Working with 16bit offsets and segments in Radare2

Question

I have a simple DOS COM program which I want to analyse using Radare2:

  USE16
  ORG 100h

  mov ax, cs
  dec ax
  mov ds, ax

  mov dx, message+10h
  mov ah, 9
  int 21h
  ret

message:   db "Hello there!$"

(Use yasm or echo "jMhIjti6HQG0Cc0hw0hlbGxvIHRoZXJlISQ=" | base64 -d > test.com to compile it to a binary.)

When I load the binary using r2 -b16 test.com radare shows that I'm at 0000:0000.

How can I tell radare that the actual program address should be 0000:0100?

Also how can I tell radare that the offset loaded into the dx register points to message? In other words, can I tell radare that dx is an offset using a segment that starts at 0000:0100 - 0x10?

Answer 1

You can use -m 0x100 to load the binary at a specific address, as can be seen in r2 -h output:

-m [addr] map file at given address (loadaddr)

So you can do something like this:

$ r2 -m 0x100 -b 16 test.com

[0000:0100]> aa
[x] Analyze all flags starting with sym. and entry0 (aa)
[0000:0100]> pdf
╭ (fcn) fcn.00000100 13
│   fcn.00000100 ();
│           0000:0100      8cc8           mov ax, cs
│           0000:0102      48             dec ax
│           0000:0103      8ed8           mov ds, ax
│           0000:0105      ba1d01         mov dx, 0x11d                ; 285
│           0000:0108      b409           mov ah, 9
│           0000:010a      cd21           int 0x21                     ; '!'
╰           0000:010c      c3             ret

Regarding your second question, the bytes that interpreted as mov dx, 0x11d are ba1d01. As you can see, 0x01d1 is hard coded so r2 won't add message + to it.

You can create a flag using f str.message 13 @ 0x10d but it would probably not be helpful in your case.