3

Let's say I want to check this guys work. He says that he is getting

8d 15 c8 90 04 08       lea    0x80490c8,%edx
ba c8 90 04 08          mov    $0x80490c8,%edx

Is there an easy way with Radare to disassemble an user-provide byte-sequence like 8d 15 c8 90 04 08

2
  • Why not just use Capstone?
    – julian
    Commented Apr 16, 2018 at 4:09
  • 1
    yeah use rasm2 -a arch -b bits -d "bytes"
    – blabb
    Commented Apr 16, 2018 at 4:24

2 Answers 2

5

Yes, you can use the pad command from inside radare2:

[0x00000000]> pa?
|Usage: pa[ed] [hex|asm]  assemble (pa) disasm (pad) esil (pae) from hexpairs

[0x00000000]> pad 8d 15 c8 90 04 08
lea edx, [rip + 0x80490c8]

[0x00000000]> pad 8d 15 c8 90 04 08 ba c8 90 04 08
lea edx, [rip + 0x80490c8]
mov edx, 0x80490c8

Or using rasm2 utility from the radare2 toolkit:

$ rasm2 -d '8d 15 c8 90 04 08'
lea edx, [0x80490c8]
1
2

use rasm2 - a x86,arm,ppc,whatever -b 16,32,64 -d "de ad d0 0d"

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.