4

Disassembling is great but when trying to re-assemble to opcode it gives different results each time. Example:

C:\>rasm2 -a x86 -b 64 -d "48898D80FEFFFF"  
mov qword [rbp - 0x180], rcx  
C:\>rasm2 -a x86 -b 64 "mov qword [rbp - 0x180], rcx"  
49898d80feffff  

See the difference? The first byte has been changed and it keep the same behavior each time. Another issue is, I couldn't get it to assemble this instruction with 8 bytes it only gives me 4 bytes:

C:\>rasm2 -a x86 -b 64 -d "C7458C0000803F"  
mov dword [rbp - 0x74], 0x3f800000  
C:\>rasm2 -a x86 -b 64 "mov dword [rbp - 0x74], 0x3f800000"  
41c67400

But when I remove the the bits flag and set the registers to 32 bit it gives me the correct opcodes!

C:\>rasm2 -a x86 "mov dword [ebp - 0x74], 0x3f800000"  
c7458c0000803f

Why is it doing this and what did I do wrong?

GitHub issue link for future reference.

8
  • rasm2 -v gives what? are you using the latest version? Apr 17, 2018 at 15:43
  • @PawełŁukasik rasm2 2.6.0-git 1 @ windows-x86-64 git. I'm pretty sure it's the latest version.
    – Cyb3r
    Apr 17, 2018 at 15:52
  • I'm running the first two commands and have the same output (on Ubuntu though). I'll check windows later Apr 17, 2018 at 15:55
  • 1
    I've asked core developers -- it's known issue. Probably will be resolved soon. Apr 20, 2018 at 19:25
  • 1
    @IgorSkochinsky Done.
    – Cyb3r
    Apr 29, 2018 at 20:43

1 Answer 1

2

This was a bug, and the issue that was opened by OP is now fixed on radare2 Master and on the latest releases.

$ rasm2 -a x86 -b 64 -d "48898D80FEFFFF"
mov qword [rbp - 0x180], rcx
$ rasm2 -a x86 -b 64 "mov qword [rbp - 0x180], rcx"
48898d80feffff

$ rasm2 -a x86 -b 64 -d "C7458C0000803F"
mov dword [rbp - 0x74], 0x3f800000
$ rasm2 -a x86 -b 64 "mov dword [rbp - 0x74], 0x3f800000"
c7458c0000803f

The fix can be found in this link.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.