What does the 3 columns in the radare2 visual mode represent?
The first one is an address of the instruction, then opcodes followed by mnemonic. On the far left you have also some arrows indicating jumps and on the far right there are comments.
May I know how the command below:
wa je 0x400976 @0x00400968
changes 760c to 740c and jne 0x400976 to je 0x400976?
wa command, which you could check by requesting help in r2, is a command that writes the opcode of the provided mnemonic.
| wa[?] push ebp write opcode, separated by ';' (use '"' around the command)
wa je 0x400976 @0x00400968 will write the opcodes for the
je 0x400976 at the address of
And actually it changes from
750c, and that is the opcode of the jump-not-equal with the offset of
0xC bytes. You requested (by issuing the command
wa) to write on that spot the jump-if-equal and the opcode of this is
74. The offset stays the same.
Also, what does that accomplish? Does it just bypass the function
It changes the condition so from now on the jump will be taken when the strings that are being compared (@
0x400961) are equal and not taken if they are different. This also happens to the string being printed at offset
Apart from the first question this is nor really radare2 specific stuff. It looks like you should start with some basic assembly and/or RE topics/tutorials that are plenty on the internet.