如何通过gdb查看反汇编代码

如何通过gdb查看反汇编代码

转载：https://blog.csdn.net/counsellor/article/details/80686758

如何通过gdb查看反汇编代码

0x00 程序源码

C代码如下：

#include <stdio.h>
int addme(int a, int b)
{
    int c ;
    c = a+ b;
    return c;
}
int main(int argc, char const *argv[])
{
    int ret= 0;
    ret = addme(10,20);
    printf("%d\n", ret);
    return 0;
}

x01 编译生成可执行文件

$ gcc -g3 -o add.out add.c

0x02 gdb加载

$ gdb add.out

• 运行结果如下：

GNU gdb (Ubuntu 7.11.1-0ubuntu1~16.5) 7.11.1
Copyright (C) 2016 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.  Type "show copying"
and "show warranty" for details.
This GDB was configured as "x86_64-linux-gnu".
Type "show configuration" for configuration details.
For bug reporting instructions, please see:
<http://www.gnu.org/software/gdb/bugs/>.
Find the GDB manual and other documentation resources online at:
<http://www.gnu.org/software/gdb/documentation/>.
For help, type "help".
Type "apropos word" to search for commands related to "word"...
Reading symbols from add.out...done.
(gdb) disassemble 
No frame selected.
(gdb) b main
Breakpoint 1 at 0x40054f: file add.c, line 11.
(gdb) r
Starting program: /home/test/tmp/test_assembly/add.out 

Breakpoint 1, main (argc=1, argv=0x7fffffffdc48) at add.c:11
11      int ret= 0;

• 先运行了disassemble命令，提示没有栈帧。看来反汇编只能在运行过程中使用。于是在main函数中下了断点。

0x03 反汇编main函数

(gdb) disassemble main
Dump of assembler code for function main:
   0x0000000000400540 <+0>: push   %rbp
   0x0000000000400541 <+1>: mov%rsp,%rbp
   0x0000000000400544 <+4>: sub$0x20,%rsp
   0x0000000000400548 <+8>: mov%edi,-0x14(%rbp)
   0x000000000040054b <+11>:    mov%rsi,-0x20(%rbp)
=> 0x000000000040054f <+15>:    movl   $0x0,-0x4(%rbp)
   0x0000000000400556 <+22>:    mov$0x14,%esi
   0x000000000040055b <+27>:    mov$0xa,%edi
   0x0000000000400560 <+32>:    callq  0x400526 <addme>
   0x0000000000400565 <+37>:    mov%eax,-0x4(%rbp)
   0x0000000000400568 <+40>:    mov-0x4(%rbp),%eax
   0x000000000040056b <+43>:    mov%eax,%esi
   0x000000000040056d <+45>:    mov$0x400614,%edi
   0x0000000000400572 <+50>:    mov$0x0,%eax
   0x0000000000400577 <+55>:    callq  0x400400 <printf@plt>
   0x000000000040057c <+60>:    mov$0x0,%eax
   0x0000000000400581 <+65>:    leaveq 
   0x0000000000400582 <+66>:    retq   
End of assembler dump.

“=>“箭头指的位置为断点断下来的位置，可以看出来等价于”int ret= 0;“.

0x04 带源码的反汇编addme函数

(gdb) disassemble /m addme
Dump of assembler code for function addme:
4   {
   0x0000000000400526 <+0>: push   %rbp
   0x0000000000400527 <+1>: mov%rsp,%rbp
   0x000000000040052a <+4>: mov%edi,-0x14(%rbp)
   0x000000000040052d <+7>: mov%esi,-0x18(%rbp)

5       int c ;
6       c = a+ b;
   0x0000000000400530 <+10>:    mov-0x14(%rbp),%edx
   0x0000000000400533 <+13>:    mov-0x18(%rbp),%eax
   0x0000000000400536 <+16>:    add%edx,%eax
   0x0000000000400538 <+18>:    mov%eax,-0x4(%rbp)

7       return c;
   0x000000000040053b <+21>:    mov-0x4(%rbp),%eax

8   }
   0x000000000040053e <+24>:    pop%rbp
   0x000000000040053f <+25>:    retq   

End of assembler dump.

0x05 切换成intel指令格式

GDB默认汇编格式是AT&T格式，windows用户会感觉很蛋疼，GDB很给力的支持切换成intel指令集。

切换intel格式的命令:

set disassembly-flavor intel

切换成att格式的命令:

set disassembly-flavor att

具体操作如下：

(gdb) set disassembly-flavor intel
(gdb) disassemble /m addme
Dump of assembler code for function addme:
4   {
   0x0000000000400526 <+0>: push   rbp
   0x0000000000400527 <+1>: movrbp,rsp
   0x000000000040052a <+4>: movDWORD PTR [rbp-0x14],edi
   0x000000000040052d <+7>: movDWORD PTR [rbp-0x18],esi

5       int c ;
6       c = a+ b;
   0x0000000000400530 <+10>:    movedx,DWORD PTR [rbp-0x14]
   0x0000000000400533 <+13>:    moveax,DWORD PTR [rbp-0x18]
   0x0000000000400536 <+16>:    addeax,edx
   0x0000000000400538 <+18>:    movDWORD PTR [rbp-0x4],eax

7       return c;
   0x000000000040053b <+21>:    moveax,DWORD PTR [rbp-0x4]

8   }
   0x000000000040053e <+24>:    poprbp
   0x000000000040053f <+25>:    ret

End of assembler dump.

x06 参考文献

gdb手册