1

Megabeets determined in this answer that depending on asm.bits Radare may show either

lea edx, [0x80490c8]         (asm.bits=32)
lea edx, [rip + 0x80490c8]   (asm.bits=64)

If I want to see what the byte-code would look like for lea edx, [0x80490c8] in x86_64, how would I go about getting that?

2

Actually, there is no lea edx, [0x80490c8] for 64-bits addressing modes. Since, afaik, in all 64-bits addressing modes lea is a register relative opcode.

LEA - Load Effective Address
Computes the effective address of the second operand (the source operand) and stores it in the first operand (destination operand). The source operand is a memory address (offset part) specified with one of the processors addressing modes; the destination operand is a general-purpose register.

Source: Intel® 64 and IA-32 Architectures Software Developer’s Manual


Anyway, if you want to know the bytecodes that represent an instruction using radare2 you can use the pa command.

In 32-bits mode it'll look like this:

[0x00000000]> e asm.bits=32
[0x00000000]> pa lea edx, [0x80490c8]
8d15c8900408
[0x00000000]> pad 8d15c8900408
lea edx, [0x80490c8]

In 64-bits mode it'll look like this:

[0x00000000]> e asm.bits=64
[0x00000000]> pa lea edx, [0x80490c8]
488d15c8900408
[0x00000000]> pad 488d15c8900408
lea rdx, [rip + 0x80490c8]

You can see that radare2 knows that lea edx, [0x80490c8] can't be expressed in 64bits so it uses a RIP relative expression.

0

32

radare2  -a x86 -b 32 -c "wa lea edx,[0x80490c8] ; pd 1 ; exit()" -
Written 6 byte(s) (lea edx,[0x80490c8]) = wx 8d15c8900408
            0x00000000      8d15c8900408   lea edx, [0x80490c8]
 -- Are you a wizard?
[0x00000000]> q

64

radare2  -a x86 -b 64 -c "wa lea edx,[rip+0x80490c8] ; pd 1 ; exit()" -
Written 7 byte(s) (lea edx,[rip+0x80490c8]) = wx 488d98c8900408
            0x00000000      488d98c89004.  lea rbx, [rax + 0x80490c8]
 -- SHALL WE PLAY A GAME?
[0x00000000]> q

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.