4

By that I mean is it possible to write a program in C, compile it and then see what it looks like in ones and zeros?

Isaiah
  • 4,201
  • 4
  • 27
  • 40
  • yeah.... just open your compiled program with a hexeditor... people actually do do this to reverse engineer stuff*. – mpen Aug 28 '09 at 02:40
  • 9
    The sad thing is, I actually do have to stare at hexadecimal memory dumps to debug certain kinds of crash at my job. My coworkers call it "reading the Matrix," whereas I think of it as "time for an Aspirin." – Crashworks Aug 28 '09 at 03:20

4 Answers4

16

You can use xxd:

xxd -b filename

C:\opt\bin> xxd -b ctags.exe | head
0000000: 01001101 01011010 10010000 00000000 00000011 00000000  MZ....
0000006: 00000000 00000000 00000100 00000000 00000000 00000000  ......
000000c: 11111111 11111111 00000000 00000000 10111000 00000000  ......
0000012: 00000000 00000000 00000000 00000000 00000000 00000000  ......
0000018: 01000000 00000000 00000000 00000000 00000000 00000000  @.....
000001e: 00000000 00000000 00000000 00000000 00000000 00000000  ......
0000024: 00000000 00000000 00000000 00000000 00000000 00000000  ......
000002a: 00000000 00000000 00000000 00000000 00000000 00000000  ......
0000030: 00000000 00000000 00000000 00000000 00000000 00000000  ......
0000036: 00000000 00000000 00000000 00000000 00000000 00000000  ......

Just to make this a little more programming related:

#include <stdio.h>
#include <stdlib.h>

const char *lookup[] = {
   /*  0       1       2       3       4       5       6       7 */
    "0000", "0001", "0010", "0011", "0100", "0101", "0110", "0111",
   /*  8       9       A       B       C       D       E       F */
    "1000", "1001", "1010", "1011", "1100", "1101", "1110", "1111",
};

int main(int argc, char *argv[]) {
    FILE *fin;
    int c;
    size_t bytes_read = 0;

    if ( argc != 2 ) {
        fputs("No filename provided", stderr);
        exit(EXIT_FAILURE);
    }

    fin = fopen(argv[1], "rb");
    if ( !fin ) {
        fprintf(stderr, "Cannot open %s\n", argv[1]);
        exit(EXIT_FAILURE);
    }

    while ( EOF != (c = fgetc(fin)) ) {
        printf("%s", lookup[ (c & 0xf0) >> 4 ]);
        printf("%s", lookup[ (c & 0x0f) ]);

        bytes_read += 1;
        if ( bytes_read % 9 == 0 ) {
            puts("");
        }
    }

    fclose(fin);

    return EXIT_SUCCESS;
}

Output:

C:\Temp> binary.exe c:\opt\bin\ctags.exe | head
010011010101101010010000000000000000001100000000000000000000000000000100
000000000000000000000000111111111111111100000000000000001011100000000000
000000000000000000000000000000000000000000000000010000000000000000000000
000000000000000000000000000000000000000000000000000000000000000000000000
000000000000000000000000000000000000000000000000000000000000000000000000
000000000000000000000000000000000000000000000000000000000000000000000000
000000000000000000000000000000000000000000000000111000000000000000000000
000000000000111000011111101110100000111000000000101101000000100111001101
001000011011100000000001010011001100110100100001010101000110100001101001
011100110010000001110000011100100110111101100111011100100110000101101101
Sinan Ünür
  • 116,958
  • 15
  • 196
  • 339
4

Use hexdump or a hex editor to view a binary in hexadecimal bytes.

Hexadecimal is simply a more compact way to view binary. Every hexadecimal digit (0-F) represents four bits. For example, 0xF in decimal is 15 and in binary is 1111.

Andrew Keeton
  • 22,195
  • 6
  • 45
  • 72
1

You mean that you can't do compilation and translate the opcodes to binary in your head?

Actually, one of the computers I learned to program on had to have the bootstrap code toggled in via front panel switches. You needed to enter enough code to get it to boot the loader off the 8" floppy drive and load up the OS. You can see a picture of one here. I really did need to know the binary for the boot loader opcodes.

tvanfosson
  • 524,688
  • 99
  • 697
  • 795
  • +1 for having used an 8" floppy. Reminds me of the few days I spent with some water-cooled IBM system with a whopping 64K memory in a giant cabinet. – Sinan Ünür Aug 28 '09 at 03:14
  • Out of curiousity, how much code did that end up being? A few opcodes, a few dozen, a few hundred? – Brooks Moses Aug 28 '09 at 03:16
  • @Brooks -- I wish I could remember. I don't think that it could have been very many. I'm pretty sure that I could have toggled in my entire program and skipped the floppy though. Debugging was done by stepping through the memory space and looking at the red lights indicating 1/0s to check values. Got my first anti-piracy lecture when I copied the OS onto my own floppy so I could have both OS and my program on one and not have to switch. **That** made a lasting impression. Let's just say that the licensing department and I get on pretty well now. – tvanfosson Aug 28 '09 at 10:53
0

Sure it's possible. You could write your own viewer using the information in this post.

Community
  • 1
  • 1
Paul A. Hoadley
  • 1,518
  • 1
  • 13
  • 17