3

Let's say I want to check this guys work. He says that he is getting

8d 15 c8 90 04 08       lea    0x80490c8,%edx
ba c8 90 04 08          mov    $0x80490c8,%edx

Is there an easy way with Radare to disassemble an user-provide byte-sequence like 8d 15 c8 90 04 08

  • Why not just use Capstone? – julian Apr 16 '18 at 4:09
  • 1
    yeah use rasm2 -a arch -b bits -d "bytes" – blabb Apr 16 '18 at 4:24
5

Yes, you can use the pad command from inside radare2:

[0x00000000]> pa?
|Usage: pa[ed] [hex|asm]  assemble (pa) disasm (pad) esil (pae) from hexpairs

[0x00000000]> pad 8d 15 c8 90 04 08
lea edx, [rip + 0x80490c8]

[0x00000000]> pad 8d 15 c8 90 04 08 ba c8 90 04 08
lea edx, [rip + 0x80490c8]
mov edx, 0x80490c8

Or using rasm2 utility from the radare2 toolkit:

$ rasm2 -d '8d 15 c8 90 04 08'
lea edx, [0x80490c8]
| improve this answer | |
2

use rasm2 - a x86,arm,ppc,whatever -b 16,32,64 -d "de ad d0 0d"

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.