Radare2 - what does dot mean in disassembly

Question

I've just started using radare2 and I've noticed a dot when I tried to disassamble one on my programs. The output is:
0x00000000      48b841000000.  movabs rax, 0x41

I understand that 0x48 is the REX prefix for mov (0xB8) and immediate operand is 0x41. If 0x41 consumed 64 bits it would be 0x0000000000000041 (8 bytes).
Total length of the instruction should be 10 bytes (0xA) which makes sense as my next instruction starts at 0xA (as first one consumes 10 bytes starting from 0x0 to 0x9)
What is the meaning of dot in disassembly above? Could someone maybe point me to documentation that talks about disassembly format?

Paweł Łukasik · Accepted Answer

Since the number of bytes in the instructions can be different and they had to put some limit on the column width, this is how it is indicated that there are more bytes in the instruction that those that you see on the screen. A '.' indicates that there's more and it doesn't mean it's always zero(s)- it can be anything.
If this bothers you there are flags that control the behavior.
:> e asm.nbytes = 6

controls how many bytes are shown, and if you put that value to a relatively small number almost all will end with a '.'.
You could put there 10 to see the full instruction but of course that would push opcodes more to the right. You can also turn the bytes off to save some space:
:> e asm.bytes = false

Radare2 - what does dot mean in disassembly

One Answer

Add your own answers!

Ask a Question