Question

how can I view the hexadecimal representation of some assembler commands?

this is from gdb:

0x8048395 <simple+1>            mov    %esp,%ebp
0x8048397 <simple+3>            mov    $0x1,%eax
0x804839c <simple+8>            pop    %ebp                               
0x804839d <simple+9>            ret

“simple” is the c function of this program. I tried

dump ihex value dump.hex simple

which results in

:020000040804EE
:0183940000E8
:00000001FF

and

dump ihex memory dump.hex 0x8048394 0x804839d

which results in something different

:020000040804EE
:098394005589E5B8010000005D07
:00000001FF

why are they different? is one of them correct?

Answer 1

To see the real bytes you can simply use:

disas /r simple

Of if you want to dump to a file to raw binary

dump binary memory file.bin 0x8048394 0x804839d

The ihex format is the Intel Hex format, and it is not as straightforward as it may seem.

Also, when you use dump value you are dumping the value of the address of the function, not the code of the function itself. That is what is done with dump memory.

UPDATE: Actually, when you do dump <format> value dump.hex simple, it dumps the content of simple, but not knowing how to dump a function value, it dumps it as if it were a char value, that is, it dumps the first byte of the function. If you want to dump the address of the function, just do: dump <format> value dump.hex &simple.