Differences between objdump and xxd

Question

I am trying to find a call function in a binary file, so I tried this:

1. Compile my code (in C),
2. Use the command: mips-mti-linux-gnu-objdump -d myapp.elf> objdump.txt
3. My function in objdump.txt file: 9d003350: 42000828 myfunction 0x1

Now, I want to identify this function in myapp.bin when reading this from memory. But, I get this: 28080042.

I tried to use the command: xxd -ps myapp.bin> xxd.txt Just can find: 28080042.

Is it possible to do that?

Answer 1

That's an endianness conflict. objdump and xxd are giving you the same bytes, they're just using different endianness.

Actual bytes in order:
    28 08 00 42
Big endian value:
    28 08 00 42
Little endian value:
    42 00 08 28

xxd -p will print out the individual bytes in the file in the order in which they exist.

objdump is disassembling it, it knows that the bytes belong in groups of 4, and it's interpreting them as little-endian.

xxd can print in little-endian order, using the -e flag (with a default grouping of 4 bytes, use the -g flag to change the number of bytes per group). However, this is incompatible with the -p flag, because the -p flag ignores any grouping.

objdump can be made to print in big-endian order, using the -EB flag, however, this will affect what instructions it reports.