1

I am disassembling a binary with radare2 and I see some lines like this:

|  0x004007f1   488b05981820.  mov rax, qword [0x00602090] ; 0x602090:8]=0x400c60

I do not understand, what are the addresses 0x00602090 or 0x400c60 ?

What are the differences between the two ?

4

The difference is that the first address, 0x00602090 is the location from where the value will be loaded into the rax register. The second one, 0x400c60 is what is located in that memory location. r2 is giving you hints about the actual result might be in the comments. It also informs you that 8 byte will be used for the operation with the :8 suffix.

So it looks like that at address 0x602090 there's a 8-byte value stored that constitutes as an address 0x400c60.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.