disassemble command
Disassembles a specified function or a function fragment.
Syntax
disassemble [Function]
disassemble [Address]
disassemble [Start],[End]
disassemble [Function],+[Length]
disassemble [Address],+[Length]
disassemble /m [...]
disassemble /r [...]
Parameters
- Function
- Specifies the function to disassemble. If specified, the disassemble command will produce the disassembly output of the entire function.
- Address
- Specifies the address inside a function to disassemble. Note that when only one address is specified, this command will disassemble the entire function that includes the given address, including the instructions above it.
- Start/End
- Specifies starting and ending addresses to disassemble. If this form is used, the command won't disassemble the entire function, but only the instructions between the starting and ending addresses.
- Length
- Specifies the amount of bytes to disassemble starting from the given address or function.
- /m
- When this option is specified, the disassemble command will show the source lines that correspond to the disassembled instructions.
- /r
- When this option is specified, the disassemble command will show the raw byte values of all disassembled instructions.
Remarks
The default disassembly style used by GDB is the AT&T style (e.g. mov 0xc(%ebp),%eax) that can be confusing for Windows users. To switch to the Intel disassembly style (e.g. mov eax, DWORD PTR [ebp+0xc]) use the set disassembly-flavor command.
Note that the disassemble command only works for the code inside functions. If you want to disassemble memory outside any known function, use the x/i variant of the x command.
Examples
We will show several examples of the disassemble command based on the following example:
{
return a + b;
}
int main()
{
return func(1, 2);
}
We will compile this file without optimization and run several variants of the disassemble command to display the contents of both functions.
Breakpoint 1 at 0x8048400: file test.c, line 8.
(gdb) run
Starting program: /home/bazis/test
Breakpoint 1, main () at test.c:8
8 return func(1, 2);
(gdb) disassemble
Dump of assembler code for function main:
0x080483fa <+0>: push %ebp
0x080483fb <+1>: mov %esp,%ebp
0x080483fd <+3>: sub $0x8,%esp
=> 0x08048400 <+6>: movl $0x2,0x4(%esp)
0x08048408 <+14>: movl $0x1,(%esp)
0x0804840f <+21>: call 0x80483ed <func>
0x08048414 <+26>: leave
0x08048415 <+27>: ret
End of assembler dump.
(gdb) disassemble func
Dump of assembler code for function func:
0x080483ed <+0>: push %ebp
0x080483ee <+1>: mov %esp,%ebp
0x080483f0 <+3>: mov 0xc(%ebp),%eax
0x080483f3 <+6>: mov 0x8(%ebp),%edx
0x080483f6 <+9>: add %edx,%eax
0x080483f8 <+11>: pop %ebp
0x080483f9 <+12>: ret
End of assembler dump.
(gdb) disassemble func,+6
Dump of assembler code from 0x80483ed to 0x80483f3:
0x080483ed <func+0>: push %ebp
0x080483ee <func+1>: mov %esp,%ebp
0x080483f0 <func+3>: mov 0xc(%ebp),%eax
End of assembler dump.
(gdb) disassemble func+3,func+7
Dump of assembler code from 0x80483f0 to 0x80483f4:
0x080483f0 <func+3>: mov 0xc(%ebp),%eax
0x080483f3 <func+6>: mov 0x8(%ebp),%edx
End of assembler dump.
(gdb) disassemble 0x80483f0
Dump of assembler code for function func:
0x080483ed <+0>: push %ebp
0x080483ee <+1>: mov %esp,%ebp
0x080483f0 <+3>: mov 0xc(%ebp),%eax
0x080483f3 <+6>: mov 0x8(%ebp),%edx
0x080483f6 <+9>: add %edx,%eax
0x080483f8 <+11>: pop %ebp
0x080483f9 <+12>: ret
End of assembler dump.
(gdb) disassemble /m func
Dump of assembler code for function func:
2 {
0x080483ed <+0>: push %ebp
0x080483ee <+1>: mov %esp,%ebp
3 return a + b;
0x080483f0 <+3>: mov 0xc(%ebp),%eax
0x080483f3 <+6>: mov 0x8(%ebp),%edx
0x080483f6 <+9>: add %edx,%eax
4 }
0x080483f8 <+11>: pop %ebp
0x080483f9 <+12>: ret
End of assembler dump.
(gdb) disassemble /r func
Dump of assembler code for function func:
0x080483ed <+0>: 55 push %ebp
0x080483ee <+1>: 89 e5 mov %esp,%ebp
0x080483f0 <+3>: 8b 45 0c mov 0xc(%ebp),%eax
0x080483f3 <+6>: 8b 55 08 mov 0x8(%ebp),%edx
0x080483f6 <+9>: 01 d0 add %edx,%eax
0x080483f8 <+11>: 5d pop %ebp
0x080483f9 <+12>: c3 ret
End of assembler dump.
Common errors
If you try using the disassemble command to disassemble code outside any known function, it will fail. Instead use the x/i command. Here's an example of disassembling a buffer containing a copy of a function:
Temporary breakpoint 1 at 0x8048463: file test2.c, line 8.
Starting program: /home/bazis/test2
Temporary breakpoint 1, main () at test2.c:8
8 void *pCopyOfFunction = malloc(512);
(gdb) next
9 memcpy(pCopyOfFunction, func, 512);
(gdb) next
10 return func(1, 2);
(gdb) disassemble pCopyOfFunction
No function contains specified address.
(gdb) x/5i pCopyOfFunction
0x804b008: push %ebp
0x804b009: mov %esp,%ebp
0x804b00b: mov 0xc(%ebp),%eax
0x804b00e: mov 0x8(%ebp),%edx
0x804b011: add %edx,%eax
Compatibility with VisualGDB
It is recommended to use the Debug->Windows->Disassembly window in Visual Studio instead of using the disassemble command explicitly. VisualGDB will issue the disassemble command automatically, parse its output and display it in a user-friendly way. Nonetheless you can run this command manually via the GDB Session window.