radare2 disassembles an instruction in the following way (binary here):
0x0040425f 0f847b020000 je 0x4044e0
Why is giving
rasm2 different result?
rasm2 -a x86 -b 64 -d '0f847b020000' je 0x281
Reverse Engineering Stack Exchange is a question and answer site for researchers and developers who explore the principles of a system through analysis of its structure, function, and operation. It only takes a minute to sign up.Sign up to join this community
I don't think it is a different result, only a different representation.
radare2 output tells you at which absolute address will the jump take you (in this case
0x004044e0), while the
rasm2 output tells you how far from the current address (in this case
0x0040425f) will the jump take you.
To make it more clear: Your current instruction starts at address
0x0040425f, while your destination address is
0x004044e0. If you substitute the two addresses you get:
0x004044e0 - 0x0040425f = 0x00000281, which is the parameter to the jump in the
Also, the opcode
0x0F 0x84 stands for
JE rel16/rel32 and since you haven't specified at which address your instruction
0f847b020000 resides the
rasm2 tool is correctly telling you that it is
0x281 bytes from wherever the instruction is:
parameter_value(0x0000027b) + instruction_length(0x06) = 0x00000281