I want to output only the code in labels after start (start, loop1, and loop2).
$ objdump -d quasilog.o
00000000 <main>:
0: b9 64 00 00 00 mov $0x64,%ecx
00000005 <start>:
5: 31 ff xor %edi,%edi
00000007 <loop1>:
7: 89 cb mov %ecx,%ebx
00000009 <loop2>:
9: 4b dec %ebx
a: 31 d2 xor %edx,%edx
c: 89 c8 mov %ecx,%eax
e: f7 f3 div %ebx
10: 85 d2 test %edx,%edx
12: 75 f5 jne 9 <loop2>
14: 47 inc %edi
15: 29 d9 sub %ebx,%ecx
17: 83 f9 01 cmp $0x1,%ecx
1a: 77 eb ja 7 <loop1>
1c: c3 ret
So I see the code in my labels is 24 bytes long (0x1c - 0x5 + 1).
$ hd quasilog.o
00000000 7f 45 4c 46 01 01 01 00 00 00 00 00 00 00 00 00 |.ELF............|
00000010 01 00 03 00 01 00 00 00 00 00 00 00 00 00 00 00 |................|
00000020 18 01 00 00 00 00 00 00 34 00 00 00 00 00 28 00 |........4.....(.|
00000030 07 00 04 00 b9 64 00 00 00 31 ff 89 cb 4b 31 d2 |.....d...1...K1.|
00000040 89 c8 f7 f3 85 d2 75 f5 47 29 d9 83 f9 01 77 eb |......u.G)....w.|
00000050 c3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
00000060 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
00000070 03 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
00000080 03 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
00000090 03 00 03 00 01 00 00 00 05 00 00 00 00 00 00 00 |................|
000000a0 00 00 01 00 07 00 00 00 07 00 00 00 00 00 00 00 |................|
000000b0 00 00 01 00 0d 00 00 00 09 00 00 00 00 00 00 00 |................|
000000c0 00 00 01 00 13 00 00 00 00 00 00 00 00 00 00 00 |................|
000000d0 10 00 01 00 00 73 74 61 72 74 00 6c 6f 6f 70 31 |.....start.loop1|
000000e0 00 6c 6f 6f 70 32 00 6d 61 69 6e 00 00 2e 73 79 |.loop2.main...sy|
000000f0 6d 74 61 62 00 2e 73 74 72 74 61 62 00 2e 73 68 |mtab..strtab..sh|
00000100 73 74 72 74 61 62 00 2e 74 65 78 74 00 2e 64 61 |strtab..text..da|
00000110 74 61 00 2e 62 73 73 00 00 00 00 00 00 00 00 00 |ta..bss.........|
00000120 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
*
etc.
I notice my code starts with 31 FF and I find that at byte 0x39. So this gives me the output I want:
$ hd -s 0x39 -n 24 quasilog.o
00000039 31 ff 89 cb 4b 31 d2 89 c8 f7 f3 85 d2 75 f5 47 |1...K1.......u.G|
00000049 29 d9 83 f9 01 77 eb c3 |)....w..|
Is there any way to automate this process? To be clear, I want the output of hd, that is provide me with -s and -n values. I'm open to using xxd as well.
Usually my main starts at 0x34, but I don't know why.
Here is my attempt:
objdump -d quasilog.o | grep start | grep -P -o "[0-9a-f]+" | head -1 gets the address of start.
objdump -d quasilog.o | tail -1 | grep -P -o "[0-9a-f]+" | head -1 gets the last address.
