Printing bytecode in bytes given a string of assembly for Radare to disassemble?

Question

Megabeets determined in this answer that depending on asm.bits Radare may show either

lea edx, [0x80490c8]         (asm.bits=32)
lea edx, [rip + 0x80490c8]   (asm.bits=64)

If I want to see what the byte-code would look like for lea edx, [0x80490c8] in x86_64, how would I go about getting that?

Answer 1

Actually, there is no lea edx, [0x80490c8] for 64-bits addressing modes. Since, afaik, in all 64-bits addressing modes lea is a register relative opcode.

LEA - Load Effective Address
Computes the effective address of the second operand (the source operand) and stores it in the first operand (destination operand). The source operand is a memory address (offset part) specified with one of the processors addressing modes; the destination operand is a general-purpose register.

Source: Intel® 64 and IA-32 Architectures Software Developer’s Manual

---

Anyway, if you want to know the bytecodes that represent an instruction using radare2 you can use the pa command.

In 32-bits mode it'll look like this:

[0x00000000]> e asm.bits=32
[0x00000000]> pa lea edx, [0x80490c8]
8d15c8900408
[0x00000000]> pad 8d15c8900408
lea edx, [0x80490c8]

In 64-bits mode it'll look like this:

[0x00000000]> e asm.bits=64
[0x00000000]> pa lea edx, [0x80490c8]
488d15c8900408
[0x00000000]> pad 488d15c8900408
lea rdx, [rip + 0x80490c8]

You can see that radare2 knows that lea edx, [0x80490c8] can't be expressed in 64bits so it uses a RIP relative expression.

Answer 2

32

radare2  -a x86 -b 32 -c "wa lea edx,[0x80490c8] ; pd 1 ; exit()" -
Written 6 byte(s) (lea edx,[0x80490c8]) = wx 8d15c8900408
            0x00000000      8d15c8900408   lea edx, [0x80490c8]
 -- Are you a wizard?
[0x00000000]> q

64

radare2  -a x86 -b 64 -c "wa lea edx,[rip+0x80490c8] ; pd 1 ; exit()" -
Written 7 byte(s) (lea edx,[rip+0x80490c8]) = wx 488d98c8900408
            0x00000000      488d98c89004.  lea rbx, [rax + 0x80490c8]
 -- SHALL WE PLAY A GAME?
[0x00000000]> q