Login/Register
Where is my function in hex file?
Asked Answered
cbinaryhexhexdump
M

2

1

I am trying to understand more about binary files. So I wrote a pointer *data to print out the function in the binary. The problem is that I cannot find the hex value that I printed out to stdio in the hexdump file.

#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <errno.h>

/* Our old friend die from ex17. */
void die(const char *message){
    if(errno){
        perror(message);
    }
    else{
        printf("ERROR: %s\n", message);
    }
    exit(1);
}

// a typedef creates a fake type, in this 
// case for a function pointer
typedef int (*compare_cb)(int a, int b);

/* A classic buble sort function that uses 
     the compare_cb to do the sorting */
int *bubble_sort(int *numbers, int count, compare_cb cmp){
    int temp = 0;
    int i = 0;
    int j = 0;
    int *target = malloc(count * sizeof(int));
    if(!target) die("Memory error.");

    memcpy(target, numbers, count * sizeof(int));
    for(i = 0; i < count; i++) {
        for(j = 0; j < count - 1; j++) {
            if(cmp(target[j], target[j+1])>0) {
                temp = target[j+1];
                target[j+1] = target[j];
                target[j] = temp;
            }
        }
    }
    return target;
}

int sorted_order(int a, int b){
    return a - b;
}

int reverse_order(int a, int b){
    return b - a;
}

int strange_order(int a, int b){
    if(a == 0 || b == 0){
        return 0;
    }
    else{
        return a % b;
    }
}

/* Used to test that we are sorting things correctly by doing the sort and printing it out. */
void test_sorting(int *numbers, int count, compare_cb cmp){
    int i = 0; 
    int *sorted = bubble_sort(numbers, count, cmp);
    if(!sorted) die("Failed to sort as requested.");

    for(i = 0; i < count; i++) {
        printf("%d ", sorted[i]);
    }
    printf("\n");
    free(sorted);

    // printing function pointers purposefully
    unsigned char *data = (unsigned char *)cmp;
    for(i = 0; i < 25; i++) {
        printf("%02x:", data[i]);
    }
    printf("\n");
}

int main(int argc, char *argv[]){
    if(argc < 2) die("USAGE: ex18 4 3 1 5 6");
    int count = argc - 1;
    int i = 0;
    char **inputs = argv + 1;

    int *numbers = malloc(count * sizeof(int));
    if(!numbers) die("Memory error.");

    for(i = 0; i < count; i++) {
        numbers[i] = atoi(inputs[i]);
    }

    test_sorting(numbers, count, sorted_order);
    test_sorting(numbers, count, reverse_order);
    test_sorting(numbers, count, strange_order);

    free(numbers);
    return 0;
}

When I run with:

$./ex18 1 2 3

I get:

1 2 3 
55:48:89:e5:89:7d:fc:89:75:f8:8b:45:f8:8b:55:fc:29:c2:89:d0:5d:c3:55:48:89:
3 2 1 
55:48:89:e5:89:7d:fc:89:75:f8:8b:45:fc:8b:55:f8:29:c2:89:d0:5d:c3:55:48:89:
2 3 1 
55:48:89:e5:89:7d:fc:89:75:f8:83:7d:fc:00:74:06:83:7d:f8:00:75:07:b8:00:00:

Then I run:

$hexdump ex18 > ex18_hexdump

The content in ex18_hexdump is (this is updated with the correct file based on the comments, truncated because of the limit of the post):

0000000 457f 464c 0102 0001 0000 0000 0000 0000
0000010 0002 003e 0001 0000 06b0 0040 0000 0000
0000020 0040 0000 0000 0000 2880 0000 0000 0000
0000030 0000 0000 0040 0038 0009 0040 0023 0020
0000040 0006 0000 0005 0000 0040 0000 0000 0000
0000050 0040 0040 0000 0000 0040 0040 0000 0000
0000060 01f8 0000 0000 0000 01f8 0000 0000 0000
0000070 0008 0000 0000 0000 0003 0000 0004 0000
0000080 0238 0000 0000 0000 0238 0040 0000 0000
0000090 0238 0040 0000 0000 001c 0000 0000 0000
00000a0 001c 0000 0000 0000 0001 0000 0000 0000
00000b0 0001 0000 0005 0000 0000 0000 0000 0000
00000c0 0000 0040 0000 0000 0000 0040 0000 0000
00000d0 0e7c 0000 0000 0000 0e7c 0000 0000 0000
00000e0 0000 0020 0000 0000 0001 0000 0006 0000
00000f0 1e10 0000 0000 0000 1e10 0060 0000 0000
0000100 1e10 0060 0000 0000 0270 0000 0000 0000
0000110 0278 0000 0000 0000 0000 0020 0000 0000
0000120 0002 0000 0006 0000 1e28 0000 0000 0000
0000130 1e28 0060 0000 0000 1e28 0060 0000 0000
0000140 01d0 0000 0000 0000 01d0 0000 0000 0000
0000150 0008 0000 0000 0000 0004 0000 0004 0000
0000160 0254 0000 0000 0000 0254 0040 0000 0000
0000170 0254 0040 0000 0000 0044 0000 0000 0000
0000180 0044 0000 0000 0000 0004 0000 0000 0000
0000190 e550 6474 0004 0000 0c5c 0000 0000 0000
00001a0 0c5c 0040 0000 0000 0c5c 0040 0000 0000
00001b0 0064 0000 0000 0000 0064 0000 0000 0000
00001c0 0004 0000 0000 0000 e551 6474 0006 0000
00001d0 0000 0000 0000 0000 0000 0000 0000 0000
*
00001f0 0000 0000 0000 0000 0010 0000 0000 0000
0000200 e552 6474 0004 0000 1e10 0000 0000 0000
0000210 1e10 0060 0000 0000 1e10 0060 0000 0000
0000220 01f0 0000 0000 0000 01f0 0000 0000 0000
0000230 0001 0000 0000 0000 6c2f 6269 3436 6c2f
0000240 2d64 696c 756e 2d78 3878 2d36 3436 732e
0000250 2e6f 0032 0004 0000 0010 0000 0001 0000
0000260 4e47 0055 0000 0000 0002 0000 0006 0000
0000270 0018 0000 0004 0000 0014 0000 0003 0000
0000280 4e47 0055 fa9e 22b4 8dc1 8436 2383 76de
0000290 941a 0296 8cb1 14fa 0001 0000 0001 0000
00002a0 0001 0000 0000 0000 0000 0000 0000 0000
00002b0 0000 0000 0000 0000 0000 0000 0000 0000
*
00002d0 005c 0000 0012 0000 0000 0000 0000 0000
00002e0 0000 0000 0000 0000 0017 0000 0012 0000
00002f0 0000 0000 0000 0000 0000 0000 0000 0000
0000300 0026 0000 0012 0000 0000 0000 0000 0000
0000310 0000 0000 0000 0000 001f 0000 0012 0000
0000320 0000 0000 0000 0000 0000 0000 0000 0000
0000330 004a 0000 0012 0000 0000 0000 0000 0000
0000340 0000 0000 0000 0000 0061 0000 0020 0000
0000350 0000 0000 0000 0000 0000 0000 0000 0000
0000360 0037 0000 0012 0000 0000 0000 0000 0000
0000370 0000 0000 0000 0000 003e 0000 0012 0000
0000380 0000 0000 0000 0000 0000 0000 0000 0000
0000390 0010 0000 0012 0000 0000 0000 0000 0000
00003a0 0000 0000 0000 0000 0045 0000 0012 0000
00003b0 0000 0000 0000 0000 0000 0000 0000 0000
00003c0 000b 0000 0012 0000 0000 0000 0000 0000
00003d0 0000 0000 0000 0000 6c00 6269 2e63 6f73
00003e0 362e 6500 6978 0074 6570 7272 726f 7000
00003f0 7475 6863 7261 7000 6972 746e 0066 5f5f
0000400 7265 6e72 5f6f 6f6c 6163 6974 6e6f 6d00
0000410 6d65 7063 0079 616d 6c6c 636f 6100 6f74
0000420 0069 5f5f 696c 6362 735f 6174 7472 6d5f
0000430 6961 006e 7266 6565 5f00 675f 6f6d 5f6e
0000440 7473 7261 5f74 005f 4c47 4249 5f43 2e32
0000450 3431 4700 494c 4342 325f 322e 352e 0000
0000460 0000 0002 0002 0002 0002 0002 0000 0003
0000470 0002 0002 0002 0002 0001 0002 0001 0000
0000480 0010 0000 0000 0000 9194 0696 0000 0003
0000490 0070 0000 0010 0000 1a75 0969 0000 0002
00004a0 007b 0000 0000 0000 1ff8 0060 0000 0000
00004b0 0006 0000 0006 0000 0000 0000 0000 0000
00004c0 2018 0060 0000 0000 0007 0000 0001 0000
00004d0 0000 0000 0000 0000 2020 0060 0000 0000
00004e0 0007 0000 0002 0000 0000 0000 0000 0000
00004f0 2028 0060 0000 0000 0007 0000 0003 0000
0000500 0000 0000 0000 0000 2030 0060 0000 0000
0000510 0007 0000 0004 0000 0000 0000 0000 0000
0000520 2038 0060 0000 0000 0007 0000 0005 0000
0000530 0000 0000 0000 0000 2040 0060 0000 0000
0000540 0007 0000 0006 0000 0000 0000 0000 0000
0000550 2048 0060 0000 0000 0007 0000 0007 0000
0000560 0000 0000 0000 0000 2050 0060 0000 0000
0000570 0007 0000 0008 0000 0000 0000 0000 0000
0000580 2058 0060 0000 0000 0007 0000 0009 0000
0000590 0000 0000 0000 0000 2060 0060 0000 0000
00005a0 0007 0000 000a 0000 0000 0000 0000 0000
00005b0 2068 0060 0000 0000 0007 0000 000b 0000
00005c0 0000 0000 0000 0000 8348 08ec 8b48 2505
00005d0 201a 4800 c085 0574 73e8 0000 4800 c483
00005e0 c308 0000 0000 0000 0000 0000 0000 0000
00005f0 35ff 1a12 0020 25ff 1a14 0020 1f0f 0040
0000600 25ff 1a12 0020 0068 0000 e900 ffe0 ffff
0000610 25ff 1a0a 0020 0168 0000 e900 ffd0 ffff
0000620 25ff 1a02 0020 0268 0000 e900 ffc0 ffff
0000630 25ff 19fa 0020 0368 0000 e900 ffb0 ffff
0000640 25ff 19f2 0020 0468 0000 e900 ffa0 ffff
0000650 25ff 19ea 0020 0568 0000 e900 ff90 ffff
0000660 25ff 19e2 0020 0668 0000 e900 ff80 ffff
0000670 25ff 19da 0020 0768 0000 e900 ff70 ffff
0000680 25ff 19d2 0020 0868 0000 e900 ff60 ffff
0000690 25ff 19ca 0020 0968 0000 e900 ff50 ffff
00006a0 25ff 19c2 0020 0a68 0000 e900 ff40 ffff
00006b0 ed31 8949 5ed1 8948 48e2 e483 50f0 4954
00006c0 c0c7 0bf0 0040 c748 80c1 400b 4800 c7c7
00006d0 0a6a 0040 67e8 ffff f4ff 0f66 441f 0000
00006e0 87b8 6020 5500 2d48 2080 0060 8348 0ef8
00006f0 8948 77e5 5d02 b8c3 0000 0000 8548 74c0
0000700 5df4 80bf 6020 ff00 0fe0 801f 0000 0000
0000710 80b8 6020 5500 2d48 2080 0060 c148 03f8
0000720 8948 48e5 c289 c148 3fea 0148 48d0 f8d1
0000730 0275 c35d 00ba 0000 4800 d285 f474 485d
0000740 c689 80bf 6020 ff00 0fe2 801f 0000 0000
0000750 3d80 1929 0020 7500 5511 8948 e8e5 ff7e
0000760 ffff c65d 1605 2019 0100 c3f3 1f0f 0040
0000770 8348 a83d 2016 0000 1e74 00b8 0000 4800
0000780 c085 1474 bf55 1e20 0060 8948 ffe5 5dd0
0000790 7be9 ffff 0fff 001f 73e9 ffff 55ff 8948
00007a0 48e5 ec83 4810 7d89 e8f8 fe72 ffff 008b
00007b0 c085 0e74 8b48 f845 8948 e8c7 fec0 ffff
00007c0 16eb 8b48 f845 8948 bfc6 0c04 0040 00b8
00007d0 0000 e800 fe58 ffff 01bf 0000 e800 febe
00007e0 ffff 4855 e589 8348 40ec 8948 d87d 7589
00007f0 48d4 5589 c7c8 f445 0000 0000 45c7 00ec
0000800 0000 c700 f045 0000 0000 458b 48d4 4898
0000810 e0c1 4802 c789 55e8 fffe 48ff 4589 48f8
0000820 7d83 00f8 0a75 0fbf 400c e800 ff6d ffff
0000830 458b 48d4 4898 148d 0085 0000 4800 4d8b
0000840 48d8 458b 48f8 ce89 8948 e8c7 fe10 ffff
0000850 45c7 00ec 0000 e900 00c7 0000 45c7 00f0
0000860 0000 e900 00a8 0000 458b 48f0 4898 c083
0000870 4801 148d 0085 0000 4800 458b 48f8 d001
0000880 088b 458b 48f0 4898 148d 0085 0000 4800
0000890 458b 48f8 d001 108b 8b48 c845 ce89 d789
00008a0 d0ff c085 667e 458b 48f0 4898 c083 4801
00008b0 148d 0085 0000 4800 458b 48f8 d001 008b
00008c0 4589 8bf4 f045 9848 8348 01c0 8d48 8514
00008d0 0000 0000 8b48 f845 0148 8bc2 f045 9848
00008e0 8d48 850c 0000 0000 8b48 f845 0148 8bc8
00008f0 8900 8b02 f045 9848 8d48 8514 0000 0000
0000900 8b48 f845 0148 8bc2 f445 0289 4583 01f0
0000910 458b 83d4 01e8 453b 0ff0 498f ffff 83ff
0000920 ec45 8b01 ec45 453b 0fd4 2d8c ffff 48ff
0000930 458b c9f8 55c3 8948 89e5 fc7d 7589 8bf8
0000940 f845 558b 29fc 89c2 5dd0 55c3 8948 89e5
0000950 fc7d 7589 8bf8 fc45 558b 29f8 89c2 5dd0
0000960 55c3 8948 89e5 fc7d 7589 83f8 fc7d 7400
0000970 8306 f87d 7500 b807 0000 0000 09eb 458b
0000980 99fc 7df7 89f8 5dd0 55c3 8948 48e5 ec83
0000990 4840 7d89 89d8 d475 8948 c855 45c7 00ec
00009a0 0000 4800 558b 8bc8 d44d 8b48 d845 ce89
00009b0 8948 e8c7 fe2a ffff 8948 f045 8348 f07d
00009c0 7500 bf0a 0c1d 0040 d0e8 fffd c7ff ec45
00009d0 0000 0000 2beb 458b 48ec 4898 148d 0085
00009e0 0000 4800 458b 48f0 d001 008b c689 3abf
00009f0 400c b800 0000 0000 33e8 fffc 83ff ec45
0000a00 8b01 ec45 453b 7cd4 bfcd 000a 0000 fde8
0000a10 fffb 48ff 458b 48f0 c789 e1e8 fffb 48ff
0000a20 458b 48c8 4589 c7f8 ec45 0000 0000 28eb
0000a30 458b 48ec d063 8b48 f845 0148 0fd0 00b6
0000a40 b60f 89c0 bfc6 0c3e 0040 00b8 0000 e800
0000a50 fbdc ffff 4583 01ec 7d83 18ec d27e 0abf
0000a60 0000 e800 fba8 ffff c3c9 4855 e589 4853
0000a70 ec83 8938 cc7d 8948 c075 7d83 01cc 0a7f
0000a80 44bf 400c e800 fd13 ffff 458b 83cc 01e8
0000a90 4589 c7dc d845 0000 0000 8b48 c045 8348
0000aa0 08c0 8948 e045 458b 48dc 4898 e0c1 4802
0000ab0 c789 b9e8 fffb 48ff 4589 48e8 7d83 00e8
0000ac0 0a75 0fbf 400c e800 fcd1 ffff 45c7 00d8
0000ad0 0000 eb00 8b3a d845 9848 8d48 8514 0000
0000ae0 0000 8b48 e845 8d48 021c 458b 48d8 4898
0000af0 148d 00c5 0000 4800 458b 48e0 d001 8b48
0000b00 4800 c789 87e8 fffb 89ff 8303 d845 8b01
0000b10 d845 453b 7cdc 8bbe dc4d 8b48 e845 35ba
0000b20 4009 8900 48ce c789 5ce8 fffe 8bff dc4d
0000b30 8b48 e845 4bba 4009 8900 48ce c789 46e8
0000b40 fffe 8bff dc4d 8b48 e845 61ba 4009 8900
0000b50 48ce c789 30e8 fffe 48ff 458b 48e8 c789
0000b60 9be8 fffa b8ff 0000 0000 8348 38c4 5d5b
0000b70 66c3 0f2e 841f 0000 0000 0f00 441f 0000
0000b80 5741 8941 41ff 4956 f689 5541 8949 41d5
0000b90 4c54 258d 1278 0020 4855 2d8d 1278 0020
0000ba0 4c53 e529 db31 c148 03fd 8348 08ec 15e8
0000bb0 fffa 48ff ed85 1e74 1f0f 0084 0000 0000
0000bc0 894c 4cea f689 8944 41ff 14ff 48dc c383
0000bd0 4801 eb39 ea75 8348 08c4 5d5b 5c41 5d41
0000be0 5e41 5f41 66c3 2e66 1f0f 0084 0000 0000
0000bf0 c3f3 0000 8348 08ec 8348 08c4 00c3 0000
0000c00 0001 0002 5245 4f52 3a52 2520 0a73 4d00
0000c10 6d65 726f 2079 7265 6f72 2e72 4600 6961
0000c20 656c 2064 6f74 7320 726f 2074 7361 7220
0000c30 7165 6575 7473 6465 002e 6425 0020 3025
0000c40 7832 003a 5355 4741 3a45 6520 3178 2038
0000c50 2034 2033 2031 2035 0036 0000 1b01 3b03
0000c60 0060 0000 000b 0000 f994 ffff 00ac 0000
0000c70 fa54 ffff 007c 0000 fb41 ffff 00d4 0000
0000c80 fb86 ffff 00f4 0000 fcd9 ffff 0114 0000
0000c90 fcef ffff 0134 0000 fd05 ffff 0154 0000
0000ca0 fd2d ffff 0174 0000 fe0e ffff 0194 0000
0000cb0 ff24 ffff 01bc 0000 ff94 ffff 0204 0000
0000cc0 0014 0000 0000 0000 7a01 0052 7801 0110
0000cd0 0c1b 0807 0190 1007 0014 0000 001c 0000
0000ce0 f9d0 ffff 002a 0000 0000 0000 0000 0000
0000cf0 0014 0000 0000 0000 7a01 0052 7801 0110
0000d00 0c1b 0807 0190 0000 0024 0000 001c 0000
0000d10 f8e0 ffff 00c0 0000 0e00 4610 180e 0f4a
0000d20 770b 8008 3f00 3b1a 332a 2224 0000 0000
0000d30 001c 0000 0044 0000 fa65 ffff 0045 0000
0000d40 4100 100e 0286 0d43 0006 0000 0000 0000
0000d50 001c 0000 0064 0000 fa8a ffff 0153 0000
0000d60 4100 100e 0286 0d43 0306 014e 070c 0008
0000d70 001c 0000 0084 0000 fbbd ffff 0016 0000
0000d80 4100 100e 0286 0d43 5106 070c 0008 0000
0000d90 001c 0000 00a4 0000 fbb3 ffff 0016 0000
0000da0 4100 100e 0286 0d43 5106 070c 0008 0000
0000db0 001c 0000 00c4 0000 fba9 ffff 0028 0000
0000dc0 4100 100e 0286 0d43 6306 070c 0008 0000
0000dd0 001c 0000 00e4 0000 fbb1 ffff 00e1 0000
0000de0 4100 100e 0286 0d43 0206 0cdc 0807 0000
0000df0 0024 0000 0104 0000 fc72 ffff 0107 0000
0000e00 4100 100e 0286 0d43 4506 0383 fd02 070c
0000e10 0008 0000 0000 0000 0044 0000 012c 0000
0000e20 fd60 ffff 0065 0000 4200 100e 028f 0e45
0000e30 8e18 4503 200e 048d 0e45 8c28 4805 300e
0000e40 0686 0e48 8338 4d07 400e 0e6c 4138 300e
0000e50 0e41 4228 200e 0e42 4218 100e 0e42 0008
0000e60 0014 0000 0174 0000 fd88 ffff 0002 0000
0000e70 0000 0000 0000 0000 0000 0000 0000 0000
*
0001e10 0770 0040 0000 0000 0750 0040 0000 0000
0001e20 0000 0000 0000 0000 0001 0000 0000 0000
0001e30 0001 0000 0000 0000 000c 0000 0000 0000
0001e40 05c8 0040 0000 0000 000d 0000 0000 0000
0001e50 0bf4 0040 0000 0000 0019 0000 0000 0000
0001e60 1e10 0060 0000 0000 001b 0000 0000 0000
0001e70 0008 0000 0000 0000 001a 0000 0000 0000
0001e80 1e18 0060 0000 0000 001c 0000 0000 0000
0001e90 0008 0000 0000 0000 fef5 6fff 0000 0000
0001ea0 0298 0040 0000 0000 0005 0000 0000 0000
0001eb0 03d8 0040 0000 0000 0006 0000 0000 0000
0001ec0 02b8 0040 0000 0000 000a 0000 0000 0000
0001ed0 0087 0000 0000 0000 000b 0000 0000 0000
0001ee0 0018 0000 0000 0000 0015 0000 0000 0000
0001ef0 0000 0000 0000 0000 0003 0000 0000 0000
0001f00 2000 0060 0000 0000 0002 0000 0000 0000
0001f10 0108 0000 0000 0000 0014 0000 0000 0000
0001f20 0007 0000 0000 0000 0017 0000 0000 0000
0001f30 04c0 0040 0000 0000 0007 0000 0000 0000
0001f40 04a8 0040 0000 0000 0008 0000 0000 0000
0001f50 0018 0000 0000 0000 0009 0000 0000 0000
0001f60 0018 0000 0000 0000 fffe 6fff 0000 0000
0001f70 0478 0040 0000 0000 ffff 6fff 0000 0000
0001f80 0001 0000 0000 0000 fff0 6fff 0000 0000
0001f90 0460 0040 0000 0000 0000 0000 0000 0000
0001fa0 0000 0000 0000 0000 0000 0000 0000 0000
*
0002000 1e28 0060 0000 0000 0000 0000 0000 0000
0002010 0000 0000 0000 0000 0606 0040 0000 0000
0002020 0616 0040 0000 0000 0626 0040 0000 0000
0002030 0636 0040 0000 0000 0646 0040 0000 0000
0002040 0656 0040 0000 0000 0666 0040 0000 0000
0002050 0676 0040 0000 0000 0686 0040 0000 0000
0002060 0696 0040 0000 0000 06a6 0040 0000 0000
0002070 0000 0000 0000 0000 0000 0000 0000 0000
0002080 4347 3a43 2820 6255 6e75 7574 3420 382e
0002090 322e 312d 7539 7562 746e 3175 2029 2e34
00020a0 2e38 0032 002c 0000 0002 0000 0000 0008
00020b0 0000 0000 079d 0040 0000 0000 03d4 0000
00020c0 0000 0000 0000 0000 0000 0000 0000 0000
00020d0 0000 0000 0308 0000 0004 0000 0000 0108
00020e0 00df 0000 5801 0000 1a00 0000 9d00 4007
00020f0 0000 0000 d400 0003 0000 0000 0000 0000
0002100 0200 0708 00cd 0000 0102 7b08 0000 0200
0002110 0702 008e 0000 0402 d207 0000 0200 0601
0002120 007d 0000 0202 5305 0001 0300 0504 6e69
0002130 0074 0802 3005 0001 0200 0708 0122 0000
0002140 0804 0072 0000 0102 8406 0000 0400 7f08
0002150 0000 0500 0072 0000 0804 0057 0000 0802
0002160 2b05 0001 0200 0708 00c8 0000 5d06 0001
0002170 0100 a313 0000 0400 a908 0000 0700 0057
0002180 0000 00bd 0000 5708 0000 0800 0057 0000
0002190 0900 6964 0065 0701 079d 0040 0000 0000
00021a0 0045 0000 0000 0000 9c01 00e9 0000 5f0a
00021b0 0000 0100 7907 0000 0200 6891 0b00 0147
00021c0 0000 1701 0084 0000 07e2 0040 0000 0000
00021d0 0153 0000 0000 0000 9c01 016a 0000 670a
00021e0 0000 0100 8417 0000 0200 4891 140a 0000
00021f0 0100 5717 0000 0200 4491 630c 706d 0100
0002200 9817 0000 0300 b891 0d7f 0089 0000 1801
0002210 0057 0000 9102 0e64 0069 1901 0057 0000
0002220 9102 0e5c 006a 1a01 0057 0000 9102 0d60
0002230 006f 0000 1b01 0084 0000 9102 0068 000f
0002240 0000 0100 572b 0000 3500 4009 0000 0000
0002250 1600 0000 0000 0000 0100 a49c 0001 0c00
0002260 0061 2b01 0057 0000 9102 0c6c 0062 2b01
0002270 0057 0000 9102 0068 390f 0001 0100 572f
0002280 0000 4b00 4009 0000 0000 1600 0000 0000
0002290 0000 0100 de9c 0001 0c00 0061 2f01 0057
00022a0 0000 9102 0c6c 0062 2f01 0057 0000 9102
00022b0 0068 b30f 0000 0100 5733 0000 6100 4009
00022c0 0000 0000 2800 0000 0000 0000 0100 189c
00022d0 0002 0c00 0061 3301 0057 0000 9102 0c6c
00022e0 0062 3301 0057 0000 9102 0068 a110 0000
00022f0 0100 893d 4009 0000 0000 e100 0000 0000
0002300 0000 0100 899c 0002 0a00 0067 0000 3d01
0002310 0084 0000 9102 0a48 0014 0000 3d01 0057
0002320 0000 9102 0c44 6d63 0070 3d01 0098 0000
0002330 9103 7fb8 690e 0100 573e 0000 0200 5c91
0002340 0d0d 0000 0100 843f 0000 0200 6091 760d
0002350 0000 0100 8948 0002 0200 6891 0400 3408
0002360 0000 0b00 00ae 0000 4f01 0057 0000 0a6a
0002370 0040 0000 0000 0107 0000 0000 0000 9c01
0002380 0305 0000 1d0a 0001 0100 574f 0000 0300
0002390 bc91 0a7f 0053 0000 4f01 0305 0000 9103
00023a0 7fb0 140d 0000 0100 5751 0000 0200 4c91
00023b0 690e 0100 5752 0000 0200 4891 c10d 0000
00023c0 0100 0553 0003 0200 5091 670d 0000 0100
00023d0 8455 0000 0200 5891 0400 6c08 0000 0000
00023e0 1101 2501 130e 030b 1b0e 110e 1201 1007
00023f0 0017 0200 0024 0b0b 0b3e 0e03 0000 2403
0002400 0b00 3e0b 030b 0008 0400 000f 0b0b 1349
0002410 0000 2605 4900 0013 0600 0016 0e03 0b3a
0002420 0b3b 1349 0000 1507 2701 4919 0113 0013
0002430 0800 0005 1349 0000 2e09 3f01 0319 3a08
0002440 3b0b 270b 1119 1201 4007 9618 1942 1301
0002450 0000 050a 0300 3a0e 3b0b 490b 0213 0018
0002460 0b00 012e 193f 0e03 0b3a 0b3b 1927 1349
0002470 0111 0712 1840 4296 0119 0013 0c00 0005
0002480 0803 0b3a 0b3b 1349 1802 0000 340d 0300
0002490 3a0e 3b0b 490b 0213 0018 0e00 0034 0803
00024a0 0b3a 0b3b 1349 1802 0000 2e0f 3f01 0319
00024b0 3a0e 3b0b 270b 4919 1113 1201 4007 9718
00024c0 1942 1301 0000 2e10 3f01 0319 3a0e 3b0b
00024d0 270b 1119 1201 4007 9618 1942 1301 0000
00024e0 eb00 0000 0200 1d00 0000 0100 fb01 0d0e
00024f0 0100 0101 0001 0000 0001 0100 6500 3178
0002500 2e38 0063 0000 0000 0900 9d02 4007 0000
0002510 0000 1800 adbb 08d9 035a 9e09 2f08 7575
0002520 0875 004b 0402 0601 0674 08a0 bbe5 02bb
0002530 133e bb08 3002 0813 007e 0402 0601 064a
0002540 00e3 0402 0601 064a 0903 4bba 9f30 309f
0002550 9f9f 9f30 0200 0104 6606 6706 9277 0831
0002560 752f 8308 0200 0104 7406 a006 0200 0204
0002570 0091 0402 0202 1127 0200 0104 4a06 8506
0002580 bc9f 0083 0402 9102 0200 0204 2402 0011
0002590 0402 0601 064a 9f69 f330 0200 0104 6606
00025a0 9f06 7591 08bc 004b 0402 0601 0674 00a0
00025b0 0402 9102 0200 0204 3602 0011 0402 0601
00025c0 064a 0886 0859 0859 bb5a 0259 0007 0101
00025d0 6f73 7472 6465 6f5f 6472 7265 7300 726f
00025e0 6574 0064 6f63 6e75 0074 682f 6d6f 2f65
00025f0 6572 2f78 6572 2f78 7270 6a6f 6365 7374
0002600 702f 6f72 7267 6d61 696d 676e 632f 6c2f
0002610 6165 6e72 685f 7261 5f64 6177 2f79 7865
0002620 3831 6100 6772 0076 7865 3831 632e 6d00
0002630 7365 6173 6567 6e00 6d75 6562 7372 7400
0002640 7261 6567 0074 6164 6174 7500 736e 6769
0002650 656e 2064 6863 7261 7400 6d65 0070 6873
0002660 726f 2074 6e75 6973 6e67 6465 6920 746e
0002670 7400 7365 5f74 6f73 7472 6e69 0067 616d
0002680 6e69 7300 7274 6e61 6567 6f5f 6472 7265
0002690 6900 706e 7475 0073 6f6c 676e 6c20 6e6f
00026a0 2067 6e75 6973 6e67 6465 6920 746e 4700
00026b0 554e 4320 3420 382e 322e 2d20 746d 6e75
00026c0 3d65 6567 656e 6972 2063 6d2d 7261 6863
00026d0 783d 3638 362d 2034 672d 2d20 7366 6174
00026e0 6b63 702d 6f72 6574 7463 726f 6100 6772
00026f0 0063 6973 657a 7974 6570 6c00 6e6f 2067
0002700 6f6c 676e 6920 746e 7200 7665 7265 6573
0002710 6f5f 6472 7265 6200 6275 6c62 5f65 6f73
0002720 7472 7300 6f68 7472 6920 746e 6300 6d6f
0002730 6170 6572 635f 0062 2e00 7973 746d 6261
0002740 2e00 7473 7472 6261 2e00 6873 7473 7472
0002750 6261 2e00 6e69 6574 7072 2e00 6f6e 6574
0002760 412e 4942 742d 6761 2e00 6f6e 6574 672e
0002770 756e 622e 6975 646c 692d 0064 672e 756e
0002780 682e 7361 0068 642e 6e79 7973 006d 642e
0002790 6e79 7473 0072 672e 756e 762e 7265 6973
00027a0 6e6f 2e00 6e67 2e75 6576 7372 6f69 5f6e
00027b0 0072 722e 6c65 2e61 7964 006e 722e 6c65
00027c0 2e61 6c70 0074 692e 696e 0074 742e 7865
00027d0 0074 662e 6e69 0069 722e 646f 7461 0061
00027e0 652e 5f68 7266 6d61 5f65 6468 0072 652e
00027f0 5f68 7266 6d61 0065 692e 696e 5f74 7261
0002800 6172 0079 662e 6e69 5f69 7261 6172 0079
0002810 6a2e 7263 2e00 7964 616e 696d 0063 672e
0002820 746f 2e00 6f67 2e74 6c70 0074 642e 7461
0002830 0061 622e 7373 2e00 6f63 6d6d 6e65 0074
0002840 642e 6265 6775 615f 6172 676e 7365 2e00
0002850 6564 7562 5f67 6e69 6f66 2e00 6564 7562
0002860 5f67 6261 7262 7665 2e00 6564 7562 5f67
0002870 696c 656e 2e00 6564 7562 5f67 7473 0072
0002880 0000 0000 0000 0000 0000 0000 0000 0000
*
00028c0 001b 0000 0001 0000 0002 0000 0000 0000
00028d0 0238 0040 0000 0000 0238 0000 0000 0000
00028e0 001c 0000 0000 0000 0000 0000 0000 0000
00028f0 0001 0000 0000 0000 0000 0000 0000 0000
0002900 0023 0000 0007 0000 0002 0000 0000 0000
0002910 0254 0040 0000 0000 0254 0000 0000 0000
0002920 0020 0000 0000 0000 0000 0000 0000 0000
0002930 0004 0000 0000 0000 0000 0000 0000 0000
0002940 0031 0000 0007 0000 0002 0000 0000 0000
0002950 0274 0040 0000 0000 0274 0000 0000 0000
0002960 0024 0000 0000 0000 0000 0000 0000 0000
0002970 0004 0000 0000 0000 0000 0000 0000 0000
0002980 0044 0000 fff6 6fff 0002 0000 0000 0000
0002990 0298 0040 0000 0000 0298 0000 0000 0000
00029a0 001c 0000 0000 0000 0005 0000 0000 0000
00029b0 0008 0000 0000 0000 0000 0000 0000 0000
00029c0 004e 0000 000b 0000 0002 0000 0000 0000
00029d0 02b8 0040 0000 0000 02b8 0000 0000 0000
00029e0 0120 0000 0000 0000 0006 0000 0001 0000
00029f0 0008 0000 0000 0000 0018 0000 0000 0000
0002a00 0056 0000 0003 0000 0002 0000 0000 0000
0002a10 03d8 0040 0000 0000 03d8 0000 0000 0000
0002a20 0087 0000 0000 0000 0000 0000 0000 0000
0002a30 0001 0000 0000 0000 0000 0000 0000 0000
0002a40 005e 0000 ffff 6fff 0002 0000 0000 0000
0002a50 0460 0040 0000 0000 0460 0000 0000 0000
0002a60 0018 0000 0000 0000 0005 0000 0000 0000
0002a70 0002 0000 0000 0000 0002 0000 0000 0000
0002a80 006b 0000 fffe 6fff 0002 0000 0000 0000
0002a90 0478 0040 0000 0000 0478 0000 0000 0000
0002aa0 0030 0000 0000 0000 0006 0000 0001 0000
0002ab0 0008 0000 0000 0000 0000 0000 0000 0000
0002ac0 007a 0000 0004 0000 0002 0000 0000 0000
0002ad0 04a8 0040 0000 0000 04a8 0000 0000 0000
0002ae0 0018 0000 0000 0000 0005 0000 0000 0000
0002af0 0008 0000 0000 0000 0018 0000 0000 0000
0002b00 0084 0000 0004 0000 0002 0000 0000 0000
0002b10 04c0 0040 0000 0000 04c0 0000 0000 0000
0002b20 0108 0000 0000 0000 0005 0000 000c 0000
0002b30 0008 0000 0000 0000 0018 0000 0000 0000
0002b40 008e 0000 0001 0000 0006 0000 0000 0000
0002b50 05c8 0040 0000 0000 05c8 0000 0000 0000
0002b60 001a 0000 0000 0000 0000 0000 0000 0000
0002b70 0004 0000 0000 0000 0000 0000 0000 0000
0002b80 0089 0000 0001 0000 0006 0000 0000 0000
0002b90 05f0 0040 0000 0000 05f0 0000 0000 0000
0002ba0 00c0 0000 0000 0000 0000 0000 0000 0000
0002bb0 0010 0000 0000 0000 0010 0000 0000 0000
0002bc0 0094 0000 0001 0000 0006 0000 0000 0000
0002bd0 06b0 0040 0000 0000 06b0 0000 0000 0000
0002be0 0542 0000 0000 0000 0000 0000 0000 0000
0002bf0 0010 0000 0000 0000 0000 0000 0000 0000
0002c00 009a 0000 0001 0000 0006 0000 0000 0000
0002c10 0bf4 0040 0000 0000 0bf4 0000 0000 0000
0002c20 0009 0000 0000 0000 0000 0000 0000 0000
0002c30 0004 0000 0000 0000 0000 0000 0000 0000
0002c40 00a0 0000 0001 0000 0002 0000 0000 0000
0002c50 0c00 0040 0000 0000 0c00 0000 0000 0000
0002c60 005a 0000 0000 0000 0000 0000 0000 0000
0002c70 0004 0000 0000 0000 0000 0000 0000 0000
0002c80 00a8 0000 0001 0000 0002 0000 0000 0000
0002c90 0c5c 0040 0000 0000 0c5c 0000 0000 0000
0002ca0 0064 0000 0000 0000 0000 0000 0000 0000
0002cb0 0004 0000 0000 0000 0000 0000 0000 0000
0002cc0 00b6 0000 0001 0000 0002 0000 0000 0000
0002cd0 0cc0 0040 0000 0000 0cc0 0000 0000 0000
0002ce0 01bc 0000 0000 0000 0000 0000 0000 0000
0002cf0 0008 0000 0000 0000 0000 0000 0000 0000
0002d00 00c0 0000 000e 0000 0003 0000 0000 0000
0002d10 1e10 0060 0000 0000 1e10 0000 0000 0000
0002d20 0008 0000 0000 0000 0000 0000 0000 0000
*
0002d40 00cc 0000 000f 0000 0003 0000 0000 0000
0002d50 1e18 0060 0000 0000 1e18 0000 0000 0000
0002d60 0008 0000 0000 0000 0000 0000 0000 0000
*
0002d80 00d8 0000 0001 0000 0003 0000 0000 0000
0002d90 1e20 0060 0000 0000 1e20 0000 0000 0000
0002da0 0008 0000 0000 0000 0000 0000 0000 0000
*
0002dc0 00dd 0000 0006 0000 0003 0000 0000 0000
0002dd0 1e28 0060 0000 0000 1e28 0000 0000 0000
0002de0 01d0 0000 0000 0000 0006 0000 0000 0000
0002df0 0008 0000 0000 0000 0010 0000 0000 0000
0002e00 00e6 0000 0001 0000 0003 0000 0000 0000
0002e10 1ff8 0060 0000 0000 1ff8 0000 0000 0000
0002e20 0008 0000 0000 0000 0000 0000 0000 0000
0002e30 0008 0000 0000 0000 0008 0000 0000 0000
0002e40 00eb 0000 0001 0000 0003 0000 0000 0000
0002e50 2000 0060 0000 0000 2000 0000 0000 0000
0002e60 0070 0000 0000 0000 0000 0000 0000 0000
0002e70 0008 0000 0000 0000 0008 0000 0000 0000
0002e80 00f4 0000 0001 0000 0003 0000 0000 0000

I cannot find 55 and 48 next to each other.

Update 1: The updated binary file has the following patterns that looks like the function I printed:

first pattern:

0000790 7be9 ffff 0fff 001f 73e9 ffff 55ff 8948
00007a0 48e5 ec83 4810 7d89 e8f8 fe72 ffff 008b
00007b0 c085 0e74 8b48 f845 8948 e8c7 fec0 ffff

second pattern:

0000980 99fc 7df7 89f8 5dd0 55c3 8948 48e5 ec83
0000990 4840 7d89 89d8 d475 8948 c855 45c7 00ec
00009a0 0000 4800 558b 8bc8 d44d 8b48 d845 ce89

However, from the pattern I printed out: 55:48:89:e5:89:7d:fc:89:75:f8:8b:45:f8:8b:55:fc:29:c2:89:d0:5d:c3:55:48:89:

I should be able to find this function in the binary, i.e., I am lookin for something like below in the binary: ...89fc7d89e5894855

But the first pattern above has: ...8348e5894855 which is different from the pattern I am looking for

The second pattern above has: ...8348e5894855 which is also different.

Morrow answered 22/12, 2014 at 6:24 Comment(6)
You won't find absolute function addresses in executable files. If you are on Linux (which I assume) read about ELF file format (man elf). – Incorporeity
@immibis: the values are 0x55 and 0x48, the first two bytes of the output from printing the function code — at least hypothetically. – Exmoor
@immibis, that is the first two number that I printed out each time I print the function. – Morrow
@Jongware, See the command I used. I believe that is the default hex value in the binary which is what I want. – Morrow
@Jongware, I am afraid I did not completely understand where things go wrong. My intention is to get the human readable hex values to inspect my binary, so any hex editor will do the job. Is hexdump wrong for this purpose? Can you give a constructive suggestion? – Morrow
@Jongware, thank you for pointing it out. You are right. I updated the binary file and some more basic question. Could you take a look? – Morrow
B
2

If you want to know where the compiler (or strictly the linker) has located data and functions in the binary, you need to instruct the linker to generate a map file, or you can use the objdump and/or nm utilities on the existing object file.

Blower answered 22/12, 2014 at 9:59 Comment(6)
The OP did not dump run-time data, the hex dump in the executable output shows the function compare_cb cmp. The first few bytes are recognizable as a standard function prologue. Therefore these bytes should appear when examining the executable. However, OPs hexdump seems to be from the wrong file .. – Salish
@Salish : I hadn't spotted that cmp was a function pointer! – Blower
Still: he should be able to find it in the hex dump. (Well, the correct one.) – Salish
Indeed. But the map, objdump and nm are tools that he should be aware of, so I'll let the answer stand without the flawed analysis. – Blower
could you elaborate more? – Morrow
@dannycrane : The links to the relevant tools are the elaboration. – Blower
S
0

After compiling your code, without any optimizations, I get the executable ex18 with a size of 10,136 bytes. file reports it as a "Mach-O 64-bit executable x86_64", since I am on a Mac. Some tool names and notations may be different on your system.

Let's have a look at this file with some of the standard tools of Linux et fili.

Using hexdump I get 363 lines of hex, and some of them are * which indicate a repetition of the previous line. (Without that default setting, I'd get 10136/16 = 821 lines.)

After adding -Wl,-map,ex18.map (remember: I'm on OS X, and this command line syntax is different than the default for general versions of gcc) I get a file that starts with

# Path: ex18
# Arch: x86_64
# Object files:
[  0] linker synthesized
[  1] /usr/lib/crt1.10.6.o
[  2] /var/folders/b6/g3yv219j13v46njdytcd767w0000gn/T//ccoACNzu.o
[  3] /usr/lib/libSystem.dylib
# Sections:
# Address   Size        Segment Section
0x1000007A0 0x0000056F  __TEXT  __text
0x100000D10 0x00000036  __TEXT  __stubs
0x100000D48 0x0000006C  __TEXT  __stub_helper
0x100000DB4 0x00000056  __TEXT  __cstring
0x100000E0A 0x00000050  __TEXT  __unwind_info
0x100000E60 0x00000198  __TEXT  __eh_frame
0x100001000 0x00000028  __DATA  __program_vars
0x100001028 0x00000010  __DATA  __nl_symbol_ptr
0x100001038 0x00000048  __DATA  __la_symbol_ptr
0x100001080 0x00000020  __DATA  __common
# Symbols:
# Address   Size        File  Name
0x1000007A0 0x0000003C  [  1] start
0x1000007E0 0x00000050  [  2] _die
0x100000830 0x000001C0  [  2] _bubble_sort
0x1000009F0 0x00000070  [  2] ___inline_memcpy_chk
0x100000A60 0x00000020  [  2] _sorted_order
0x100000A80 0x00000020  [  2] _reverse_order
0x100000AA0 0x00000040  [  2] _strange_order
0x100000AE0 0x00000100  [  2] _test_sorting
0x100000BE0 0x0000012F  [  2] _main

.. followed by more functions that were used in the program (_atoi, _exit) and the addresses of literal strings and such. What does this information tell us?

  • You can ignore the large offset 0x100000000;
  • the remainder is the offset of each item in the executable binary file;
  • most names have one or more leading underscores added (this is a peculiarity of most linkers, and it comes down to 'having a unique name' -- don't worry about it);
  • the Sections are, broadly speaking, to indicate what each part of the file is for. Some sections are executable (in this case, __text is); some contain literal text data (__cstring contains only the text strings from your program). Executables are divided into sections for several good reasons. "Code", for example, can only be run when in an executable section, "Read-Only data" may never be executed, and so on and so forth.
  • The Symbols are addresses of functions and data in the executable. In this dump, the addresses appear in their most basic form: minus the huge constant, as an offset into the executable file.

That last item, the Symbol listing, seems to be your point of interest. start, for instance, is at 7A0 in my binary. Examining the hex dump, I find the following sequence of bytes at that position: 6A 00 48 89 E5 48 83 E4 F0... Now these are literal instructions to the CPU. We can find the same for sorted_order, reverse_order and strange_order and confirm they are almost the same bytes you get when printing from "within" the program.

But what do these bytes mean? On to the next tool.

Clifford mentions objdump, my OS X has otool. Using otool -tv ex18, I get a 404 line long disassembly of the text section. The disassembly starts with

(__TEXT,__text) section
start:
00000001000007a0    pushq   $0x00
00000001000007a2    movq    %rsp,%rbp
00000001000007a5    andq    $0xf0,%rsp
00000001000007a9    movq    0x08(%rbp),%rdi
00000001000007ad    leaq    0x10(%rbp),%rsi
00000001000007b1    movl    %edi,%edx
00000001000007b3    addl    $0x01,%edx

and this is the written out form ('disassembly') of the hex bytes I show above. otool includes, very helpful, the function names as labels, so we can scroll through the list and find your _sorted_order, _reverse_order, and _strange_order functions again. Here is what I got:

55 48 89 E5 89 7D FC 89 75 F8 ...

or, in more readable disassembly:

_sorted_order:
0000000100000a60    pushq   %rbp
0000000100000a61    movq    %rsp,%rbp
0000000100000a64    movl    %edi,0xfc(%rbp)
0000000100000a67    movl    %esi,0xf8(%rbp)
0000000100000a6a    movl    0xfc(%rbp),%eax
0000000100000a6d    movl    0xf8(%rbp),%ecx
0000000100000a70    subl    %ecx,%eax
0000000100000a72    movl    %eax,0xf0(%rbp)
0000000100000a75    movl    0xf0(%rbp),%eax
0000000100000a78    movl    %eax,0xf4(%rbp)
0000000100000a7b    movl    0xf4(%rbp),%eax
0000000100000a7e    popq    %rbp
0000000100000a7f    ret

For the precise meaning of this, you may want to consult an assembler web site. Assembly may look intimidating, but even a short primer will be enough to understand the general gist. Me, I can read this like a novel (a short and boring one) ;) it reads two values from the internal stack, subtracts one from the other, and returns that value in %eax. That seems pretty much what the routine in C does too (which is a good thing: this is the evidence that the compiler created code that does exactly what your C code told it to!).

How does this compare to the hex dump from your program? (And why did I state it may "almost" be the same?)

In your source, you call the sort routine through cmp, a pointer to a function. The pointer is what is going to be used by the sort function as its comparison routine. Other than forwarding it as a pointer, instead of a regular immediate call, it's perfectly normal C syntax.

This means that when running the program, the value of cmp is that of the compare routine itself. It is no different than the 'value' of test_sorting when called with

test_sorting (numbers, count, sorted_order);

What do you get when 'reading' from a pointer to a function? Why, the actual code at that address of course! It is nothing more and nothing less than the instructions that are going to be executed next. You don't even have to use a function to get the pointer to anything: adding this at the bottom of your main will also work.

unsigned char *data = (unsigned char *)test_sorting;
for(i = 0; i < 25; i++) {
    printf("%02x:", data[i]);
}
printf("\n");

So, what you print from memory is the same as what you can locate in the executable file, right? No.

Earlier I said a program needs to know the addresses of functions, strings, and other assorted stuff. Their position must be included in the file because it may be loaded on any particular address; this way, a loader can relocate loaded addresses to the actual addresses in use. As an example, the literal string "ERROR: %s\n" in the function die is stored at

0x100000DB4 0x0000000B  [  2] literal string: ERROR: %s

according to my map file. When printf is called, it loads this address and sends it off elsewhere (ultimately, to your screen). However, you cannot be sure this program is loaded at the exact same memory address as the dump assumes. What if there is something else at that point in memory? So, the loader picks a free memory address to load in to, and adds this (absolute) address to each of the (relative) addresses in the executable file. And if you print out data from 'within' running the program, these are the addresses you get, including the absolute part, where inspecting the file you only get relative addresses.

Salish answered 22/12, 2014 at 22:54 Comment(0)

© 2022 - 2024 — McMap. All rights reserved.