4

Disassembling is great but when trying to re-assemble to opcode it gives different results each time. Example:

C:\>rasm2 -a x86 -b 64 -d "48898D80FEFFFF"  
mov qword [rbp - 0x180], rcx  
C:\>rasm2 -a x86 -b 64 "mov qword [rbp - 0x180], rcx"  
49898d80feffff  

See the difference? The first byte has been changed and it keep the same behavior each time. Another issue is, I couldn't get it to assemble this instruction with 8 bytes it only gives me 4 bytes:

C:\>rasm2 -a x86 -b 64 -d "C7458C0000803F"  
mov dword [rbp - 0x74], 0x3f800000  
C:\>rasm2 -a x86 -b 64 "mov dword [rbp - 0x74], 0x3f800000"  
41c67400

But when I remove the the bits flag and set the registers to 32 bit it gives me the correct opcodes!

C:\>rasm2 -a x86 "mov dword [ebp - 0x74], 0x3f800000"  
c7458c0000803f

Why is it doing this and what did I do wrong?

GitHub issue link for future reference.

  • rasm2 -v gives what? are you using the latest version? – Paweł Łukasik Apr 17 '18 at 15:43
  • @PawełŁukasik rasm2 2.6.0-git 1 @ windows-x86-64 git. I'm pretty sure it's the latest version. – Cyb3r Apr 17 '18 at 15:52
  • I'm running the first two commands and have the same output (on Ubuntu though). I'll check windows later – Paweł Łukasik Apr 17 '18 at 15:55
  • 1
    I've asked core developers -- it's known issue. Probably will be resolved soon. – Alex Bender Apr 20 '18 at 19:25
  • 1
    @IgorSkochinsky Done. – Cyb3r Apr 29 '18 at 20:43
2

This was a bug, and the issue that was opened by OP is now fixed on radare2 Master and on the latest releases.

$ rasm2 -a x86 -b 64 -d "48898D80FEFFFF"
mov qword [rbp - 0x180], rcx
$ rasm2 -a x86 -b 64 "mov qword [rbp - 0x180], rcx"
48898d80feffff

$ rasm2 -a x86 -b 64 -d "C7458C0000803F"
mov dword [rbp - 0x74], 0x3f800000
$ rasm2 -a x86 -b 64 "mov dword [rbp - 0x74], 0x3f800000"
c7458c0000803f

The fix can be found in this link.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.