Question

I have very simple C program:

int foobar(int a)
{
    int b = a;
}

int main(int argc, char *argv[])
{
    foobar(0xDEAD);
    return 0;
}

Using objdump -d main.out I got disassembled binary with a lot of assembler instructions:

  4004a3:   55                      push   %ebp
  4004a4:   48 89 e5                mov    %esp,%ebp
  4004a7:   48 83 ec 10             sub    $0x10,%esp

How can I find for example address of every push instruction from another C program?
Can it be done this way?:

position = 0;
while (...)
{
   ...
   int act_value;
   read(binary_file, &act_value, 4);

   if (act_value == /*what value?*/)
   {
      printf("Instruction: push\n");
      printf("Address: %X\n", position * 4); /* is this correct?*/
   }
   position++;
   ...
}

Answer 1

As Oli Charlesworth already pointed out, instructions are of variable length on the x86 architecture. You can still write a program to do this for you, but you’ll need to parse all the instructions to properly know how long they are and where the next one starts.

I don’t understand why you want to write your own program to solve the problem, or is there something you’re not telling us? Are you only looking for a way to find the addresses of the push instructions? If so, just do this:

objdump -d another_c_program | grep push

Of course, this will also find pushl and so on. I guess you want them too, otherwise the command can be modified.