Noesis
5.3.17 · D5 · HinglishBuild Systems & Toolchain

Question bank — Disassembly — objdump, reading assembly

2,368 words11 min read↑ Read in English

5.3.17 · D5 · Coding › Build Systems & Toolchain › Disassembly — objdump, reading assembly

Shuru karne se pehle, ek anchor taaki yahan koi word bina earn kiye use na ho:

Traps se pehle — paanch words jo yeh page baar baar use karta hai

Neeche ke questions kuch jargon words par lean karte hain. Taaki kuch bhi use hone se pehle earn ho, yahan plain language mein hain, har ek ek picture se anchored.

Figure — Disassembly — objdump, reading assembly
Figure — Disassembly — objdump, reading assembly
Figure — Disassembly — objdump, reading assembly
Figure — Disassembly — objdump, reading assembly

True or false — justify karo

Har ek ek statement hai. Decide karo, phir kyun bolo — reasoning hi point hai.

T/F: Disassembly original C source perfectly recover kar leta hai.
False — yeh instructions recover karta hai, source nahi. Variable names, comments, types, aur kaunsi lines optimizer ne merge/delete ki, sab gone hain; disassembly ek one-way street hai jo bytes → mnemonics map karta hai, bytes → C nahi.
T/F: Har x86 instruction same number of bytes ki hoti hai.
False — x86 ek CISC design hai; instructions 1 byte (c3 = ret) se lekar 15 tak run karte hain. Isliye aap next instruction "address + 4" se locate nahi kar sakte.
T/F: objdump -d poori file dump karta hai including strings aur data.
False — -d sirf executable .text section ko touch karta hai. Constant strings, globals, aur relocation info doosre ELF sections mein rehte hain aur -s, -r, ya -D chahiye.
T/F: Intel syntax mein, mov rbp, rsp rbp ko rsp mein copy karta hai.
False — Intel destination pehle rakhta hai, toh mov rbp, rsp ka matlab hai rbp = rsp. Trap yeh hai ki left-to-right ko source→dest padhna, jo AT&T convention hai.
T/F: cmp a, b value a - b kahin store kar deta hai aapke use ke liye.
False — cmp a - b compute karta hai sirf CPU flags (ZF/SF/CF/OF) set karne ke liye, phir numeric result throw away kar deta hai. Koi register mein kuch nahi likha jaata; flags hi poora product hain.
T/F: Kam assembly instructions matlab hamesha faster code.
False — ek div 30+ cycles cost kar sakta hai jabki das movs ~3 mein ho jaate hain. Count batata hai kya run hota hai; sirf profiling batata hai kitna fast (pipelining, cache, dependency chains dominate karte hain).
T/F: if (x > 5) ke baad jle (jump if ≤) ek compiler bug hai.
False — yeh normal branch inversion hai. Source kehta hai "body tab karo jab x > 5 ho", toh compiler door jump karta hai jab opposite (x <= 5) hold kare, body skip karte hue. Inverted conditions standard pattern hai.
T/F: lea eax, [rdi+rsi] address rdi+rsi par memory read karta hai.
False — lea (load effective address) address compute karta hai lekin kabhi dereference nahi karta. Yahan optimizer ise pure adder ki tarah abuse karta hai: eax = rdi + rsi, koi memory access nahi aur koi flag side effects nahi.
T/F: 48 89 e5 mein 48 prefix ek separate instruction hai.
False — 48 ek REX prefix hai (ek byte, 40–4f) jiska matlab hai "64-bit operands par operate karo". Yeh agle opcode 89 (mov) ko modify karta hai; yeh apni koi instruction nahi hai.
T/F: -M intel CPU kya execute karta hai woh badal deta hai.
False — -M intel sirf yeh badalta hai ki objdump same bytes ko kaise print karta hai. Machine code identical hai; aap ek display dialect choose kar rahe ho, recompile nahi kar rahe.

Error dhundho

Har line mein ek galat claim ya reading hai. Flaw ka naam batao.

"Bytes 55 48 89 e5 chaar mov instructions mein disassemble hote hain."
Galat count aur galat ops — 55 hai push rbp (1 byte) aur 48 89 e5 hai mov rbp, rsp (3 bytes, jahan 48 REX 64-bit prefix hai). Yeh woh do-instruction prologue hai, chaar movs nahi; aap x86 ko equal chunks mein slice nahi kar sakte.
"Maine AT&T mein mov %eax, %ebx padha toh eax = ebx samjha."
Ulta — % sigils AT&T mark karte hain, jahan source pehle aata hai, toh mov %eax, %ebx ka matlab hai ebx = eax. Direction assign karne se pehle sigils check karo (% registers par, $ immediates par).
"objdump -D bas -d hai more useful output ke saath."
Misleading — -D sabhi ELF sections ko disassemble karta hai, toh data bytes ko instructions ki tarah decode karke garbage mnemonics print karta hai. Yeh noisier hai, strictly "more useful" nahi.
"add eax, edx ka result edx mein hoga kyunki woh second operand tha."
Galat — Intel mein destination pehle hai, toh add eax, edx karta hai eax = eax + edx; sum eax mein jaata hai, jise System V ABI integer return register designate karta hai.
"-O2 version mein koi stack frame nahi hai, toh compiler prologue bhool gaya."
Bhula nahi — optimizer ne prove kar diya ki frame unnecessary tha (koi locals spill nahi hue, koi calls ek stable base ki zarurat nahi) aur deliberately omit kar diya. Absent prologue ek optimization hai, omission nahi.
"Address column 1149: woh jagah hai jahan is line ka data rehta hai."
Galat — address column wahan hai jahan instruction khud baitha hai (uska offset / virtual address), kisi bhi operand ke address par nahi.

Why questions

GNU AT&T syntax default kyun rakhta hai jabki zyaadatar tutorials Intel use karte hain?
Historical: GNU toolchain Unix conventions se bada hua jo AT&T use karte the (source first, % on registers, $ on immediates). Intel syntax dst = src jaisa padhta hai, jo C mein sochne ke tarike se match karta hai, toh learners ise -M intel se flip karte hain.
cmp ek separate instruction ki tarah kyun exist karta hai instead of bas sub use karne ke?
sub apne destination ko difference se overwrite karta hai; often aap comparison flags (ZF/SF/CF/OF) chahte ho bina operand destroy kiye. cmp exactly woh flag side effects deta hai jabki dono values intact rehti hain.
-O0 code args jaise edi/esi seedha stack par kyun spill karta hai?
-O0 par compiler debuggability aur simple, literal translation ko prioritize karta hai, har variable ko ek fixed stack home deta hai taaki ek debugger use dhoondh sake. Higher -O levels values ko registers mein rakhte hain.
Crash address C line number se zyaada useful kyun ho sakta hai?
Optimizers code reorder, inline, aur delete karte hain, toh ek source line kisi single instruction se correspond nahi kar sakti. Faulting instruction address ground truth hai is baare mein ki crash ke waqt actually kya execute hua.
ret ek single byte (c3) kyun hai jabki sub rsp, 0x8 chaar hai?
ret ko koi operands nahi chahiye — yeh bas pop aur jump karta hai, toh ek opcode byte kaafi hai. sub rsp, 0x8 mein REX prefix (64-bit), ek opcode, ek operand descriptor, aur ek immediate hai, isliye ise chaar bytes chahiye.
Assembly padhna kyun matter karta hai agar aap kabhi likhne ka plan nahi banate?
Kyunki yeh jawab deta hai "kya compiler woh kiya jo main sochta tha?" — aap ise optimizations verify karne, crashes samajhne, aur un binaries inspect karne ke liye padhte ho jinke aapke paas source nahi, instructions hand-author karne ke liye nahi.
Integer return value specifically eax/rax mein kyun jaati hai?
Yeh ek contract hai: System V x86-64 ABI rax ko return register designate karta hai taaki caller aur callee agree karein kahan dekhna hai, bina function ke internals inspect kiye.

Edge cases

Agar aap objdump -d ek aise file par run karo jisme koi .text section nahi hai (pure data), toh kya hoga?
Aapko essentially kuch disassemble nahi milega — -d non-executable sections skip karta hai, toh ek data-only object koi instructions nahi dikhata. Raw bytes dekhne ke liye aapko -s chahiye hoga.
Ek .o (unlinked object) disassemble karna ek linked executable se kaisa dikhta hai?
.o mein addresses 0 ke paas start hoti hain aur unresolved call/jump targets placeholders ki tarah dikhte hain; -r woh relocations reveal karta hai (woh "patch-me-later" notes) jinhe linker resolve karta hai. Executable mein final addresses fill in hoti hain.
Agar objdump ek multi-byte instruction ke beech se decoding start kare toh kya hoga?
Nonsense produce hoga — same byte stream alag matlab rakhta hai depending on jahan decoding shuru hoti hai, toh mis-aligned disassembly (common jab -D se data ko code treat kiya jaata hai) plausible-looking lekin galat mnemonics deta hai.
Ek empty function body void f(){} -O2 par kya disassemble karta hai?
Often bas ret (c3) — koi prologue nahi, koi kaam nahi, ek single-byte return. Optimizer sirf woh rakhta hai jo observable hai, aur ek empty function ko bas return karna hai.
Kya do alag byte sequences same mnemonic mein disassemble ho sakti hain?
Haan — kaafi operations ke multiple encodings hain (e.g. alag immediate sizes ya register combos), toh mov, add, wagera byte patterns ki poori families se correspond karte hain, ek fixed sequence se nahi.
Agar binary bina -g ke compile hui ho toh -S kya dikhata hai?
Bahut kam ya koi source interleaving nahi — -S debug info par rely karta hai instructions ko C lines se map karne ke liye, toh -g ke bina aapko plain disassembly milti hai with source column mostly empty.

Connections