The Official Radare2 Book | страница 13



See ~? for help.

The ~ character enables internal grep-like function used to filter output of any command:

pd 20~call ; disassemble 20 instructions and grep output for 'call'

Additionally, you can grep either for columns or for rows:

pd 20~call:0 ; get first row

pd 20~call:1 ; get second row

pd 20~call[0] ; get first column

pd 20~call[1] ; get second column

Or even combine them:

pd 20~call:0[0] ; grep the first column of the first row matching 'call'

This internal grep function is a key feature for scripting radare2, because it can be used to iterate over a list of offsets or data generated by disassembler, ranges, or any other command. Refer to the loops section (iterators) for more information.

The @ character is used to specify a temporary offset at which the command to its left will be executed. The original seek position in a file is then restored.

For example, pd 5 @ 0x100000fce to disassemble 5 instructions at address 0x100000fce.

Most of the commands offer autocompletion support using key, for example seek or flags commands. It offers autocompletion using all possible values, taking flag names in this case. Note that it is possible to see the history of the commands using the !~... command - it offers a visual mode to scroll through the radare2 command history.

To extend the autocompletion support to handle more commands or enable autocompletion to your own commands defined in core, I/O plugins you must use the !!! command.

Expressions are mathematical representations of 64-bit numerical values. They can be displayed in different formats, be compared or used with all commands accepting numeric arguments. Expressions can use traditional arithmetic operations, as well as binary and boolean ones. To evaluate mathematical expressions prepend them with command ?:

[0xb7f9d810]> ?vi 0x8048000

134512640

[0xv7f9d810]> ?vi 0x8048000+34

134512674

[0xb7f9d810]> ?vi 0x8048000+0x34

134512692

[0xb7f9d810]> ? 1+2+3-4*3

hex 0xfffffffffffffffa

octal 01777777777777777777772

unit 17179869184.0G

segment fffff000:0ffa

int64 -6

string "\xfa\xff\xff\xff\xff\xff\xff\xff"

binary 0b1111111111111111111111111111111111111111111111111111111111111010

fvalue: -6.0

float: nanf

double: nan

trits 0t11112220022122120101211020120210210211201

Supported arithmetic operations are:

   • + : addition

   • - : subtraction

   • * : multiplication