0

I know we can edit opcodes in radare2's visual mode using i.
But is there any way to edit instructions directly in visual mode?

In my case, instruction is jae 0x8048450,
and i want change it to jnbe 0x8048450

0

This is called assembling - the reverse of "disassembling".

You can do so with the command wa (presumably, "write assembly"). It can be found in the Radare2 cheat sheet:

wa jnz 0x400d24
  • Thank you for answering, when i run wa jnbe 0x8048450, radare2 write ja 0x10090882. radare2 result: Written 6 bytes (jnbe 0x8048450) = wx 0f874a840408. why? – ali Dec 22 '16 at 23:28
  • @ali: because they are the same, and – apparently – radare2 defaults to the jnbe notation. – usr2564301 Dec 23 '16 at 0:02
  • But i think jnbe 0x8048450 and ja 0x10090882 are not same operations. I received SIGSEGV after this change! – ali Dec 23 '16 at 13:36
  • That's a bit confusing. Are you talking about the difference between ja and jnbe? Because they are exactly the same instruction (look at that web page I linked to–their codes are the same!). But the address in your examples are not the same, so it should not be surprising you get a different result. It also has nothing to do with the segfault–you changed the code, and so you probably broke something. – usr2564301 Dec 23 '16 at 14:30
  • I looked, thanks. Problem are addresses. 731c jae 0x8048450 after wa ja 0x8048450 --> 0f8718000000 ja 0x8048450 and it's not true. And 731c jae 0x8048450 after i + 771c --> 771c jae 0x8048450 and it's true. wa ja 0x8048450 and i + 771c should be same. am i right? – ali Dec 23 '16 at 20:25
1

In visual mode, you can use the A command, to launch the interactive assembler, type your opcodes, and see in real time the corresponding hex code.

You could have found this command by typing ?, to get help, in visual mode.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.