Reverse Engineering Asked by Pehat on September 11, 2020
I have some experience with IDA and now I’m trying to use Radare2/Cutter the same way. I disassemble a DOS MZ file. I have the following:
;-- section.seg_000:
12: entry0 ();
0000:0000 push ds ; [00] -rwx section size 10784 named
seg_000
0000:0001 xor ax, ax
;-- di:
0000:0003 push ax
0000:0004 mov ah, 0x30 ; '0'
0000:0006 int 0x21
0000:0008 mov byte cs:[0x11], al
665: fcn.0000000c ();
0000:000c cmp al, 2
0000:000e jae 0x12
0000:0010 retf
0000:0011 .byte 0x00 ; RELOC 16
0000:0012 mov ax, 0x2a2 ; RELOC 16
I want to label address 0x11
as DOSVersion
and reference it by this name instead of the offset. In IDA (Turbo Assembler syntax), I can make it look like this:
proc Main far
push ds
xor ax, ax
push ax
mov ah, DOS_FN_VERSION
int DOS_INT
mov [cs:DOSVersion], al
cmp al, DOS_VERSION_2_0
jnb short ProperDosVer
retf
DOSVersion db 0
ProperDosVer:
mov ax, DSEG
How can I achieve the same result with Radare2/Cutter?
In cutter you have an option under right mouse button click to set a label for a particular value.
Or you can use Shift+N to activate that.
From r2 you can get the same behavior by issuing a f name = addr
command.
| f name 12 @ 33 set flag 'name' with length 12 at offset 33
| f name = 33 alias for 'f name @ 33' or 'f name 1 33'
One caveat,it has to start from label.
to be inlined in your disassembly. If not it will show up as a comment (not sure if that can be controlled)
So in your case it would be f label.DosVersion = 0x11
Answered by Paweł Łukasik on September 11, 2020
Get help from others!
Recent Answers
Recent Questions
© 2024 TransWikia.com. All rights reserved. Sites we Love: PCI Database, UKBizDB, Menu Kuliner, Sharing RPP