Monday, April 29, 2013

How to disassemble raw x86 code

Source: http://stackoverflow.com/questions/1737095/how-do-i-disassemble-raw-x86-code


objdump -D -b binary -mi386 -Maddr16,data16 mbr


--target instead of -b-D is "disassemble the contents of all sections"; -b bfdname or --target=bfdname will force reading as specified object-code format (not elf but raw binary in our case); -m machine will specify the architecture to use (in our file there is no header with arch info). -M options are options of disassembler; addr16,data16 are used to "specify the default address size and operand size" (treat code as i8086 one in the universal x86 disasm engine) 

No comments: