How to Disassemble and Analyze Object Files Using the objdump Command in Linux

When you are reverse-engineering closed-source software, debugging complex compiler errors, or analyzing potential malware, you cannot simply open the executable binary in a standard text editor. To understand how a compiled program operates under the hood, you need a specialized tool that can dissect the binary and present its internal structure in a human-readable format. In the Linux environment, the GNU Binary Utilities suite provides the objdump command exactly for this purpose.

How the objdump Command Works

The objdump utility is designed to display comprehensive information about object files (such as .o compiled objects, shared libraries like .so, and standard ELF executable binaries). Depending on the flags you use, it can extract and print the file headers, list the symbol tables (variables and function names), or, most powerfully, disassemble the machine code back into readable Assembly language.

Disassembling Machine Code

The most common use case for objdump is reverse-engineering a binary to see the actual CPU instructions it intends to execute. To disassemble the executable sections of a file, use the -d (disassemble) flag.

objdump -d /bin/ls

The output will be massive, so it is highly recommended to pipe the result into less so you can scroll through it.

objdump -d /bin/ls | less

You will see the memory addresses on the left, the raw hex machine code in the middle, and the corresponding human-readable Assembly instructions (like mov, call, and jmp) on the right.

If you have access to the original source code and the binary was compiled with debugging symbols enabled (using gcc -g), you can add the -S flag. This will interleave your original C or C++ source code lines directly in between the raw Assembly instructions, making the output exponentially easier to understand.

objdump -S my_debug_program | less

Viewing the Symbol Table

If you don’t need to read the Assembly code but just want to see a list of every function and global variable the binary contains, you can dump the symbol table using the -t (syms) flag.

objdump -t libexample.so

This will print a long list indicating the memory address of each symbol, its size, its section (such as .text for code or .data for variables), and its name. If the output says “no symbols,” the binary has likely been stripped to save space or obfuscate the code, and you will need to rely purely on the disassembler.