Step@88

如果你经常做一些逆向工程，那么这两命令对你来说应该很熟悉，的确，有了这两个命令，使你可以更清楚的看到程序代码到底怎么执行的，以及编译后的文件到底是什么布局的，总之，可以很大的方便你寻根究底。

nm:

输出object文件的符号信息，并且显示属于什么section的，

objdump -s primer 输出如下

08049888 A __bss_start
08048464 t call_gmon_start
08049888 b completed.4463
08049768 d __CTOR_END__
08049764 d __CTOR_LIST__
0804987c D __data_start
0804987c W data_start
080486f0 t __do_global_ctors_aux
08048490 t __do_global_dtors_aux
08049880 D __dso_handle
08049770 d __DTOR_END__
0804976c d __DTOR_LIST__
08049778 d _DYNAMIC
08049888 A _edata
0804988c A _end
U exit@@GLIBC_2.0
08048724 T _fini
08049764 a __fini_array_end
08049764 a __fini_array_start
08048740 R _fp_hw
080484c0 t frame_dummy
08048760 r __FRAME_END__
U free@@GLIBC_2.0
0804984c d _GLOBAL_OFFSET_TABLE_
w __gmon_start__
080486e3 T __i686.get_pc_thunk.bx
08048380 T _init
08049764 a __init_array_end
08049764 a __init_array_start
08048744 R _IO_stdin_used
08049774 d __JCR_END__
08049774 d __JCR_LIST__
w _Jv_RegisterClasses
08048640 T __libc_csu_fini
08048690 T __libc_csu_init
U __libc_start_main@@GLIBC_2.0
080484e4 T main
U malloc@@GLIBC_2.0
U memset@@GLIBC_2.0
08049884 d p.4462
U printf@@GLIBC_2.0
U sqrt@@GLIBC_2.0
08048440 T _start

在地址和符号字符串之间的符号表示符号字符串的类型,大写表示全局，小写表示局部

B 表示未初始化数据字段 bss D表示初始化数据字段 R 只读数据段 T 表示text段，U 表示为定义的。

objdump

objdump -t primer 和 nm －s primer 类似，显示符号表

objdump -h primer 显示各个section 信息

objump -d/-D primer 详细 显示反汇编的信息， 也可以加 －S

objdump -j sectionname, 显示某section的内容

可以指定 --start-address= xxx --stop-address=xxx

objdump -x 相当于 objdump -t -h -a -r 显示详细信息

readelf:

针对elf格式的object文件的显示程序，信息非常详细，包括概括信息

ELF Header:
Magic: 7f 45 4c 46 01 01 01 00 00 00 00 00 00 00 00 00
Class: ELF32
Data: 2's complement, little endian
Version: 1 (current)
OS/ABI: UNIX - System V
ABI Version: 0
Type: EXEC (Executable file)
Machine: Intel 80386
Version: 0x1
Entry point address: 0x8048440
Start of program headers: 52 (bytes into file)
Start of section headers: 5092 (bytes into file)
Flags: 0x0
Size of this header: 52 (bytes)
Size of program headers: 32 (bytes)
Number of program headers: 7
Size of section headers: 40 (bytes)
Number of section headers: 35
Section header string table index: 32

Section Headers:
[Nr] Name Type Addr Off Size ES Flg Lk Inf Al
[ 0] NULL 00000000 000000 000000 00 0 0 0
[ 1] .interp PROGBITS 08048114 000114 000013 00 A 0 0 1
[ 2] .note.ABI-tag NOTE 08048128 000128 000020 00 A 0 0 4
[ 3] .hash HASH 08048148 000148 000044 04 A 4 0 4
[ 4] .dynsym DYNSYM 0804818c 00018c 0000c0 10 A 5 1 4
[ 5] .dynstr STRTAB 0804824c 00024c 00008c 00 A 0 0 1
[ 6] .gnu.version VERSYM 080482d8 0002d8 000018 02 A 4 0 2
[ 7] .gnu.version_r VERNEED 080482f0 0002f0 000040 00 A 5 2 4
[ 8] .rel.dyn REL 08048330 000330 000008 08 A 4 0 4
[ 9] .rel.plt REL 08048338 000338 000048 08 A 4 11 4
[10] .init PROGBITS 08048380 000380 000017 00 AX 0 0 4
[11] .plt PROGBITS 08048398 000398 0000a0 04 AX 0 0 4
[12] .text PROGBITS 08048440 000440 0002e4 00 AX 0 0 16
[13] .fini PROGBITS 08048724 000724 00001c 00 AX 0 0 4
[14] .rodata PROGBITS 08048740 000740 00001d 00 A 0 0 4
[15] .eh_frame PROGBITS 08048760 000760 000004 00 A 0 0 4
[16] .ctors PROGBITS 08049764 000764 000008 00 WA 0 0 4
[17] .dtors PROGBITS 0804976c 00076c 000008 00 WA 0 0 4
[18] .jcr PROGBITS 08049774 000774 000004 00 WA 0 0 4
[19] .dynamic DYNAMIC 08049778 000778 0000d0 08 WA 5 0 4
[20] .got PROGBITS 08049848 000848 000004 04 WA 0 0 4
[21] .got.plt PROGBITS 0804984c 00084c 000030 04 WA 0 0 4
[22] .data PROGBITS 0804987c 00087c 00000c 00 WA 0 0 4
[23] .bss NOBITS 08049888 000888 000004 00 WA 0 0 4
[24] .comment PROGBITS 00000000 000888 000193 00 0 0 1
[25] .debug_aranges PROGBITS 00000000 000a20 000098 00 0 0 8
[26] .debug_pubnames PROGBITS 00000000 000ab8 000040 00 0 0 1
[27] .debug_info PROGBITS 00000000 000af8 0003d5 00 0 0 1
[28] .debug_abbrev PROGBITS 00000000 000ecd 0000e0 00 0 0 1
[29] .debug_line PROGBITS 00000000 000fad 0001f5 00 0 0 1
[30] .debug_frame PROGBITS 00000000 0011a4 00002c 00 0 0 4
[31] .debug_str PROGBITS 00000000 0011d0 0000e0 00 0 0 1
[32] .shstrtab STRTAB 00000000 0012b0 000134 00 0 0 1
[33] .symtab SYMTAB 00000000 00195c 000590 10 34 64 4
[34] .strtab STRTAB 00000000 001eec 000343 00 0 0 1
Key to Flags:
W (write), A (alloc), X (execute), M (merge), S (strings)
I (info), L (link order), G (group), x (unknown)
O (extra OS processing required) o (OS specific), p (processor specific)