Disassemble raw x64 machine code

Question

What is the right architecture to get objdump to disassemble raw x64 code? You would think -m x86-64 should work from reading the help, but it doesn't. I tried with both the cygwin64 version:

$ objdump --version
GNU objdump (GNU Binutils) 2.23.52.20130604

as well as the version in my Fedora 18 x64 install (2.23.51.0.1-3.fc18 20120806) but I only get can't use supplied machine x86-64. Also tried with amd64 and x64 but that didn't work either.

The command is basically objdump -b binary -D -m ??? file

score 25 · Accepted Answer · edited Jun 22 '20 at 22:07

25

And as usual writing down the question already gives you some rather good ideas what else to try..

Anyhow the right machine architecture is: i386:x86-64.

The full command is:

objdump -b binary -D -m i386:x86-64 <file>

If you want to disassemble code that expects to be loaded at a specific address, you can add the --adjust-vma <load-address> flag.

edited Jun 22 '20 at 22:07

thejh

44,854
16
96
107

answered Sep 28 '13 at 20:48

Voo

29,040
11
82
156

score -1 · Answer 2 · answered May 22 '22 at 00:11

-1

Many years has past and now it works as such:

$ objdump -b elf64-x86-64  -M "intel" -d 27.exe

The field "-b" can be determined with the help of objdump:

$ objdump -f 27.exe

27.exe:     file format elf64-x86-64

answered May 22 '22 at 00:11

Alex

837
8
9

score -2 · Answer 3 · answered May 29 '18 at 15:57

-2

using objdump from gcc as shown below.

objdump -z -M intel -d test.o

answered May 29 '18 at 15:57

Haseeb Mir

928
1
13
22

Disassemble raw x64 machine code

3 Answers3