Read instructions being executed

Question

As the title suggests, is there any way to read the machine code instructions as/after they have been executed? For example, if I had an arbitrary block of C code and I wanted to know what instructions were compiled and executed when that block was entered then would there be a way to do that? Thank you in advance for any pointers on the subject.

Edit: Some motivation as to what I'm trying to do: I want to have a program that roughly figures out how it has been compiled or what instructions it is currently running without actually needing to know how the machine code is made. I.e. I want to use the hard work that some compiler previously did in compiling a program so that I can copy and later use the machine code being executed.

Answer 1

Most debuggers have options to view the disassembly of the code you are executing.

Ex: in gdb use the disassemble command.

Answer 2

I can't tell if you're asking about doing this at runtime, or if you want to see a textfile containing the assembly code of your compiled C code.

If the former, just use a debugger (use disassemble in gdb with gcc, or the integrated debugger in Microsoft Visual Studio).

If the latter, you'll have to look up the specific commands for your compiler. With Visual Studio, for example, just use the flag /FAs; this will output the assembly code with your source code. For gcc:

gcc -c -g -Wa,-a,-ad foo.c > foo.lst

Answer 3

Almost every debugger can do this.

For gdb, a useful trick to remember is: display/i $pc

Do that once, and then set a breakpoint on a function, the step through the function with stepi and nexti.

The instruction at the PC will be automatically displayed each time.

Ross-Harveys-MacBook-Pro:so ross$ cat > deb.c
int main(void) { return (long)main + 0x123; }
Ross-Harveys-MacBook-Pro:so ross$ cc -O deb.c
Ross-Harveys-MacBook-Pro:so ross$ gdb -q a.out
Reading symbols for shared libraries .. done
(gdb) break main
Breakpoint 1 at 0x100000f30
(gdb) display/i $pc
(gdb) r
Starting program: /Users/ross/so/a.out 
Reading symbols for shared libraries +. done

Breakpoint 1, 0x0000000100000f30 in main ()
1: x/i $pc  0x100000f30 <main+4>:   lea    -0xb(%rip),%rax        # 0x100000f2c <main>
(gdb) stepi
0x0000000100000f37 in main ()
1: x/i $pc  0x100000f37 <main+11>:  add    $0x123,%eax
(gdb) stepi
0x0000000100000f3c in main ()
1: x/i $pc  0x100000f3c <main+16>:  leaveq 

Answer 4

If you want to know what the execution path was for a particular function, perhaps some processors have such a feature, but generally no. Now what you can do is run in an emulator and modify the emulator to print out the addresses of the fetches or reads or whatever.

If this is just a disassembly question using the gcc/binutils tools objdump -D filename > out.list and not bother executing or using a debugger

Answer 5

Little-known fact: GDB has a curses interface built in.

Use gdbtui or gdb,Ctrl+X,Ctrl+A to enter, then Ctrl+X,2 to start showing assembly and source together. The current instruction is highlighted, and you can navigate using the arrow keys.