Recently I faced with strange (in my opinion) behavior of radare2.
I have been reading the Artificial truth blog post about Hacking bits with this crackme.
In an article Julien used Intel syntax, but I choose AT&T.
So I started disassemble crackme:
$ r2 ./crackme.03.32
Set syntax to intel, block size to 10 bytes and seek to needed address and print disassemble:
[0x00010020]> e asm.syntax = intel
[0x00010020]> b 10
[0x00010020]> s 0x0010112
[0x00010112]> pd
Output was:
0x00010112 80f2ac xor dl, 0xac
0x00010115 eb02 jmp 0x10119
But when I changed syntax to ATT:
[0x00010112]> e asm.syntax = att
[0x00010112]> pd
I received that:
0x00010112 80f2ac xorb $-0x54, %dl
0x00010115 eb02 jmp 0x10119
In the source code of crackme we can find that value of argument is 0xac (xor dl, 0xac).
So, actually, question:
Why 80 f2 ac translate to the same opcodes, but with different arguments for AT&T and Intel syntax.
Why 0xac became -0x54?
$ r2 -version
radare2 0.10.0-git 8247 @ linux-little-x86-64 git.0.9.9-148-gd5f2661
commit: d5f2661cbe1a32bc26490bd7a1864ef45907aaea build: 2015-06-26
0xAC
can be written as-0x54
.0xac
as a sign bit, not a value bit, will result in-0x54
, as0xac
+0x54
=0x100
.xorb $0xac, %dl