AT&T XOR argument at radare2

Question

Recently I faced with strange (in my opinion) behavior of radare2.

I have been reading the Artificial truth blog post about Hacking bits with this crackme.

In an article Julien used Intel syntax, but I choose AT&T.

So I started disassemble crackme:

$ r2 ./crackme.03.32

Set syntax to intel, block size to 10 bytes and seek to needed address and print disassemble:

[0x00010020]> e asm.syntax = intel
[0x00010020]> b 10
[0x00010020]> s 0x0010112
[0x00010112]> pd

Output was:

       0x00010112    80f2ac         xor dl, 0xac
       0x00010115    eb02           jmp 0x10119

But when I changed syntax to ATT:

[0x00010112]> e asm.syntax = att
[0x00010112]> pd

I received that:

       0x00010112    80f2ac         xorb $-0x54, %dl
       0x00010115    eb02           jmp 0x10119

In the source code of crackme we can find that value of argument is 0xac (xor dl, 0xac).

So, actually, question:

Why 80 f2 ac translate to the same opcodes, but with different arguments for AT&T and Intel syntax.

Why 0xac became -0x54?

---

$ r2 -version
radare2 0.10.0-git 8247 @ linux-little-x86-64 git.0.9.9-148-gd5f2661
commit: d5f2661cbe1a32bc26490bd7a1864ef45907aaea build: 2015-06-26

Answer 1

It was signed and unsigned question.

The way to change the signedness is by negating it, which is NOTing all bits of that number and incrementing it by 1

>>> 256 - (~(-0x54)+1)
172
>>> hex(172)
'0xac'
>>>