Skip to content

Instantly share code, notes, and snippets.

@neuralsandwich
Last active August 23, 2016 09:19
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save neuralsandwich/6ab9995f6a6766e688e9 to your computer and use it in GitHub Desktop.
Save neuralsandwich/6ab9995f6a6766e688e9 to your computer and use it in GitHub Desktop.
Differences between lld and tool

Display shared libraries the binary uses

>$ ldd /bin/mv
	linux-vdso.so.1 =>  (0x00007ffe504e0000)
	libselinux.so.1 => /lib/x86_64-linux-gnu/libselinux.so.1 (0x00007fc974642000)
	libacl.so.1 => /lib/x86_64-linux-gnu/libacl.so.1 (0x00007fc974439000)
	libattr.so.1 => /lib/x86_64-linux-gnu/libattr.so.1 (0x00007fc974233000)
	libc.so.6 => /lib/x86_64-linux-gnu/libc.so.6 (0x00007fc973e69000)
	libpcre.so.3 => /lib/x86_64-linux-gnu/libpcre.so.3 (0x00007fc973bfc000)
	libdl.so.2 => /lib/x86_64-linux-gnu/libdl.so.2 (0x00007fc9739f7000)
	/lib64/ld-linux-x86-64.so.2 (0x00007fc97486d000)
	libpthread.so.0 => /lib/x86_64-linux-gnu/libpthread.so.0 (0x00007fc9737d9000)
>$ otool -L
/bin/mv:
	/usr/lib/libSystem.B.dylib (compatibility version 1.0.0, current version 1226.10.1)

Display disassembly

>$ objdump -D /bin/mv | head

/bin/mv:     file format elf64-x86-64


Disassembly of section .interp:

0000000000400238 <.interp>:
  400238:       2f                      (bad)  
  400239:       6c                      insb   (%dx),%es:(%rdi)
  40023a:       69 62 36 34 2f 6c 64    imul   $0x646c2f34,0x36(%rdx),%esp
codeplay@builded01:~$ objdump -d /bin/mv | head

/bin/mv:     file format elf64-x86-64


Disassembly of section .init:

0000000000402720 <_init>:
  402720:       48 83 ec 08             sub    $0x8,%rsp
  402724:       48 8b 05 cd a8 21 00    mov    0x21a8cd(%rip),%rax        # 61cff8 <_fini+0x2072ec>
  40272b:       48 85 c0                test   %rax,%rax

otool -tV /bin/mv | head
/bin/mv:
(__TEXT,__text) section
0000000100000bcd        pushq   %rbp
0000000100000bce        movq    %rsp, %rbp
0000000100000bd1        pushq   %r15
0000000100000bd3        pushq   %r14
0000000100000bd5        pushq   %r13
0000000100000bd7        pushq   %r12
0000000100000bd9        pushq   %rbx
0000000100000bda        subq    $0x5c8, %rsp            ## imm = 0x5C8
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment