I know we can edit opcodes in radare2's visual mode using i.
But is there any way to edit instructions directly in visual mode?
In my case, the instruction is:
jae 0x8048450
And I want change it to:
jnbe 0x8048450
Add a comment
|
2 Answers
This is called assembling - the reverse of "disassembling".
You can do so with the command wa (presumably, "write assembly"). It can be found in the Radare2 cheat sheet:
wa jnz 0x400d24
-
Thank you for answering, when i run
wa jnbe 0x8048450, radare2 writeja 0x10090882. radare2 result:Written 6 bytes (jnbe 0x8048450) = wx 0f874a840408. why?– aliDec 22, 2016 at 23:28 -
@ali: because they are the same, and – apparently – radare2 defaults to the
jnbenotation.– JongwareDec 23, 2016 at 0:02 -
But i think
jnbe 0x8048450andja 0x10090882are not same operations. I receivedSIGSEGVafter this change!– aliDec 23, 2016 at 13:36 -
That's a bit confusing. Are you talking about the difference between
jaandjnbe? Because they are exactly the same instruction (look at that web page I linked to–their codes are the same!). But the address in your examples are not the same, so it should not be surprising you get a different result. It also has nothing to do with the segfault–you changed the code, and so you probably broke something.– JongwareDec 23, 2016 at 14:30 -
I looked, thanks. Problem are addresses.
731c jae 0x8048450afterwa ja 0x8048450-->0f8718000000 ja 0x8048450and it's not true. And731c jae 0x8048450afteri+771c-->771c jae 0x8048450and it's true.wa ja 0x8048450andi+771cshould be same. am i right?– aliDec 23, 2016 at 20:25
In visual mode, you can use the A command, to launch the interactive assembler, type your opcodes, and see in real time the corresponding hex code.
You could have found this command by typing ?, to get help, in visual mode.
