/usr/share/doc/radare-doc/html/Section10.2.html is in radare-doc 1:1.5.2-6.
This file is owned by root:root, with mode 0o644.
The actual contents of the file can be viewed below.
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 | <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN"
"http://www.w3.org/TR/html4/strict.dtd">
<html>
<head>
<meta http-equiv="content-type" content="text/html; charset=US-ASCII">
<title>Boolean expressions</title>
<link rel="previous" href="Section10.1.html">
<link rel="ToC" href="contents.html">
<link rel="next" href="Section10.3.html">
</head>
<body>
<h1><a name="expr-cmp"></a>10.2 Boolean expressions</h1>
<p>
These expressions can be checked for equality for later make conditional execution of commands.
</p>
<p>
Here is an example that checks if current eip is 0x8048404 and skips this instruction (!jmp eip+2) if matches.
</p>
<pre><code>> ? eip == 0x8048404
> ??!jmp eip+2
</code></pre>
<p>
You can check the last comparision result with the '???' command. Which is the substraction of the first part of the expression and the second part of it.
</p>
<pre><code>> ? 1==1 # check equality (==)
> ???
0x0
> ? 2==1 # check equality (==)
> ???
0x1
> ? 1!=2 # check difference (!=)
> ???
0x0
</code></pre>
<p>
Substraction can be also used as a comparator operation, because it's what the == operator does internally. If the substraction of two elements is 0 means that they are equal. Now we can replace the previous expression into:
</p>
<pre><code>> ? 2-1
> ???
0x1 # false
> ? 2-2
> ???
0x0 # true
</code></pre>
<p>
The conditional command is given after the '??' command. Which is the help of the '?' command when no arguments given:
</p>
<pre><code>[0xB7F9D810]> ??
Usage: ?[?[?]] <expr>
> ? eip ; get value of eip flag
> ? 0x80+44 ; calc math expression
> ? eip-23 ; ops with flags and numbers
> ? eip==sym.main ; compare flags
The '??' is used for conditional executions after a comparision
> ? [foo] = 0x44 ; compare memory read with byte
> ??? ; show result of comparision
> ?? s +3 ; seek current seek + 3 if equal
</code></pre>
<!-- version IDs:
$Id: radare.but 2009-04-25 pancake $
-->
</body>
</html>
|