Recently I faced with strange (in my opinion) behavior of radare2.

I have been reading the Artificial truth blog post about Hacking bits with this crackme.

In an article Julien used Intel syntax, but I choose AT&T.

So I started disassemble crackme:

$ r2 ./crackme.03.32

Set syntax to intel, block size to 10 bytes and seek to needed address and print disassemble:

[0x00010020]> e asm.syntax = intel
[0x00010020]> b 10
[0x00010020]> s 0x0010112
[0x00010112]> pd

Output was:

       0x00010112    80f2ac         xor dl, 0xac
       0x00010115    eb02           jmp 0x10119

But when I changed syntax to ATT:

[0x00010112]> e asm.syntax = att
[0x00010112]> pd

I received that:

       0x00010112    80f2ac         xorb $-0x54, %dl
       0x00010115    eb02           jmp 0x10119

In the source code of crackme we can find that value of argument is 0xac (xor dl, 0xac).

So, actually, question:

Why 80 f2 ac translate to the same opcodes, but with different arguments for AT&T and Intel syntax.

Why 0xac became -0x54?

$ r2 -version
radare2 0.10.0-git 8247 @ linux-little-x86-64 git.0.9.9-148-gd5f2661
commit: d5f2661cbe1a32bc26490bd7a1864ef45907aaea build: 2015-06-26
  • 2
    It's a matter of notation of a single byte only. The byte value 0xAC can be written as -0x54. – usr2564301 Jul 1 '15 at 10:06
  • 3
    You should learn about representation of signed and unsigned values; this will make it clear immediately. Interpreting the first bit of 0xac as a sign bit, not a value bit, will result in -0x54, as 0xac+0x54=0x100. – Guntram Blohm Jul 1 '15 at 10:17
  • Thanks for explaining! I have thought about signed and unsigned values. – Alex Bender Jul 1 '15 at 10:38
  • Now here is the current output after changing the syntax with att in radare2. xorb $0xac, %dl – Maijin Dec 22 '15 at 22:36

It was signed and unsigned question.

The way to change the signedness is by negating it, which is NOTing all bits of that number and incrementing it by 1

>>> 256 - (~(-0x54)+1)
>>> hex(172)

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.