如何通过gdb查看反汇编代码
如何通过gdb查看反汇编代码
0x00 程序源码
C代码如下：
#include <stdio.h>
int addme(int a, int b)
{
int c ;
c = a+ b;
return c;
}
int main(int argc, char const *argv[])
{
int ret= 0;
ret = addme(10,20);
printf("%d\n", ret);
return 0;
}
0x01 编译⽣成可执⾏⽂件
$ gcc -g3 -o add.out add.c
0x02 gdb加载
$ gdb add.out
运⾏结果如下：
GNU gdb (Ubuntu 7.11.1-0ubuntu1~16.5) 7.11.1
Copyright (C) 2016 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later </licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.  Type "show copying"
and "show warranty" for details.
This GDB was configured as "x86_64-linux-gnu".
Type "show configuration" for configuration details.
For bug reporting instructions, please see:
</software/gdb/bugs/>.
Find the GDB manual and other documentation resources online at:
</software/gdb/documentation/>.
For help, type "help".
Type "apropos word" to search for commands related to "word"...
Reading symbols from done.
(gdb) disassemble
No frame selected.
(gdb) b main
Breakpoint 1 at 0x40054f: file add.c, line 11.
(gdb) r
Starting program: /home/test/tmp/test_assembly/add.out
Breakpoint 1, main (argc=1, argv=0x7fffffffdc48) at add.c:11
11      int ret= 0;
先运⾏了disassemble命令，提⽰没有栈帧。看来反汇编只能在运⾏过程中使⽤。于是在main函数中下了断点。0x03 反汇编main函数
(gdb) disassemble main
Dump of assembler code for function main:
0x0000000000400540 <+0>: push  %rbp
0x0000000000400541 <+1>: mov%rsp,%rbp
0x0000000000400544 <+4>: sub$0x20,%rsp
0x0000000000400548 <+8>: mov%edi,-0x14(%rbp)
0x000000000040054b <+11>:    mov%rsi,-0x20(%rbp)
=> 0x000000000040054f <+15>:    movl  $0x0,-0x4(%rbp)
0x0000000000400556 <+22>:    mov$0x14,%esi
0x000000000040055b <+27>:    mov$0xa,%edi
0x0000000000400560 <+32>:    callq  0x400526 <addme>
0x0000000000400565 <+37>:    mov%eax,-0x4(%rbp)
0x0000000000400568 <+40>:    mov-0x4(%rbp),%eax
0x000000000040056b <+43>:    mov%eax,%esi
0x000000000040056d <+45>:    mov$0x400614,%edi
0x0000000000400572 <+50>:    mov$0x0,%eax
0x0000000000400577 <+55>:    callq  0x400400 <printf@plt>
0x000000000040057c <+60>:    mov$0x0,%eax
0x0000000000400581 <+65>:    leaveq
0x0000000000400582 <+66>:    retq
End of assembler dump.
“=>“箭头指的位置为断点断下来的位置，可以看出来等价于”int ret= 0;“.
0x04 带源码的反汇编addme函数
(gdb) disassemble /m addme
Dump of assembler code for function addme:
4  {
0x0000000000400526 <+0>: push  %rbp
0x0000000000400527 <+1>: mov%rsp,%rbp
0x000000000040052a <+4>: mov%edi,-0x14(%rbp)
0x000000000040052d <+7>: mov%esi,-0x18(%rbp)
5      int c ;
6      c = a+ b;
0x0000000000400530 <+10>:    mov-0x14(%rbp),%edx
0x0000000000400533 <+13>:    mov-0x18(%rbp),%eax
0x0000000000400536 <+16>:    add%edx,%eax
0x0000000000400538 <+18>:    mov%eax,-0x4(%rbp)
7      return c;
0x000000000040053b <+21>:    mov-0x4(%rbp),%eax
8  }
0x000000000040053e <+24>:    pop%rbp
0x000000000040053f <+25>:    retq
End of assembler dump.
0x05 切换成intel指令格式
GDB默认汇编格式是AT&T格式，windows⽤户会感觉很蛋疼，GDB很给⼒的⽀持切换成intel指令集。切换intel格式的命令:
set disassembly-flavor intel
切换成att格式的命令:
set disassembly-flavor att
具体操作如下：
(gdb) set disassembly-flavor intel
(gdb) disassemble /m addme
Dump of assembler code for function addme:如何查看html代码
4  {
0x0000000000400526 <+0>: push  rbp
0x0000000000400527 <+1>: movrbp,rsp
0x000000000040052a <+4>: movDWORD PTR [rbp-0x14],edi
0x000000000040052d <+7>: movDWORD PTR [rbp-0x18],esi
5      int c ;
6      c = a+ b;
0x0000000000400530 <+10>:    movedx,DWORD PTR [rbp-0x14]  0x0000000000400533 <+13>:    moveax,DWORD PTR [rbp-0x18]  0x0000000000400536 <+16>:    addeax,edx
0x0000000000400538 <+18>:    movDWORD PTR [rbp-0x4],eax
7      return c;
0x000000000040053b <+21>:    moveax,DWORD PTR [rbp-0x4]
8  }
0x000000000040053e <+24>:    poprbp
0x000000000040053f <+25>:    ret
End of assembler dump.
0x06 参考⽂献

版权声明：本站内容均来自互联网，仅供演示用，请勿用于商业和其他非法用途。如果侵犯了您的权益请与我们联系QQ:729038198，我们将在24小时内删除。