3

For example if I'm in perf report I can press enter to follow a branch. If a bin was using -g some source shows up too.

I don't really need the source but it'd be very convenient if I could follow the jumps. What can I do to make reading assembly easier? Since I'm on linux I ended up running perf and using report to read this

  • `objdump -d --visualize-jumps=color` is interesting, although unusable on a large binary as it has so many columns of lines. Agner Fog's `objconv` disassembler will create branch targets, making it easier to find the tops of loops, example in [How to disassemble a binary executable in Linux to get the assembly code?](https://stackoverflow.com/a/33978857) . Other answers show examples of `objdump -d -S` to mix source and asm. – Peter Cordes Dec 14 '22 at 04:35
  • @PeterCordes thats pretty good. If this is an answer I'd accept it –  Dec 14 '22 at 05:22
  • IDA, Binary Ninja, Radare2, Hopper (for macOS), Ghidra. All are far better alternatives than `objdump` for reading a disassembly. You can double-click on a jump to reach its target and all show the graph of basic blocks. – Margaret Bloom Dec 14 '22 at 07:16
  • Which is your favorite? Which works on linux? I do have a mac (ARM) so I can try hopper –  Dec 14 '22 at 19:13

1 Answers1

2

objdump -d --visualize-jumps=color is interesting, although unusable on a large binary as it has so many columns of lines. In a random smaller binary I had lying around (from testing alignment of 64-bit _Atomic vars in 32-bit mode, in case anyone's curious; this binary was from clang):

objdump -drwC -Mintel --visualize-jumps=color

...
 726:                e8 a5 fd ff ff             call   4d0 <pthread_create@plt>
 72b:                83 c4 10                   add    esp,0x10
 72e:                85 c0                      test   eax,eax
 730:      /-------- 75 62                      jne    794 <main+0xb4>
 732:   /--|-------> c5 f8 57 c0                vxorps xmm0,xmm0,xmm0
 736:   |  |         c5 fb 10 8e 48 e8 ff ff    vmovsd xmm1,QWORD PTR [esi-0x17b8]
 73e:   |  |         66 90                      xchg   ax,ax
 740:   |  |  /----> 31 c0                      xor    eax,eax
 742:   |  |  |      31 d2                      xor    edx,edx
 744:   |  |  |      31 c9                      xor    ecx,ecx
 746:   |  |  |      31 db                      xor    ebx,ebx
 748:   |  |  |      f0 0f c7 8e c0 00 00 00    lock cmpxchg8b QWORD PTR [esi+0xc0]
 750:   |  |  |      c5 f9 6e d0                vmovd  xmm2,eax
 754:   |  |  |      c4 e3 69 22 d2 01          vpinsrd xmm2,xmm2,edx,0x1
 75a:   |  |  |      c5 f9 2e d0                vucomisd xmm2,xmm0
 75e:   |  |  |  /-- 75 02                      jne    762 <main+0x82>
 760:   |  |  +--|-- 7b de                      jnp    740 <main+0x60>
 762:   |  |  |  \-> c5 f9 2e d1                vucomisd xmm2,xmm1
 766:   |  |  |  /-- 75 02                      jne    76a <main+0x8a>
 768:   |  |  \--|-- 7b d6                      jnp    740 <main+0x60>
 76a:   |  |     \-> 83 ec 04                   sub    esp,0x4

...

Agner Fog's objconv disassembler makes output that's ready to assemble, including labels on branch targets, making it easier to find the tops of loops. Example output in How to disassemble a binary executable in Linux to get the assembly code? Other answers show examples of objdump -d -S to mix source and asm.

Also related: How to remove "noise" from GCC/clang assembly output? I usually look at gcc -O3 ... -S output instead of assembling into a binary. Unless I already have a specific binary. The Godbolt compiler explorer has good tools for finding asm associated with a source line, like a loop body, which works most of the time depending on the debug info generated by compilers.

Sep Roland
  • 33,889
  • 7
  • 43
  • 76
Peter Cordes
  • 328,167
  • 45
  • 605
  • 847
  • Great idea with `-S`. I used that before but I don't think I ever used it with the intention of reading the assembly (without modifying it). I tried objconv and will try the rest of your suggestions –  Dec 14 '22 at 19:16
  • 1
    And BTW, `--visualize-jumps=color` actually is colorized on a terminal to help you track which line is which, but SO code blocks don't support that even if I did copy/paste the ANSI escape sequences. – Peter Cordes Dec 15 '22 at 00:26
  • Is this functionality available for arm binaries as well? I've tried this flag with `aarch64-linux-gnu-objdump`, but it doesn't seem to output any arrows. – Nikos Mavrogeorgis Jul 05 '23 at 16:00
  • 1
    @NikosMavrogeorgis: Apparently not for AArch64. It did work for me with arm-none-eabi-objdump from GNU Binutils 2.40, but not the same version of `aarch64-linux-gnu-objdump`. (On a compiler-generated `.o` with a function that had `b` and `b.hi` instructions.) – Peter Cordes Jul 05 '23 at 16:58
  • Thank you for checking. I would expect that it's straightforward to replicate the functionality for AArch64 as well, but perhaps nobody took up the task yet. – Nikos Mavrogeorgis Jul 06 '23 at 12:26
  • 1
    @NikosMavrogeorgis: Yes, exactly what I was thinking. objdump does already need to know which instructions are branches so it can print the absolute target address like `b.hi 24 `, but probably the visualization was a recent addition and needs separate per-target code for some reason, which nobody's written yet. – Peter Cordes Jul 06 '23 at 12:31