Extract and Print the .text Section Bytes

Topic Overview

The .text Section

The .text section contains the executable machine code of a program. It is read-only and mapped into memory with execute permissions. Every instruction your CPU runs from the binary lives here.

Finding and Dumping .text

To extract it manually:

1. Locate the section header table via e_shoff
2. Find the section named .text using the .shstrtab string table
3. Read sh_offset and sh_size from its section header
4. Read that many bytes from sh_offset in the file

A standard hex dump shows 16 bytes per line. For example, the classic x86-64 prologue appears as:

cCopy
Loading…

Those bytes decode to push rbp; mov rbp, rsp; sub rsp, 0x10.

For This Exercise

You will find the .text section by name and print a formatted hex dump. Disassemblers start with these raw bytes and decode instructions, and malware analysts often need to extract shellcode from .text when packers encrypt or compress it.

From Raw Bytes to Instructions

The first bytes of .text often reveal compiler and optimization choices. An unoptimized build shows a full prologue; -O2 may omit the frame pointer. Security analysts compare .text hashes before and after an update to detect unauthorized code injection. Packers may encrypt .text at rest and decrypt it at runtime, which is why extracting this section is a common unpacker first step.

Your Task

Decode a stream of x86-64 machine code one instruction at a time, for this subset (check the encodings in the Intel SDM or on felixcloutier.com):

The register number r (low 3 bits of the opcode, or a ModRM field) names a 32-bit register: 0 eax, 1 ecx, 2 edx, 3 ebx, 4 esp, 5 ebp, 6 esi, 7 edi. ModRM splits into mod (bits 7-6), reg (bits 5-3) and rm (bits 2-0); only mod = 3, register to register, is decoded.

Input

N (1 to 1024), then N bytes in hex.

Output

decoded N bytes, then one line per instruction, then instructions: K. Each line has an exact format: the spacing is fixed, so copy these C formats.

Anything else prints a line and moves on:

• An unknown byte, or a B8-BF / 89 / 8B / 83 opcode without enough bytes left: (unknown opcode 0x91 at offset 5), advancing 1 byte.
• 89 or 8B with mod != 3: (unsupported ModRM mod=0 at offset 3), advancing 2 bytes.
• 83 with mod != 3 or reg != 5: (unsupported 83 ModRM mod=3 reg=0 at offset 3), advancing 3 bytes.

Offsets are decimal.