Get function hex-codes from GCC

Question

Now I encounter problem. My project works on assembly-level. So I need assembly-level programming but the project scale is too large to do work on assembly-level only. Because of this issue, I determine get hexcodes from c-source-file made by gcc. but how? How can I get certain function's HEXCODES by using gcc?

I have a idea,

int function_name(){
    int a=1;
    return a;
}
write(fd, (char *)function_name, sizeof(function_name))

I would get hexcodes of function_name after this doing. but It's not good way to solve this problem, It would make me need to handle many file when I need many function as target.

Is there other good way to solve this problem? I think ideal solution that need only function name(and output file name if needed) and works on command-line. Is ideal solution which I think impossible?

Also I assume that compiler's optimization options is off so I would get hexcodes from function_name is '\x55\x8B\xEC\x83\xEC\x04\xC7\x45\xFC\x01\x00\x00\x00\x8B\x45\xFC\x8B\xE5\x5D\xC3' function_name's assembly code is below.

PUSH EBP
MOV EBP, ESP
SUB ESP, 4
MOV DWORD PTR[EBP-4], 1
MOV EAX, DWORD PTR[EBP-4]
MOV ESP, EBP
POP EBP
RETN

`gcc -S -o mycode.S mycode.c`. Add `-masm=intel` if you want readable output. — Kerrek SB, Mar 30 '15 at 07:29
@KerrekSB Oh... I'm sorry... I have mistake on my questions. I mean assembly code as binary codes(opcodes)... Really sorry, Thanks to your answer — pyutic, Mar 30 '15 at 07:46
Why do you need to copy the binary output? If you want to select different functions depending on some conditions then function pointer is the way to go — phuclv, Mar 30 '15 at 08:04
@LưuVĩnhPhúc My project is on assembly-programming-level. But only-assembly-level programming is too hard to handle BIG scale code. So I want to use trick, get assembly-code from gcc. — pyutic, Mar 30 '15 at 08:10
What you are asking is unclear. Please improve your question. Explain what you want to do and on which kind of files. Be specific, and give an example. — Basile Starynkevitch, Mar 30 '15 at 08:22
@BasileStarynkevitch I edited my question a moment ago. sorry, and thank you — pyutic, Mar 30 '15 at 08:31
Define what is a function for you. I'm pretty sure you don't really know. (think about `static` functions, and about `inline`-d functions, assuming that the compiler is optimizing, e.g. `gcc -O2`) — Basile Starynkevitch, Mar 30 '15 at 08:35
I will vote for closing that question, or downvote it, since you don't explain enough what you are actually trying to do. Please **improve your question** *by editing it* (*not* by commenting it)! — Basile Starynkevitch, Mar 30 '15 at 08:52
Your example is precisely a function which would be inlined by most optimizing compilers. In such case, your question does not have any sense. — Basile Starynkevitch, Mar 30 '15 at 08:56
I voted to close your question. What you are asking is unclear, and shows that you did not enough research. — Basile Starynkevitch, Mar 30 '15 at 09:03
@BasileStarynkevitch Thanks for your answer and really sorry about unclear question. — pyutic, Mar 30 '15 at 09:16

score 2 · Accepted Answer · answered Mar 30 '15 at 07:33

2

gcc produces an assembly file from every source file as part of the compilation toolchain. That file is usually temporary, and as such is immediately deleted. If you want it to be saved as myfile.s, you can use this command:

gcc -S -o myfile.s myfile.c

answered Mar 30 '15 at 07:33

lodo

2,314
19
31

Oh... I'm sorry... I have mistake on my questions. I mean assembly code as binary codes(opcodes)... Really sorry, Thanks to your answer – pyutic Mar 30 '15 at 07:45
@pyutic Your compiler already produces machine code. It's unclear what you mean by "get function assembly code". You can find the file offset start and end location with objdump or readelf of a function, and a view the executable/object file in a hex editor if you want - but perhaps that's not what you actually want – nos Mar 30 '15 at 09:13
1

Actually, better try `gcc -O -fverbose-asm -S myfile.c` – Basile Starynkevitch Mar 30 '15 at 09:21

Marco van de Voort · Answer 2 · 2015-03-30T09:21:28.440

Try

objdump -D -Mintel yourfile.o

the dump will look like (.O generated by free pascal compiler, but gcc will be mostly the same)

   0:   55                      push   ebp
   1:   89 e5                   mov    ebp,esp
   3:   8d 64 24 ec             lea    esp,[esp-0x14]
   7:   53                      push   ebx
   8:   89 45 fc                mov    DWORD PTR [ebp-0x4],eax
   b:   c7 45 f4 00 00 00 00    mov    DWORD PTR [ebp-0xc],0x0
  12:   31 c0                   xor    eax,eax
  14:   68 00 00 00 00          push   0x0
  19:   55                      push   ebp
  1a:   68 00 00 00 00          push   0x0
  1f:   64 ff 30                push   DWORD PTR fs:[eax]
  22:   64 89 20                mov    DWORD PTR fs:[eax],esp
  25:   c7 45 f8 00 00 00 00    mov    DWORD PTR [ebp-0x8],0x0
  2c:   8b 45 fc                mov    eax,DWORD PTR [ebp-0x4]
  2f:   8b 50 04                mov    edx,DWORD PTR [eax+0x4]

The code is still relocatable, so references will be zero bytes.

To resolve that you need to objdump the binary (.exe) instead of the .o, but such output is usually huge, and will make finding a specific location harder.

score 0 · Answer 3 · edited May 23 '17 at 12:06

I guess you are on Linux, since you are using gcc

You might run

 gcc -Wall -O -c myfile.c

to get an object file myfile.o from your source C file myfile.c ; that object file is in ELF so contains notably binary code and relocation orders. You could parse that ELF object file (e.g. with commands like objdump(1) or readelf or thru some library like libelf or libbfd)

Alternatively work only on ELF shared objects with position independent code and use dlopen(3). See program library howto

Notice that not every source-level C function correspond to some function (e.g. ELF symbol) inside of object files (e.g. because of static functions - their name can be forgotten or stripped, or because of inline functions - they don't have their own machine code, it has been inlined in the caller). Assume an optimizing compiler (e.g. gcc -O2).

Remember that decompilation is an impossible task in general. Be aware of the halting problem which is undecidable.

Look also at this question and the answers about libopcode

BTW,

write(fd, (char *)function_name, sizeof(function_name))

won't compile (you cannot take the sizeof some function). Maybe you would do

write(fd, (char*)function_name, sizeof(char*))

which will write some address, which might not mean much (be aware of ASLR).

Maybe you want dladdr(3)? You probably would need to compile your program with the -rdynamic option passed at linking time.

OP does not list a *nix or ELF as platform? – Marco van de Voort Mar 30 '15 at 09:22 — Marco van de Voort, Mar 30 '15 at 09:22

Get function hex-codes from GCC

3 Answers3