300-215 Question 198
Select 2During a forensic investigation of a suspicious binary file on a Linux server, you are tasked with extracting the file's assembly code to analyze its behavior. Which of the following commands or tools would allow you to disassemble the binary and interpret its contents?
- A
objdump -d <binary_file>
- B
strings <binary_file>
- C
readelf -a <binary_file>
- D
python -m dis <binary_file>
- E
bash <binary_file>
Show answer and explanation
Correct answers: A, C
Explanation
In forensic investigations, tools like objdump and readelf are critical for interpreting and analyzing binary files. The 'objdump -d' command disassembles the binary, providing assembly code for analysis, while 'readelf -a' offers comprehensive information about ELF binary files. Other tools like 'strings', 'python -m dis', and 'bash' have different purposes and do not serve the specific need of disassembling a binary file for assembly code analysis.
- A. Correct.
Correct: The '-d' option in objdump disassembles the binary file, enabling you to view its assembly code for analysis.
- B. Incorrect.
Incorrect: The 'strings' command extracts printable strings from a binary file but does not provide disassembled assembly code.
- C. Correct.
Correct: The 'readelf -a' command provides detailed information about the ELF (Executable and Linkable Format) file, including sections that can aid in understanding the structure of the binary.
- D. Incorrect.
Incorrect: The 'python -m dis' command disassembles Python bytecode, not binary executables, so it is not applicable for analyzing non-Python binaries.
- E. Incorrect.
Incorrect: Running a binary file directly with bash will not disassemble it or provide any useful forensic insights; it would simply attempt to execute it, which can be risky.