[lldb-dev] How to disassemble a section (python api)?

[Greg Clayton via lldb-dev]

Currently you can't disassemble a section, nor would you probably want to since there are padding bytes in between functions.

The easiest way is to get all SBSymbol objects and ask each one for the instructions if they are code:

(lldb) script
Python Interactive Interpreter. To exit, type 'quit()', 'exit()' or Ctrl-D.
>>> module = lldb.target.module['a.out']
>>> num_symbols = module.GetNumSymbols()
>>> for i in range(num_symbols):
...     symbol = module.GetSymbolAtIndex(i)
...     if symbol.GetType() == lldb.eSymbolTypeCode:
...         print symbol
...         instructions = symbol.GetInstructions(lldb.target)
...         for inst in instructions:
...             print inst
... 
id = {0x00000004}, range = [0x0000000100000f00-0x0000000100000f20), name="foo(float)", mangled="_Z3foof"
a.out[0x100000f00]: pushq  %rbp
a.out[0x100000f01]: movq   %rsp, %rbp
a.out[0x100000f04]: movss  %xmm0, -0x4(%rbp)
a.out[0x100000f09]: cvttss2si -0x4(%rbp), %eax
a.out[0x100000f0e]: shll   $0x1, %eax
a.out[0x100000f11]: popq   %rbp
a.out[0x100000f12]: retq   
a.out[0x100000f13]: nopw   %cs:(%rax,%rax)
id = {0x00000008}, range = [0x0000000100000f20-0x0000000100000f40), name="foo(int)", mangled="_Z3fooi"
a.out[0x100000f20]: pushq  %rbp
a.out[0x100000f21]: movq   %rsp, %rbp
a.out[0x100000f24]: movl   %edi, -0x4(%rbp)
a.out[0x100000f27]: movl   -0x4(%rbp), %edi
a.out[0x100000f2a]: shll   $0x2, %edi
a.out[0x100000f2d]: movl   %edi, %eax
a.out[0x100000f2f]: popq   %rbp
a.out[0x100000f30]: retq   
a.out[0x100000f31]: nopw   %cs:(%rax,%rax)
id = {0x0000000c}, range = [0x0000000100000f40-0x0000000100000f90), name="main"
a.out[0x100000f40]: pushq  %rbp
a.out[0x100000f41]: movq   %rsp, %rbp
a.out[0x100000f44]: subq   $0x30, %rsp
a.out[0x100000f48]: movss  0x40(%rip), %xmm0
a.out[0x100000f50]: movl   $0x0, -0x4(%rbp)
a.out[0x100000f57]: movl   %edi, -0x8(%rbp)
a.out[0x100000f5a]: movq   %rsi, -0x10(%rbp)
a.out[0x100000f5e]: movq   %rdx, -0x18(%rbp)
a.out[0x100000f62]: movss  %xmm0, -0x1c(%rbp)
a.out[0x100000f67]: movl   $0x4d2, -0x20(%rbp)
a.out[0x100000f6e]: movss  -0x1c(%rbp), %xmm0
a.out[0x100000f73]: callq  0x100000f00
a.out[0x100000f78]: movl   -0x20(%rbp), %edi
a.out[0x100000f7b]: movl   %eax, -0x24(%rbp)
a.out[0x100000f7e]: callq  0x100000f20
a.out[0x100000f83]: movl   -0x24(%rbp), %edi
a.out[0x100000f86]: addl   %eax, %edi
a.out[0x100000f88]: movl   %edi, %eax
a.out[0x100000f8a]: addq   $0x30, %rsp
a.out[0x100000f8e]: popq   %rbp
a.out[0x100000f8f]: retq   
>>> 


If you want the symbols only from a specific section you can get the section from the symbol's start address and compare that to a given name:

section_name = ".text"
for i in range(num_symbols):
    symbol = module.GetSymbolAtIndex(i)
    if symbol.GetType() == lldb.eSymbolTypeCode:
        symbol_section = symbol.GetStartAddress().GetSection()
        if symbol_section.GetName() == section_name:
            print symbol
            instructions = symbol.GetInstructions(lldb.target)
            for inst in instructions:
                print inst





> On Nov 12, 2015, at 2:13 PM, kwadwo amankwa via lldb-dev <lldb-dev at lists.llvm.org> wrote:
> 
> Hi
> I'm writing a small script and need to disassemble a whole section , what would be the correct way to go about it ?
> 
> Cheers Que,
> _______________________________________________
> lldb-dev mailing list
> lldb-dev at lists.llvm.org
> http://lists.llvm.org/cgi-bin/mailman/listinfo/lldb-dev