Recently I faced with strange (in my opinion) behavior of radare2.I have been reading the Artificial truth blog post about Hacking bits with this crackme.In an article Julien used Intel syntax,but I choose AT&T.So I started disassemble crackme:$ r2 ./crackme.03.32Set syntax to intel, block size to 10 bytes and seek to needed address and print disassemble:[0x00010020]> e asm.syntax = intel[0x00010020]> b 10[0x00010020]> s 0x0010112[0x00010112]> pdOutput was:       0x00010112    80f2ac         xor dl, 0xac       0x00010115    eb02           jmp 0x10119But when I changed syntax to ATT:[0x00010112]> e asm.syntax = att[0x00010112]> pdI received that:       0x00010112    80f2ac         xorb $-0x54, %dl       0x00010115    eb02           jmp 0x10119In the source code of crackme we can find that value of argument is 0xac (xor dl, 0xac).So, actually, question:Why 80 f2 ac translate to the same opcodes, but with different arguments for AT&T and Intel syntax.Why 0xac became -0x54?$ r2 -versionradare2 0.10.0-git 8247 @ linux-little-x86-64 git.0.9.9-148-gd5f2661commit: d5f2661cbe1a32bc26490bd7a1864ef45907aaea build: 2015-06-26
AT&T XOR argument at radare2
disassemblers;crackme
It was signed and unsigned question.The way to change the signedness is by negating it, which is NOTing all bits of that number and incrementing it by 1>>> 256 - (~(-0x54)+1)172>>> hex(172)'0xac'>>> 