-1

radare2 disassembles an instruction in the following way (binary here):

0x0040425f 0f847b020000   je 0x4044e0

Why is giving rasm2 different result?

rasm2 -a x86 -b 64 -d '0f847b020000'
je 0x281
  • Please give some reasons why you downvoted my question. – robert Feb 18 '16 at 22:53
  • I am just curious. Why was this downvoted? – robert Feb 22 '16 at 6:13
5
rasm2 -d -o 0x40425f 0f847b020000
je 0x4044e0
3

I don't think it is a different result, only a different representation. The radare2 output tells you at which absolute address will the jump take you (in this case 0x004044e0), while the rasm2 output tells you how far from the current address (in this case 0x0040425f) will the jump take you.

To make it more clear: Your current instruction starts at address 0x0040425f, while your destination address is 0x004044e0. If you substitute the two addresses you get: 0x004044e0 - 0x0040425f = 0x00000281, which is the parameter to the jump in the rasm2 tool.

Also, the opcode 0x0F 0x84 stands for JE rel16/rel32 and since you haven't specified at which address your instruction 0f847b020000 resides the rasm2 tool is correctly telling you that it is 0x281 bytes from wherever the instruction is: parameter_value(0x0000027b) + instruction_length(0x06) = 0x00000281

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.