Linux

Every text on x86 assembly teaches the same function prologue: push %rbp mov %rsp, %rbp Save the old frame pointer, point it at the current stack top, and now you have a stable base to address locals and walk the stack. It is in every textbook, every course, every disassembly screenshot from 2010. I recently disassembled every executable on my Linux machine, all 2,749 of them, and counted how each function begins....

I keep asking small questions about binaries and never having a quick way to answer them. How big is the average function in this program? How much of it is cold error handling that almost never runs? Does it use SIMD at all? Was it built with the stack protector? readelf, objdump and nm all know pieces of the answer, but stitching them together by hand gets old fast. So I wrote a tool for it: machine-code-analyzer....