Skip to content

Instantly share code, notes, and snippets.

@utsengar
Created November 1, 2011 04:32
Show Gist options
  • Save utsengar/1329947 to your computer and use it in GitHub Desktop.
Save utsengar/1329947 to your computer and use it in GitHub Desktop.
Object dump using gobjdump on Mac OSX
1. Write a hello hello world c
main( )
{
printf("Hello World\n");
}
2. Compile it: gcc hello.c
Bonus: `gcc -Wall -save-temps hello.c -o hello` will give you extra stuff like:
1. temp file (.i),
2. intermediate file which has the machine code (.o) and
3. assembly instructions (.s)
3. gobjdump -p a.out (Install binutils if you don't have it, port install binutils)
4. The object dump.
a.out: file format mach-o-x86-64
Mach-O header:
magic : feedfacf
cputype : 01000007 (x86_64)
cpusubtype: 80000003
filetype : 00000002 (execute)
ncmds : 0000000d (13)
sizeofcmds: 00000620
flags : 00200085 (noundefs+dyldlink+twolevel+pie)
reserved : 00000000
Load command segment_64: name: __PAGEZERO
vmaddr: 0000000000000000 vmsize: 0000000100000000
fileoff: 0000000000000000 filesize: 0000000000000000 endoff: 0000000000000000
nsects: 0 flags: 0
Load command segment_64: name: __TEXT
vmaddr: 0000000100000000 vmsize: 0000000000001000
fileoff: 0000000000000000 filesize: 0000000000001000 endoff: 0000000000001000
nsects: 6 flags: 0
Section: __text __TEXT (bfdname: .text)
addr: 0000000100000ec0 size: 0000000000000060 offset: 0000000000000ec0
align: 4 nreloc: 0 reloff: 0000000000000000
flags: 80000400 (type: regular attr: some_instructions+pure_instructions)
reserved1: 0x0 reserved2: 0x0 reserved3: 0x0
Section: __stubs __TEXT (bfdname: __TEXT.__stubs)
addr: 0000000100000f20 size: 000000000000000c offset: 0000000000000f20
align: 1 nreloc: 0 reloff: 0000000000000000
flags: 80000408 (type: symbol_stubs attr: some_instructions+pure_instructions)
first indirect sym: 0 (2 entries) stub size: 6 reserved3: 0x0
Section: __stub_helper __TEXT (bfdname: __TEXT.__stub_helper)
addr: 0000000100000f2c size: 0000000000000024 offset: 0000000000000f2c
align: 2 nreloc: 0 reloff: 0000000000000000
flags: 80000400 (type: regular attr: some_instructions+pure_instructions)
reserved1: 0x0 reserved2: 0x0 reserved3: 0x0
Section: __cstring __TEXT (bfdname: .cstring)
addr: 0000000100000f50 size: 000000000000000c offset: 0000000000000f50
align: 0 nreloc: 0 reloff: 0000000000000000
flags: 00000002 (type: cstring_literals attr: -)
reserved1: 0x0 reserved2: 0x0 reserved3: 0x0
Section: __unwind_info __TEXT (bfdname: __TEXT.__unwind_info)
addr: 0000000100000f5c size: 0000000000000050 offset: 0000000000000f5c
align: 0 nreloc: 0 reloff: 0000000000000000
flags: 00000000 (type: regular attr: -)
reserved1: 0x0 reserved2: 0x0 reserved3: 0x0
Section: __eh_frame __TEXT (bfdname: .eh_frame)
addr: 0000000100000fb0 size: 0000000000000048 offset: 0000000000000fb0
align: 3 nreloc: 0 reloff: 0000000000000000
flags: 00000000 (type: regular attr: -)
reserved1: 0x0 reserved2: 0x0 reserved3: 0x0
Load command segment_64: name: __DATA
vmaddr: 0000000100001000 vmsize: 0000000000001000
fileoff: 0000000000001000 filesize: 0000000000001000 endoff: 0000000000002000
nsects: 4 flags: 0
Section: __program_vars __DATA (bfdname: __DATA.__program_vars)
addr: 0000000100001000 size: 0000000000000028 offset: 0000000000001000
align: 4 nreloc: 0 reloff: 0000000000000000
flags: 00000000 (type: regular attr: -)
reserved1: 0x0 reserved2: 0x0 reserved3: 0x0
Section: __nl_symbol_ptr __DATA (bfdname: .non_lazy_symbol_ptr)
addr: 0000000100001028 size: 0000000000000010 offset: 0000000000001028
align: 3 nreloc: 0 reloff: 0000000000000000
flags: 00000006 (type: non_lazy_symbol_pointers attr: -)
first indirect sym: 2 (2 entries) reserved2: 0x0 reserved3: 0x0
Section: __la_symbol_ptr __DATA (bfdname: .lazy_symbol_ptr)
addr: 0000000100001038 size: 0000000000000010 offset: 0000000000001038
align: 3 nreloc: 0 reloff: 0000000000000000
flags: 00000007 (type: lazy_symbol_pointers attr: -)
first indirect sym: 4 (2 entries) reserved2: 0x0 reserved3: 0x0
Section: __common __DATA (bfdname: __DATA.__common)
addr: 0000000100001048 size: 0000000000000020 offset: 0000000000000000
align: 3 nreloc: 0 reloff: 0000000000000000
flags: 00000001 (type: zerofill attr: -)
reserved1: 0x0 reserved2: 0x0 reserved3: 0x0
Load command segment_64: name: __LINKEDIT
vmaddr: 0000000100002000 vmsize: 0000000000001000
fileoff: 0000000000002000 filesize: 00000000000001f0 endoff: 00000000000021f0
nsects: 0 flags: 0
Load command dyld_info:
rebase: off: 0x00002000 size: 8
bind: off: 0x00002008 size: 24
weak bind: off: 0x00000000 size: 0
lazy bind: off: 0x00002020 size: 24
export: off: 0x00002038 size: 120
Load command symtab:
symoff: 0x000020b8 nsyms: 11 (endoff: 0x00002168)
stroff: 0x00002180 strsize: 112 (endoff: 0x000021f0)
Load command dysymtab:
local symbols: idx: 0 num: 1 (nxtidx: 1)
external symbols: idx: 1 num: 7 (nxtidx: 8)
undefined symbols: idx: 8 num: 3 (nxtidx: 11)
table of content: off: 0x00000000 num: 0 (endoff: 0x00000000)
module table: off: 0x00000000 num: 0 (endoff: 0x00000000)
external reference table: off: 0x00000000 num: 0 (endoff: 0x00000000)
indirect symbol table: off: 0x00002168 num: 6 (endoff: 0x00002180)
external relocation table: off: 0x00000000 num: 0 (endoff: 0x00000000)
local relocation table: off: 0x00000000 num: 0 (endoff: 0x00000000)
indirect symbols:
for section __TEXT.__stubs:
0000000100000f20 0: 0x00000008 _exit
0000000100000f26 1: 0x00000009 _puts
for section __DATA.__nl_symbol_ptr:
0000000100001028 2: 0x40000000 ABSOLUTE
0000000100001030 3: 0x40000000 ABSOLUTE
for section __DATA.__la_symbol_ptr:
0000000100001038 4: 0x00000008 _exit
0000000100001040 5: 0x00000009 _puts
Load command load_dylinker: /usr/lib/dyld
Load command uuid: 6e 36 a1 13 e1 4e 3e cc bc 81 b1 fa d9 6f d5 d3
Load command *UNKNOWN*:
Load command unixthread: nflavours: 1
0: flavour: 0x00000004 offset: 0x00000550 size: 0x000000a8
Load command load_dylib: /usr/lib/libSystem.B.dylib
time stamp: 0x00000002
current version: 0x009f0100
comptibility version: 0x00010000
Load command *UNKNOWN*:
Segments and Sections:
#: Segment name Section name Address
[Segment __PAGEZERO 0000000000000000-00000000ffffffff ---]
[Segment __TEXT 0000000100000000-0000000100000fff r-x]
01: __TEXT __text 0000000100000ec0 0000000000000060 80000400
02: __TEXT __stubs 0000000100000f20 000000000000000c 80000408
03: __TEXT __stub_helper 0000000100000f2c 0000000000000024 80000400
04: __TEXT __cstring 0000000100000f50 000000000000000c 00000002
05: __TEXT __unwind_info 0000000100000f5c 0000000000000050 00000000
06: __TEXT __eh_frame 0000000100000fb0 0000000000000048 00000000
[Segment __DATA 0000000100001000-0000000100001fff rw-]
07: __DATA __program_vars 0000000100001000 0000000000000028 00000000
08: __DATA __nl_symbol_ptr 0000000100001028 0000000000000010 00000006
09: __DATA __la_symbol_ptr 0000000100001038 0000000000000010 00000007
10: __DATA __common 0000000100001048 0000000000000020 00000001
[Segment __LINKEDIT 0000000100002000-0000000100002fff r--]
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment