objdump

Reverse Engineering

Beginnerlow risk

objdump displays information about object files. It can disassemble executables, show headers, symbols, and more.

Installation

sudo apt install binutils

Basic Syntax

objdump [options] <file>

Quick Facts

Full Name

objdump (GNU Binutils)

License

GPL

Language

C

Platforms

Linux, macOS, Unix

Category

Binary Analysis

Part Of

GNU Binutils

Tool Overview

objdump is a command-line utility from GNU Binutils that displays information about object files. It can disassemble executables, show headers, and list symbols.

The tool is part of the standard Linux toolchain and requires no installation. It provides quick static analysis of ELF, PE, and other binary formats.

objdump is ideal for initial binary triage and quick disassembly when a full RE framework is not needed. It pairs well with grep for filtering output.

Common Commands

objdump -d /path/to/fileDisassemble the executable (code) sections of an object file

objdump -D /path/to/fileDisassemble the contents of all sections, not just executable ones

objdump -d -M intel /path/to/fileDisassemble using Intel syntax instead of the default AT&T

objdump -S /path/to/fileIntermix source code with disassembly (needs debug info)

objdump -t /path/to/filePrint the symbol table entries of the file

objdump -T /path/to/filePrint the dynamic symbol table entries

objdump -r /path/to/fileDisplay the relocation entries of the file

objdump -R /path/to/fileDisplay the dynamic relocation entries

objdump -x /path/to/fileDisplay all headers, symbols, and section information

objdump -h /path/to/fileDisplay a summary of the section headers

objdump -f /path/to/fileDisplay the overall file header (format, architecture, entry point)

objdump -p /path/to/fileDisplay object-format-specific private headers (e.g. ELF program headers)

objdump -s /path/to/fileDisplay the full hex contents of all requested sections

objdump -s -j .rodata /path/to/fileDump the raw contents of a single named section

objdump -d -j .text /path/to/fileDisassemble only the .text section

Step-by-Step Guide

1Execute the tool with the disassemble flag to see the raw code
2Examine the file headers to understand its structure
3Print out the symbol table to locate internal references
4Combine the output with search utilities to find specific instructions
5Format the output to Intel syntax for easier reading

Warnings

Output files can become massive when dumping large applications
It is best used in combination with grep or less
This only provides static analysis, not live execution states

Use Cases

Quick Disassembly

View assembly code of a binary quickly.

Header Inspection

Examine ELF/PE headers and sections.

Symbol Discovery

List functions and variables in a binary.

Binary Triage

Quickly assess a binary's structure.

Key Features

Disassembly: Disassemble executable sections.
Headers: Display all file headers.
Symbols: Show symbol tables.
Sections: Dump section contents.
Multi-Format: Support for ELF, PE, and more.

Related Tools

strings

Binary Analysis

Extract printable strings from binaries.

Frequently Asked Questions

What is objdump used for?

objdump displays information about object files including disassembly, headers, symbols, and section contents.

Is objdump good for reverse engineering?

objdump is useful for quick static analysis and disassembly, but lacks the interactive features of Ghidra or Radare2.

How do I disassemble with objdump?

Use objdump -d binary to disassemble, or objdump -M intel -d for Intel syntax.

What is objdump -t used for?

objdump -t shows the symbol table, listing all functions, variables, and their addresses.

Output Explanation

Produces a static text dump containing the file's architectural headers, memory symbols, and translated assembly instructions.

Ethical Usage Notice

This tool is designed for authorized security testing, educational purposes, and legitimate network administration only. Unauthorized access to computer systems is illegal.