Moving forward (with all that in mind), what exactly is happening when we initialize
k++? What exactly is happening in the machine code (or assembly code) that results in this output? Finding the answer to this question inches us closer to the exciting realm of reverse engineering.
In order to fully investigate this, there is a program called
objdump we can use within the Linux shell that allows us to “see” inside the machine code. Before jumping into my explanation, let’s review this program:
objdump is a program for displaying various information about object files. As you will recall from our previous posts, object code is generated during the third stage of compilation, also called assembly. In order to help us parse through the information displayed using
objdump we will run it with several options:
-jDisplay information only for a specified section — today we will only be reviewing two sections:
.rodata— this is where read-only data is stored
.textthis is the program’s actual code (the assembly) — _start and main are both part of this section
-sDisplays the full contents of any sections requested. By default all non-empty sections are displayed.
-MAssembly has two versions of syntax — AT&T or Intel. We use -M intel to tell
objdumpto display output in intel format.
-dDisplay the assembler mnemonics for the machine instructions from objfile. This option only disassembles those sections which are expected to contain instructions.
-SDisplay source code intermixed with disassembly, if possible. This is helpful because it will show the lines from our program.
Now that we’ve reviewed
objdump — let’s combine that with our investigation into what happens when we specify that
The above tells us where the read-only data is stored.
Objdump program ran with flags introduced above
objdump with the above option flags produces our object code with our source code intermixed in the output. In fact, many lines of object code are produced and we are only referencing the section with our source code. To view all of the object code, click here.
There are definitely lots of cool things happening there. Before we proceed, let’s review machine instructions. According to this guide, “machine instructions generally fall into three categories: data movement, arithmetic/logic, and control-flow.” In the above screenshot, the data movement instructions occur in the second to last column.