Disassembly — objdump, reading assembly

WHY does disassembly exist?

WHY you care (the 80/20):

• A crash gives you a faulting address, not a line of C. Disassembly bridges that gap.
• Optimizers reorder/delete your code. The only ground truth is the emitted instructions.
• Security/reverse engineering: you often have no source, only the binary.

The full pipeline:

$\text{.c} \xrightarrow{\text{compile}} \text{.s (asm)} \xrightarrow{\text{assemble}} \text{.o (machine code)} \xrightarrow{\text{link}} \text{executable}$

Disassembly runs that arrow backwards from the .o or executable.

HOW to invoke objdump

WHY two syntaxes exist: historical. GNU defaults to AT&T (mov %eax, %ebx means ebx = eax, src→dst, registers prefixed %, immediates $). Intel (mov ebx, eax means ebx = eax, dst←src) reads like math assignment. We use Intel because it matches how you think: dst = src.

WHAT a disassembly line looks like

A single line has four columns:

 1149:   48 83 ec 08             sub    rsp, 0x8
  ^addr   ^raw bytes              ^mnemonic ^operands

• address 1149: offset/virtual address of this instruction.
• raw bytes 48 83 ec 08: the actual machine code (variable length on x86).
• mnemonic sub: the operation.
• operands rsp, 0x8: what it operates on.

Reading a real function from scratch (DERIVATION)

Source:

int add(int a, int b) {
    return a + b;
}

Compile: gcc -O0 -g -c add.c then objdump -d -M intel add.o:

0000000000000000 <add>:
   0:  55                 push   rbp           ; save caller's frame ptr
   1:  48 89 e5           mov    rbp, rsp      ; set up new frame
   4:  89 7d fc           mov    [rbp-0x4], edi ; spill arg a (edi) to stack
   7:  89 75 f8           mov    [rbp-0x8], esi ; spill arg b (esi) to stack
   a:  8b 55 fc           mov    edx, [rbp-0x4] ; load a
   d:  8b 45 f8           mov    eax, [rbp-0x8] ; load b
  10:  01 d0              add    eax, edx       ; eax = b + a
  12:  5d                 pop    rbp            ; restore frame
  13:  c3                 ret                   ; return (result in eax)

Reading it line-by-line — Why this step?

• push rbp / mov rbp,rsp — Why? Standard function prologue: saves the old base pointer and establishes a stable reference frame for locals.
• mov [rbp-0x4], edi — Why? The System V x86-64 calling convention passes arg 1 in edi, arg 2 in esi. At -O0 the compiler immediately spills them to stack.
• add eax, edx — Why eax? The convention returns integers in ==rax/eax==. So the compiler arranges the result there.
• ret — pops the return address and jumps to it.

Control flow: how if/loops look

Common mistakes

Flashcards

Connections

• Compilation Pipeline — disassembly is the reverse of the assemble step.
• Calling Conventions (System V x86-64) — explains rdi, rsi, rax usage.
• Stack Frames & The Stack Pointer — prologue/epilogue push rbp/sub rsp.
• Compiler Optimization Levels — -O0 vs -O2 and what the asm reveals.
• Debugging with GDB — disassemble and layout asm use the same decoding.
• ELF Object Files & Sections — .text, .data, relocations that -r shows.
• CISC vs RISC — why x86 encodings are variable length.

Concept Map

Hinglish (regional understanding)