Binary Inspection with objdump and nm

Binaries Still Carry Names

After gcc -g file.c -o file, your C source lives as machine code in ELF sections. nm lists symbols: T for text (functions), D for initialized data, B for zero-initialized BSS, U for imports the linker must resolve. Static functions show up as lowercase t, hidden from other translation units.

objdump Shows the Actual Instructions

bashCopy
Loading…

• nm answers "is helper_function defined and how big is it?"
• objdump -d disassembles .text so you see call targets and prologues
• objdump -t dumps the full symbol table with VMA addresses

This is what engineers reach for when the linker reports duplicate symbols or when you need to verify the optimizer kept a function.

For this exercise, you will compile a program with globals, statics, and multiple functions, then inspect it with nm and objdump. This task asks you to map C declarations to section placement, because malware analysis, kernel debugging, and "undefined reference" hunts all start at this symbol table.

Keep the relevant man page, ABI doc, or Rust reference chapter open while you work. When your output disagrees with the reference implementation on the same machine, the mismatch is usually an alignment rule, an off-by-one terminator, or a register slot you misread in GDB.