Linux 如何反汇编原始 16 位 x86 机器代码？
声明：本页面是StackOverFlow热门问题的中英对照翻译，遵循CC BY-SA 4.0协议，如果您需要使用它，必须同样遵循CC BY-SA许可，注明原文地址和作者信息，同时你必须将它归于原作者（不是我）：StackOverFlow
原文地址: http://stackoverflow.com/questions/1737095/
Warning: these are provided under cc-by-sa 4.0 license. You are free to use/share it, But you must attribute it to the original authors (not me):
StackOverFlow
How do I disassemble raw 16-bit x86 machine code?
提问by sigjuice
I'd like to disassemble the MBR (first 512 bytes) of a bootable x86 disk that I have. I have copied the MBR to a file using
我想反汇编我拥有的可引导 x86 磁盘的 MBR（前 512 字节）。我已将 MBR 复制到文件中
dd if=/dev/my-device of=mbr bs=512 count=1
Any suggestions for a Linux utility that can disassemble the file mbr?
对于可以反汇编文件的 Linux 实用程序有mbr什么建议吗？
采纳答案by hlovdal
You can use objdump. According to this articlethe syntax is:
您可以使用 objdump。根据这篇文章，语法是：
objdump -D -b binary -mi386 -Maddr16,data16 mbr
回答by asveikau
I like ndisasmfor this purpose. It comes with the NASM assembler, which is free and open source and included in the package repositories of most linux distros.
我喜欢ndisasm这个目的。它带有 NASM 汇编器，它是免费和开源的，并且包含在大多数 linux 发行版的软件包存储库中。
回答by starblue
The GNU tool is called objdump, for example:
GNU 工具称为objdump，例如：
objdump -D -b binary -m i8086 <file>
回答by Jason
Try this command:
试试这个命令：
sudo dd if=/dev/sda bs=512 count=1 | ndisasm -b16 -o7c00h -
回答by jameslin
ndisasm -b16 -o7c00h -a -s7c3eh mbr
Explanation- from ndisasm manpage
说明- 来自 ndasm 联机帮助页
-b= Specifies 16-, 32- or 64-bit mode. The default is 16-bit mode.-o= Specifies the notional load address for the file. This option causes ndisasm to get the addresses it lists down the left hand margin, and the target addresses of PC-relative jumps and calls, right.-a= Enables automatic (or intelligent) sync mode, in which ndisasm will attempt to guess where synchronisation should be performed, by means of examining the target addresses of the relative jumps and calls it disassembles.-s= Manually specifies a synchronisation address, such that ndisasm will not output any machine instruction which encompasses bytes on both sides of the address. Hence the instruction which starts at that address will be correctly disassembled.mbr= The file to be disassembled.
-b= 指定 16 位、32 位或 64 位模式。默认为 16 位模式。-o= 指定文件的名义加载地址。此选项使 ndisasm 获取它在左侧边缘列出的地址，以及与 PC 相关的跳转和调用的目标地址，右侧。-a= 启用自动（或智能）同步模式，其中 ndisasm 将尝试通过检查相关跳转的目标地址并调用反汇编来猜测应该在哪里执行同步。-s= 手动指定同步地址，这样 ndisasm 不会输出任何包含地址两侧字节的机器指令。因此，从该地址开始的指令将被正确反汇编。mbr= 要反汇编的文件。
回答by mirabilos
starblueand hlovdalboth have parts of the canonical answer. If you want to disassemble raw i8086 code, you usually want Intel syntax, not AT&T syntax, too, so use:
starblue和hlovdal都具有典型的答案的一部分。如果你想反汇编原始 i8086 代码，你通常需要 Intel 语法，而不是 AT&T 语法，所以使用：
objdump -D -Mintel,i8086 -b binary -m i386 mbr.bin
objdump -D -Mintel,i386 -b binary -m i386 foo.bin # for 32-bit code
objdump -D -Mintel,x86-64 -b binary -m i386 foo.bin # for 64-bit code
If your code is ELF (or a.out (or (E)COFF)), you can use the short form:
如果您的代码是 ELF（或 a.out（或 (E)COFF)），您可以使用缩写形式：
objdump -D -Mintel,i8086 a.out # disassembles the entire file
objdump -d -Mintel,i8086 a.out # disassembles only code sections
For 32-bit or 64-bit code, omit the ,8086; the ELF header already includes this information.
对于 32 位或 64 位代码，省略,8086; ELF 标头已包含此信息。
ndisasm, as suggested by jameslin, is also a good choice, but objdumpusually comes with the OS and can deal with all architectures supported by GNU binutils (superset of those supported by GCC), and its output can usually be fed into GNU as(ndisasm's can usually be fed into nasmthough, of course).
ndisasm，正如jameslin所建议的，也是一个不错的选择，但objdump通常与操作系统一起提供，可以处理 GNU binutils 支持的所有架构（GCC 支持的架构的超集），并且它的输出通常可以输入 GNU as（ndisasm 的通常可以nasm当然，被喂进去）。
Peter Cordessuggests that “Agner Fog's objconvis very nice. It puts labels on branch targets, making a lot easier to figure out what the code does. It can disassemble into NASM, YASM, MASM, or AT&T (GNU) syntax.”
Peter Cordes建议“ Agner Fog 的 objconv非常好。它将标签放在分支目标上，从而更容易弄清楚代码的作用。它可以分解为 NASM、YASM、MASM 或 AT&T (GNU) 语法。”
Multimedia Mikealready found out about --adjust-vma; the ndisasmequivalent is the -ooption.
多媒体 Mike已经发现了--adjust-vma；在ndisasm相当于是-o选项。
To disassemble, say, sh4code (I used one binary from Debian to test), use this with GNU binutils (almost all other disassemblers are limited to one platform, such as x86 with ndisasmand objconv):
比方说，要反汇编sh4代码（我使用 Debian 中的一个二进制文件进行测试），请将此与 GNU binutils 一起使用（几乎所有其他反汇编程序都仅限于一个平台，例如带有ndisasm和 的x86 objconv）：
objdump -D -b binary -m sh -EL x
The -mis the machine, and -ELmeans Little Endian (for sh4ebuse -EBinstead), which is relevant for architectures that exist in either endianness.
的-m是机器，并-EL意味着小端（对于sh4eb使用-EB代替），这是相关的存在于任一端序架构。
