I was trying to debug a crackme with radare2. I found an interesting function which radare2 flagged as
sym.xxx. The following listing is trimmed version of disassembled output of the function
[0x7ff299821090]> pdf @sym.xxx / (fcn) sym.xxx 179 | sym.xxx (); | ; CALL XREF from main @ 0x55a340b531a8 | 0x55a340b53297 55 push rbp | 0x55a340b53298 4889e5 mov rbp, rsp | 0x55a340b5329b 488d35b92d00. lea rsi, obj.key3 ; 0x55a340b5605b ; "is" | 0x55a340b532a2 488d3d373000. lea rdi, [0x55a340b562e0] | 0x55a340b532a9 e8c2fdffff call sym.imp.strcat ; char *strcat(char *s1, const char *s2) | 0x55a340b532ae 488d052b3000. lea rax, [0x55a340b562e0] | 0x55a340b532b5 48c7c1ffffff. mov rcx, 0xffffffffffffffff | 0x55a340b532bc 4889c2 mov rdx, rax | 0x55a340b532bf b800000000 mov eax, 0 | 0x55a340b532c4 4889d7 mov rdi, rdx | 0x55a340b532c7 f2ae repne scasb al, byte [rdi] ...
While stepping in through each instruction in this function, I have noticed that after executing the fourth instructon (
lea rdi, [0x55a340b562e0]) the 2nd operand of
lea instruction automatically substituted to a random register like
rdi in the disassembly of debugger window. In the screenshot below the fourth instruction got substituted to
lea rdi, [rdi] by radare2. And I think it is worth mentioning that I have loaded the crackme executable 5 times in radare2, at first two times radare2 replaced the memory address operand with
r9 and last 3 times with
I am quite unsure of what causing this behavior.Although
lea rdi, [rdi] looks self-explanatory but I don't know about
r9. Why radare2 is changing memory operands in
lea instruction ?
Radare2 version : radare2 3.7.0 22507 @ linux-x86-64 git.3.7.0-38-g9ce44c7cc
Crackme binary: https://crackmes.one/crackme/5c95646333c5d46ecd37c960