Extract and Print the .text Section Bytes

The .text Section

The .text section contains the executable machine code of a program. It is read-only and mapped into memory with execute permissions. Every instruction your CPU runs from the binary lives here.

Finding and Dumping .text

To extract it manually:

1. Locate the section header table via e_shoff
2. Find the section named .text using the .shstrtab string table
3. Read sh_offset and sh_size from its section header
4. Read that many bytes from sh_offset in the file

A standard hex dump shows 16 bytes per line. For example, the classic x86-64 prologue appears as:

cCopy
Loading…

Those bytes decode to push rbp; mov rbp, rsp; sub rsp, 0x10.

For This Exercise

You will find the .text section by name and print a formatted hex dump. Disassemblers start with these raw bytes and decode instructions, and malware analysts often need to extract shellcode from .text when packers encrypt or compress it.

From Raw Bytes to Instructions

The first bytes of .text often reveal compiler and optimization choices. An unoptimized build shows a full prologue; -O2 may omit the frame pointer. Security analysts compare .text hashes before and after an update to detect unauthorized code injection. Packers may encrypt .text at rest and decrypt it at runtime, which is why extracting this section is a common unpacker first step.