Expressions

Expressions are mathematical representations of 64-bit numerical values. They can be displayed in different formats, be compared or used with all commands accepting numeric arguments. Expressions can use traditional arithmetic operations, as well as binary and boolean ones. To evaluate mathematical expressions prepend them with command ?:

  1. [0xb7f9d810]> ?vi 0x8048000
  2. 134512640
  3. [0xv7f9d810]> ?vi 0x8048000+34
  4. 134512674
  5. [0xb7f9d810]> ?vi 0x8048000+0x34
  6. 134512692
  7. [0xb7f9d810]> ? 1+2+3-4*3
  8. hex     0xfffffffffffffffa
  9. octal   01777777777777777777772
  10. unit    17179869184.0G
  11. segment fffff000:0ffa
  12. int64   -6
  13. string  "\xfa\xff\xff\xff\xff\xff\xff\xff"
  14. binary  0b1111111111111111111111111111111111111111111111111111111111111010
  15. fvalue: -6.0
  16. float:  nanf
  17. double: nan
  18. trits   0t11112220022122120101211020120210210211201

Supported arithmetic operations are:

  • + : addition
  • - : subtraction
  • * : multiplication
  • / : division
  • % : modulus
  • >> : shift right
  • << : shift left
  1. [0x00000000]> ?vi 1+2+3
  2. 6

To use of binary OR should quote the whole command to avoid executing the | pipe:

  1. [0x00000000]> "? 1 | 2"
  2. hex     0x3
  3. octal   03
  4. unit    3
  5. segment 0000:0003
  6. int32   3
  7. string  "\x03"
  8. binary  0b00000011
  9. fvalue: 2.0
  10. float:  0.000000f
  11. double: 0.000000
  12. trits   0t10

Numbers can be displayed in several formats:

  1. 0x033   : hexadecimal can be displayed
  2. 3334    : decimal
  3. sym.fo  : resolve flag offset
  4. 10K     : KBytes  10*1024
  5. 10M     : MBytes  10*1024*1024

You can also use variables and seek positions to build complex expressions.

Use the ?$? command to list all the available commands or read the refcard chapter of this book.

  1. $$    here (the current virtual seek)
  2. $l    opcode length
  3. $s    file size
  4. $j    jump address (e.g. jmp 0x10, jz 0x10 => 0x10)
  5. $f    jump fail address (e.g. jz 0x10 => next instruction)
  6. $m    opcode memory reference (e.g. mov eax,[0x10] => 0x10)
  7. $b    block size

Some more examples:

  1. [0x4A13B8C0]> ? $m + $l
  2. 140293837812900 0x7f98b45df4a4 03771426427372244 130658.0G 8b45d000:04a4 140293837812900 10100100 140293837812900.0 -0.000000
  1. [0x4A13B8C0]> pd 1 @ +$l
  2. 0x4A13B8C2   call 0x4a13c000