超过disassemble的优势（取决于您的需求）是x /i接受指令大小而disassemble占用大小（以字节为单位）。< / p>

如何在gdb中反汇编精灵剥离文件？

2 个答案: