Foundations — Disassembly — objdump, reading assembly

5.3.17 · D1 · Coding › Build Systems & Toolchain › Disassembly — objdump, reading assembly

objdump output ki ek bhi line padhne se pehle, chhoti-chhoti ideas ki ek stack already solid honi chahiye. Yeh page unhe ek-ek karke zero se build karta hai, usi order mein jisme woh ek-doosre par depend karte hain. Agar parent note mein koi bhi term hand-wavy laga ho, toh woh yahan define kiya gaya hai.

1. Bit aur byte — machine ka alphabet

Picture: socho 8 light switches ek line mein hain. Har switch ek bit hai — upar ya neeche. 8 switches ki poori line ek byte hai. Un 8 switches se 256 alag-alag patterns ban sakte hain.

Topic ko yeh kyun chahiye: CPU jo bhi instructions run karta hai woh bytes ke roop mein stored hote hain. Jab objdump 48 83 ec 08 print karta hai, toh woh char bytes hain — switches ki char rows. Disassembly literally inhi switch-patterns ko padhne ki art hai.

2. Hexadecimal — bytes ka shorthand

Yeh tool kyun, plain decimal kyun nahi? Ek byte = 8 bits = 0 se 255 tak ka number. Decimal mein likhne par 1–3 digits lagte hain jinka width unpredictable hota hai. Lekin 8 bits do groups of 4 bits mein neatly split ho jaate hain, aur 4 bits ka har group exactly ek hex digit hota hai (4 bits = 16 values = ek hex digit). Isliye har byte hamesha exactly do hex characters ka hota hai — tidy aur aligned.

Picture: apni 8 switches ki row ko beech se split karo. Left wale 4 switches ek hex digit banate hain, right wale 4 doosra. Objdump line mein 48 ka matlab hai woh byte jiske switches 0100 1000 read karte hain.

Topic ko yeh kyun chahiye: objdump output ka har column — addresses, raw bytes, immediate values jaise 0x8 — hex mein print hota hai. Hex padhe bina disassembly line nahi padh sakte.

3. Machine code vs. assembly vs. source — teen languages

Assembly aur machine code same instructions hain — ek bytes hai, doosra un bytes ka readable label. Dono mein ek-ek ka map hota hai.

Topic ko yeh kyun chahiye: disassembly woh arrow hai jo machine code se assembly ki taraf wapas jaata hai. Compilation source → asm → machine code ki taraf jaata hai; disassembly last arrow ko ulta chalata hai. Compilation Pipeline forward direction cover karta hai. Kyunki source→asm step reversible nahi hai (comments, variable names, aur structure sab kho jaate hain), disassembly sirf assembly layer recover kar sakta hai — tumhara original C kabhi nahi.

4. CPU, registers, aur memory

Picture: registers tumhari desk par rakhe thode se pencils hain (instant reach); memory room ke doosri taraf rakhaa bada filing cabinet hai (slower, lekin vast). CPU pencils par kaam karta hai aur cabinet se paper laata-lejata hai.

Topic ko yeh kyun chahiye: disassembly mein har operand ya toh ek register (rbp, eax), ek memory address ([rbp-0x4]), ya ek immediate constant (0x8) hota hai. Teeno ko sight se pehchaanna zaroori hai.

5. Instruction — opcode + operands

$\underset{\text{opcode}}{\underbrace{\text{add}}}\underset{\text{operands}}{\underbrace{\text{eax},\text{edx}}}$

Picture: imperative mood mein ek sentence. "Add edx into eax." Pehle verb, phir cheezein.

Topic ko yeh kyun chahiye: yahi reason hai ki tum fixed number of bytes count karke next instruction nahi dhundh sakte. objdump yeh kaam karta hai ki ek instruction kahan khatam hota hai aur doosra kahan shuru hota hai.

6. Operand notation — [...], immediates, aur offsets

Picture: rbp paper par likha ek ghar ka address hai. [rbp-0x4] ka matlab hai "us ghar tak jao, phir 4 boxes peeche dekho, aur kholo." Brackets = box kholo.

Topic ko yeh kyun chahiye: parent note mein add function poora [rbp-0x…] se registers mein load karne aur wapas daalne ka dance hai. Brackets miss karo toh memory access ko number samjhoge.

7. Object files, sections, aur .text

Topic ko yeh kyun chahiye: objdump -d sirf .text section ko disassemble karta hai — kyunki sirf code hi instructions ke roop mein padhne ke liye hota hai. objdump ka -D data par point karo toh woh numbers ko instructions ki tarah decode karne ki koshish karega, jisse nonsense niklega. Sections ke existence ka pata hona explain karta hai yeh kyun hota hai.

8. Flags register aur conditional jumps

Picture: har subtraction ke baad CPU kuch status LEDs flip karta hai — ek "was-zero" LED, ek "was-negative" LED. cmp x, 5 sirf in LEDs ko jalane ke liye x - 5 subtract karta hai, phir number fek deta hai. jle LEDs dekh kar jump karta hai agar $x\le 5$ ho.

Topic ko yeh kyun chahiye: yahi hai jaise har if aur loop assembly mein dikhta hai (cmp phir ek conditional jump). Flags ke existence ka pata na ho toh branch logic jaadu jaisa lagta hai.

Prerequisite map

Har foundation agle ko feed karta hai; Disassembly mein jaane wale char arrows woh char skills hain jo tum actually har line mein use karte ho: layer pehchano, operands padho, jaano ki yeh .text mein hai, aur flags/jumps control flow follow karo.

Aage yeh lead karta hai

• Calling Conventions (System V x86-64) — kaun se registers arguments aur returns hold karte hain (§4 par build hota hai).
• Stack Frames & The Stack Pointer — rbp/rsp aur [rbp-0x4] actually kya organize karte hain (§4, §6 par build hota hai).
• Compiler Optimization Levels — kyun -O0 aur -O2 wildly different asm produce karte hain.
• Debugging with GDB — inhi registers/addresses ko live use karna.

Equipment checklist