1

Recently I faced with strange (in my opinion) behavior of radare2.

I have been reading the Artificial truth blog post about Hacking bits with this crackme.

In an article Julien used Intel syntax, but I choose AT&T.

So I started disassemble crackme:

$ r2 ./crackme.03.32

Set syntax to intel, block size to 10 bytes and seek to needed address and print disassemble:

[0x00010020]> e asm.syntax = intel
[0x00010020]> b 10
[0x00010020]> s 0x0010112
[0x00010112]> pd

Output was:

       0x00010112    80f2ac         xor dl, 0xac
       0x00010115    eb02           jmp 0x10119

But when I changed syntax to ATT:

[0x00010112]> e asm.syntax = att
[0x00010112]> pd

I received that:

       0x00010112    80f2ac         xorb $-0x54, %dl
       0x00010115    eb02           jmp 0x10119

In the source code of crackme we can find that value of argument is 0xac (xor dl, 0xac).

So, actually, question:

Why 80 f2 ac translate to the same opcodes, but with different arguments for AT&T and Intel syntax.

Why 0xac became -0x54?


$ r2 -version
radare2 0.10.0-git 8247 @ linux-little-x86-64 git.0.9.9-148-gd5f2661
commit: d5f2661cbe1a32bc26490bd7a1864ef45907aaea build: 2015-06-26
4
  • 2
    It's a matter of notation of a single byte only. The byte value 0xAC can be written as -0x54.
    – Jongware
    Jul 1, 2015 at 10:06
  • 3
    You should learn about representation of signed and unsigned values; this will make it clear immediately. Interpreting the first bit of 0xac as a sign bit, not a value bit, will result in -0x54, as 0xac+0x54=0x100. Jul 1, 2015 at 10:17
  • Thanks for explaining! I have thought about signed and unsigned values. Jul 1, 2015 at 10:38
  • Now here is the current output after changing the syntax with att in radare2. xorb $0xac, %dl
    – Maijin
    Dec 22, 2015 at 22:36

1 Answer 1

1

It was signed and unsigned question.

The way to change the signedness is by negating it, which is NOTing all bits of that number and incrementing it by 1

>>> 256 - (~(-0x54)+1)
172
>>> hex(172)
'0xac'
>>> 

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.