Disassembly — objdump, reading assembly

5.3.17 · Coding › Build Systems & Toolchain

Disassembly exist kyun karta hai?

Kyun zaroorat hai (80/20):

• Ek crash tumhe ek faulting address deta hai, C ki line nahi. Disassembly woh gap bridge karta hai.
• Optimizers tumhara code reorder/delete kar dete hain. Ek maatra ground truth emitted instructions hain.
• Security/reverse engineering: aksar tumhare paas koi source nahi hota, sirf binary hoti hai.

Poori pipeline:

$\text{.c}\stackrel{\text{compile}}{\to }\text{.s (asm)}\stackrel{\text{assemble}}{\to }\text{.o (machine code)}\stackrel{\text{link}}{\to }\text{executable}$

Disassembly woh arrow .o ya executable se ulta chalata hai.

objdump ko invoke kaise karein

Do syntaxes kyun exist karti hain: historical reason hai. GNU default AT&T hai (mov %eax, %ebx ka matlab ebx = eax hai, src→dst, registers % se prefix, immediates $). Intel (mov ebx, eax ka matlab ebx = eax hai, dst←src) math assignment jaisa padhta hai. Hum Intel use karte hain kyunki yeh tumhare sochne ke tarike se match karta hai: dst = src.

Disassembly ki ek line kaisi dikhti hai

Ek single line mein chaar columns hote hain:

 1149:   48 83 ec 08             sub    rsp, 0x8
  ^addr   ^raw bytes              ^mnemonic ^operands

• address 1149: is instruction ka offset/virtual address.
• raw bytes 48 83 ec 08: actual machine code (x86 par variable length).
• mnemonic sub: operation kya hai.
• operands rsp, 0x8: yeh kis par operate karta hai.

Ek real function scratch se padhna (DERIVATION)

Source:

int add(int a, int b) {
    return a + b;
}

Compile karo: gcc -O0 -g -c add.c phir objdump -d -M intel add.o:

0000000000000000 <add>:
   0:  55                 push   rbp           ; caller ka frame ptr save karo
   1:  48 89 e5           mov    rbp, rsp      ; naya frame set up karo
   4:  89 7d fc           mov    [rbp-0x4], edi ; arg a (edi) ko stack par spill karo
   7:  89 75 f8           mov    [rbp-0x8], esi ; arg b (esi) ko stack par spill karo
   a:  8b 55 fc           mov    edx, [rbp-0x4] ; a load karo
   d:  8b 45 f8           mov    eax, [rbp-0x8] ; b load karo
  10:  01 d0              add    eax, edx       ; eax = b + a
  12:  5d                 pop    rbp            ; frame restore karo
  13:  c3                 ret                   ; return karo (result eax mein)

Line-by-line padh rahe hain — Yeh step kyun?

• push rbp / mov rbp,rsp — Kyun? Standard function prologue: old base pointer save karta hai aur locals ke liye ek stable reference frame establish karta hai.
• mov [rbp-0x4], edi — Kyun? System V x86-64 calling convention arg 1 edi mein, arg 2 esi mein pass karta hai. -O0 par compiler inhe turant stack par spill kar deta hai.
• add eax, edx — Kyun eax? Convention integers ==rax/eax== mein return karti hai. To compiler result wahan arrange karta hai.
• ret — return address pop karta hai aur uspar jump karta hai.

Control flow: if/loops kaise dikhte hain

Common mistakes

Flashcards

Connections

• Compilation Pipeline — disassembly assemble step ka reverse hai.
• Calling Conventions (System V x86-64) — rdi, rsi, rax usage explain karta hai.
• Stack Frames & The Stack Pointer — prologue/epilogue push rbp/sub rsp.
• Compiler Optimization Levels — -O0 vs -O2 aur asm kya reveal karta hai.
• Debugging with GDB — disassemble aur layout asm same decoding use karte hain.
• ELF Object Files & Sections — .text, .data, relocations jo -r dikhata hai.
• CISC vs RISC — kyun x86 encodings variable length hoti hain.

Concept Map