2

Let's take an example of a 64 bits elf executable disassembled with pdf command in radare2:

...
0x00400ac0      0f859c000000   jne 0x400b62
...
0x00400b62      90             nop
...

I want to put a label on 0x00400b62 line. It is called a "flag" in radare2. So i type:

xxxxxx> f mylabel @ 0x00400b62

This is great because i can see my flag when i disassemble again with pdf:

;-- mylabel:
0x00400b62      90       nop

But i still see 0x400b62 in jump instructions:

0x00400ac0      0f859c000000   jne 0x400b62

I would like to see:

0x00400ac0      0f859c000000   jne mylabel

How can i do that ?

Thanks a lot

1 Answer 1

5

You should use a flag name which is separated by a dot. This is intended since registers and other stuff are also flags and to avoid overriding and confusion.

For example, instead of this:

[0x140008f9c]> f mylabel @ 0x140008fde
[0x140008f9c]> pdf
...
|           0x140008fd5      85c0           test eax, eax
|       ,=< 0x140008fd7      7505           jne 0x140008fde
|       |   0x140008fd9      66895c2470     mov word [local_70h], bx
|       |   ;-- mylabel:
|       `-> 0x140008fde      3d04010000     cmp eax, 0x104             ; 260
|       ,=< 0x140008fe3      7511           jne 0x140008ff6
...

Name it like this (loc.mylabel):

[0x140008f9c]> fr mylabel loc.mylabel
[0x140008f9c]> pdf
...
|           0x140008fd5      85c0           test eax, eax
|       ,=< 0x140008fd7      7505           jne loc.mylabel
|       |   0x140008fd9      66895c2470     mov word [local_70h], bx
|       |   ;-- loc.mylabel:
|       `-> 0x140008fde      3d04010000     cmp eax, 0x104             ; 260
|       ,=< 0x140008fe3      7511           jne 0x140008ff6
...
1
  • Where is this behaviour documented? Would like to learn more about the rationale behind it. I can't find anything in the official book.
    – Jet Blue
    Commented Oct 1, 2020 at 6:25

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.