TransWikia.com

Reference address by name in Radare2/Cutter

Reverse Engineering Asked by Pehat on September 11, 2020

I have some experience with IDA and now I’m trying to use Radare2/Cutter the same way. I disassemble a DOS MZ file. I have the following:

;-- section.seg_000:
12: entry0 ();
0000:0000      push    ds          ; [00] -rwx section size 10784 named 
seg_000
0000:0001      xor     ax, ax
;-- di:
0000:0003      push    ax
0000:0004      mov     ah, 0x30    ; '0'
0000:0006      int     0x21
0000:0008      mov     byte cs:[0x11], al
665: fcn.0000000c ();
0000:000c      cmp     al, 2
0000:000e      jae     0x12
0000:0010      retf
0000:0011      .byte 0x00          ; RELOC 16 
0000:0012      mov     ax, 0x2a2   ; RELOC 16 

I want to label address 0x11 as DOSVersion and reference it by this name instead of the offset. In IDA (Turbo Assembler syntax), I can make it look like this:

proc    Main far
    push    ds
    xor     ax, ax
    push    ax
    mov     ah, DOS_FN_VERSION
    int     DOS_INT
    mov     [cs:DOSVersion], al
    cmp     al, DOS_VERSION_2_0
    jnb     short ProperDosVer
    retf
DOSVersion      db 0
ProperDosVer:
    mov     ax, DSEG

How can I achieve the same result with Radare2/Cutter?

One Answer

In cutter you have an option under right mouse button click to set a label for a particular value.

enter image description here

Or you can use Shift+N to activate that.

From r2 you can get the same behavior by issuing a f name = addr command.

| f name 12 @ 33           set flag 'name' with length 12 at offset 33
| f name = 33              alias for 'f name @ 33' or 'f name 1 33'

One caveat,it has to start from label. to be inlined in your disassembly. If not it will show up as a comment (not sure if that can be controlled)

So in your case it would be f label.DosVersion = 0x11

Answered by Paweł Łukasik on September 11, 2020

Add your own answers!

Ask a Question

Get help from others!

© 2024 TransWikia.com. All rights reserved. Sites we Love: PCI Database, UKBizDB, Menu Kuliner, Sharing RPP