3

I've just started using radare2 and I've noticed a dot when I tried to disassamble one on my programs. The output is:

0x00000000      48b841000000.  movabs rax, 0x41

I understand that 0x48 is the REX prefix for mov (0xB8) and immediate operand is 0x41. If 0x41 consumed 64 bits it would be 0x0000000000000041 (8 bytes).

Total length of the instruction should be 10 bytes (0xA) which makes sense as my next instruction starts at 0xA (as first one consumes 10 bytes starting from 0x0 to 0x9)

What is the meaning of dot in disassembly above? Could someone maybe point me to documentation that talks about disassembly format?

| improve this question | |
  • it just means 00, I don't know why they put . instead – R4444 Jul 28 at 1:13
  • 2
    @R4444 it doesn't have to be 00. See my answer. – Paweł Łukasik Jul 28 at 7:49
4

Since the number of bytes in the instructions can be different and they had to put some limit on the column width, this is how it is indicated that there are more bytes in the instruction that those that you see on the screen. A '.' indicates that there's more and it doesn't mean it's always zero(s)- it can be anything.

If this bothers you there are flags that control the behavior.

:> e asm.nbytes = 6

controls how many bytes are shown, and if you put that value to a relatively small number almost all will end with a '.'.

You could put there 10 to see the full instruction but of course that would push opcodes more to the right. You can also turn the bytes off to save some space:

:> e asm.bytes = false
| improve this answer | |
  • got it! thanks for the answer – R4444 Jul 28 at 14:10
  • Thanks @Pawel. I assumed it was something like this – markovuksanovic Jul 28 at 14:16

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.