概述:上次用java生成exe文件。那如何解析exe文件呢?0.0??
.data:
.pdata (Procedure Data):
.rdata (Read-Only Data):
.reloc (Relocation):
.rodata (Read-Only Data):
.svm_hea (SVM Header):
.text:
objdump? --help
Usage: objdump <option(s)> <file(s)>
Display information from object <file(s)>.
At least one of the following switches must be given:
-a, --archive-headers Display archive header information
-f, --file-headers Display the contents of the overall file header
-p, --private-headers Display object format specific file header contents
-P, --private=OPT,OPT... Display object format specific contents
-h, --[section-]headers Display the contents of the section headers
-x, --all-headers Display the contents of all headers
-d, --disassemble Display assembler contents of executable sections
-D, --disassemble-all Display assembler contents of all sections
--disassemble=<sym> Display assembler contents from <sym>
-S, --source Intermix source code with disassembly
--source-comment[=<txt>] Prefix lines of source code with <txt>
-s, --full-contents Display the full contents of all sections requested
-g, --debugging Display debug information in object file
-e, --debugging-tags Display debug information using ctags style
-G, --stabs Display (in raw form) any STABS info in the file
-W, --dwarf[a/=abbrev, A/=addr, r/=aranges, c/=cu_index, L/=decodedline,
f/=frames, F/=frames-interp, g/=gdb_index, i/=info, o/=loc,
m/=macro, p/=pubnames, t/=pubtypes, R/=Ranges, l/=rawline,
s/=str, O/=str-offsets, u/=trace_abbrev, T/=trace_aranges,
U/=trace_info]
Display the contents of DWARF debug sections
-Wk,--dwarf=links Display the contents of sections that link to
separate debuginfo files
-WK,--dwarf=follow-links
Follow links to separate debug info files (default)
-WN,--dwarf=no-follow-links
Do not follow links to separate debug info files
-L, --process-links Display the contents of non-debug sections in
separate debuginfo files. (Implies -WK)
--ctf[=SECTION] Display CTF info from SECTION, (default `.ctf')
--sframe[=SECTION] Display SFrame info from SECTION, (default '.sframe')
-t, --syms Display the contents of the symbol table(s)
-T, --dynamic-syms Display the contents of the dynamic symbol table
-r, --reloc Display the relocation entries in the file
-R, --dynamic-reloc Display the dynamic relocation entries in the file
@<file> Read options from <file>
-v, --version Display this program's version number
-i, --info List object formats and architectures supported
-H, --help Display this information
The following switches are optional:
-b, --target=BFDNAME Specify the target object format as BFDNAME
-m, --architecture=MACHINE Specify the target architecture as MACHINE
-j, --section=NAME Only display information for section NAME
-M, --disassembler-options=OPT Pass text OPT on to the disassembler
-EB --endian=big Assume big endian format when disassembling
-EL --endian=little Assume little endian format when disassembling
--file-start-context Include context from start of file (with -S)
-I, --include=DIR Add DIR to search list for source files
-l, --line-numbers Include line numbers and filenames in output
-F, --file-offsets Include file offsets when displaying information
-C, --demangle[=STYLE] Decode mangled/processed symbol names
STYLE can be "none", "auto", "gnu-v3",
"java", "gnat", "dlang", "rust"
--recurse-limit Enable a limit on recursion whilst demangling
(default)
--no-recurse-limit Disable a limit on recursion whilst demangling
-w, --wide Format output for more than 80 columns
-U[d|l|i|x|e|h] Controls the display of UTF-8 unicode characters
--unicode=[default|locale|invalid|hex|escape|highlight]
-z, --disassemble-zeroes Do not skip blocks of zeroes when disassembling
--start-address=ADDR Only process data whose address is >= ADDR
--stop-address=ADDR Only process data whose address is < ADDR
--no-addresses Do not print address alongside disassembly
--prefix-addresses Print complete address alongside disassembly
--[no-]show-raw-insn Display hex alongside symbolic disassembly
--insn-width=WIDTH Display WIDTH bytes on a single line for -d
--adjust-vma=OFFSET Add OFFSET to all displayed section addresses
--show-all-symbols When disassembling, display all symbols at a given address
--special-syms Include special symbols in symbol dumps
--inlines Print all inlines for source line (with -l)
--prefix=PREFIX Add PREFIX to absolute paths for -S
--prefix-strip=LEVEL Strip initial directory names for -S
--dwarf-depth=N Do not display DIEs at depth N or greater
--dwarf-start=N Display DIEs starting at offset N
--dwarf-check Make additional dwarf consistency checks.
--ctf-parent=NAME Use CTF archive member NAME as the CTF parent
--visualize-jumps Visualize jumps by drawing ASCII art lines
--visualize-jumps=color Use colors in the ASCII art
--visualize-jumps=extended-color
Use extended 8-bit color codes
--visualize-jumps=off Disable jump visualization
--disassembler-color=off Disable disassembler color output. (default)
--disassembler-color=terminal Enable disassembler color output if displaying on a terminal.
--disassembler-color=on Enable disassembler color output.
--disassembler-color=extended Use 8-bit colors in disassembler output.
objdump: supported targets: pe-x86-64 pei-x86-64 pe-bigobj-x86-64 elf64-x86-64 pe-i386 pei-i386 elf32-i386 elf32-iamcu pdb elf64-little elf64-big elf32-little elf32-big srec symbolsrec verilog tekhex binary ihex plugin
objdump: supported architectures: i386 i386:x86-64 i386:x64-32 i8086 i386:intel i386:x86-64:intel i386:x64-32:intel iamcu iamcu:intel
The following i386/x86-64 specific disassembler options are supported for use
with the -M switch (multiple options should be separated by commas):
x86-64 Disassemble in 64bit mode
i386 Disassemble in 32bit mode
i8086 Disassemble in 16bit mode
att Display instruction in AT&T syntax
intel Display instruction in Intel syntax
att-mnemonic
Display instruction in AT&T mnemonic
intel-mnemonic
Display instruction in Intel mnemonic
addr64 Assume 64bit address size
addr32 Assume 32bit address size
addr16 Assume 16bit address size
data32 Assume 32bit data size
data16 Assume 16bit data size
suffix Always display instruction suffix in AT&T syntax
amd64 Display instruction in AMD64 ISA
intel64 Display instruction in Intel64 ISA
Report bugs to <https://sourceware.org/bugzilla/>.
-a
:显示归档头信息-f
:显示整个文件头信息-p
:显示对象格式特定的文件头内容-P
:显示对象格式特定的内容-h
:显示节头信息-x
:显示所有节头信息-d
:显示可执行段的汇编代码-D
:显示所有可执行段的汇编代码--disassemble=<sym>
:显示指定符号的汇编代码-S
:将源代码与反汇编代码混合在一起-s
:显示完整内容-g
:显示调试信息-e
:使用ctags风格的调试信息-G
:显示DWARF调试信息-w
:格式化输出以适应80列以上宽度--unicode=[default|locale|invalid|hex|escape|highlight]
:控制显示UTF-8 Unicode字符的方式--start-address=ADDR
:只处理地址大于等于ADDR的数据--stop-address=ADDR
:只处理地址小于ADDR的数据--no-addresses
:不打印地址信息--prefix-addresses
:在反汇编时打印完整的地址信息--insn-width=WIDTH
:在反汇编时,每行显示WIDTH个字节--adjust-vma=OFFSET
:将所有显示的节地址加上OFFSET--show-all-symbols
:在反汇编时,显示给定地址的所有符号--special-syms
:在符号转储中包含特殊符号--inlines
:在源行上打印所有内联函数--prefix=PREFIX
:为-S选项添加前缀--prefix-strip=LEVEL
:为-S选项删除初始目录名--dwarf-depth=N
:不显示深度大于或等于N的DIEs--dwarf-start=N
:显示从偏移量N开始的DIEs--dwarf-check
:进行额外的dwarf一致性检查--ctf-parent=NAME
:使用CTF存档成员NAME作为CTF父级--visualize-jumps
:通过绘制ASCII艺术线条可视化跳转--visualize-jumps=color
:使用颜色在ASCII艺术中显示跳转--visualize-jumps=extended-color
:使用扩展的8位颜色代码显示跳转--visualize-jumps=off
:禁用跳转可视化--disassembler-color=off
:禁用反汇编器颜色输出(默认)--disassembler-color=terminal
:如果显示在终端上,则启用反汇编器颜色输出--disassembler-color=on
:启用反汇编器颜色输出--disassembler-color=extended
:在反汇编器输出中使用8位颜色标准用法就是objdump <-options> 可执行文件
例如:objdump -d? ?main.exe? ? ? ? ?显示可执行段的汇编代码
执行? objdump -h main.exe? ? ?显示节头信息
执行??objdump -s?main.exe? ?显示完整内容?
还在往下走,数量有点大。