16.3.1 Virtual machine registers

The radare virtual machine implementation allows infinite number of register definitions. These registers also allow get and set callbacks that permit to generate register dependencies to emulate architectures like x86 that have EAX, AX, AH and AL that are subregisters and reading/writing from/to them should imply a recursive dependency.

The registers can have different types:

[0x4A13B8C0]> avrt
 .bit
 .int64
 .int32
 .int16
 .int8
 .float32
 .float64

By default they are initialized by asm.arch value. For example:

[0x4A13B8C0]> avr
.int32  eax = 0x00000000
.int16  ax = 0x00000000
.int8   al = 0x00000000
.int8   ah = 0x00000000
.int32  ebx = 0x00000000
.int32  ecx = 0x00000000
.int32  edx = 0x00000000
.int32  esi = 0x00000000
.int32  edi = 0x00000000
.int32  eip = 0x00000000
.int32  esp = 0x00000000
.int32  ebp = 0x00000000
.bit    zf = 0x00000000
.bit    cf = 0x00000000

These dependencies (for x86) can be defined with the 'avra' command which stands for 'analyze vm register aliases'). Here's the list for x86:

[0x4A13B8C0]> avra
Register alias:
ax:  get = ax=eax&0xffff
     set = eax=eax>16,eax=eax<16,eax=eax|ax
al:  get = al=eax&0xff
     set = al=al&0xff,eax=eax>16,eax=eax<16,eax=eax|al
ah:  get = ah=eax&0xff00,ah=ah>8
     set = eax=eax&0xFFFF00ff,ah=ah<8,eax=eax|ah,ah=ah>8

Here you see some expressions evaluable by the virtual machine.

You can import the register values from the debugger by using the 'avi' command (analyze vm import)

TODO: explain some examples

All these values can be resetted with the 'av-' command.