The Official Radare2 Book | страница 14



   • / : division

   • % : modulus

   • > : shift right

   • < : shift left

[0x00000000]> ?vi 1+2+3

6

To use of logical OR should quote the whole command to avoid executing the | pipe:

[0x00000000]> "? 1 | 2"

hex 0x3

octal 03

unit 3

segment 0000:0003

int32 3

string "\x03"

binary 0b00000011

fvalue: 2.0

float: 0.000000f

double: 0.000000

trits 0t10

Numbers can be displayed in several formats:

0x033 : hexadecimal can be displayed

3334 : decimal

sym.fo : resolve flag offset

10K : KBytes 10*1024

10M : MBytes 10*1024*1024

You can also use variables and seek positions to build complex expressions.

Use the ?$? command to list all the available commands or read the refcard chapter of this book.

$$ here (the current virtual seek)

$l opcode length

$s file size

$j jump address (e.g. jmp 0x10, jz 0x10 => 0x10)

$f jump fail address (e.g. jz 0x10 => next instruction)

$m opcode memory reference (e.g. mov eax,[0x10] => 0x10)

$b block size

Some more examples:

[0x4A13B8C0]> ? $m + $l

140293837812900 0x7f98b45df4a4 03771426427372244 130658.0G 8b45d000:04a4 140293837812900 10100100 140293837812900.0 -0.000000

[0x4A13B8C0]> pd 1 @ +$l

0x4A13B8C2 call 0x4a13c000

To debug a program, start radare with the -d option. Note that you can attach to a running process by specifying its PID, or you can start a new program by specifying its name and parameters:

$ pidof mc

32220

$ r2 -d 32220

$ r2 -d /bin/ls

$ r2 -a arm -b 16 -d gdb://192.168.1.43:9090

...

In the second case, the debugger will fork and load the debugee ls program in memory.

It will pause its execution early in ld.so dynamic linker. As a result, you will not yet see the entrypoint or any shared libraries at this point.

You can override this behavior by setting another name for an entry breakpoint. To do this, add a radare command e dbg.bep=entry or e dbg.bep=main to your startup script, usually it is ~/.config/radare2/radare2rc.

Another way to continue until a specific address is by using the dcu command. Which means: "debug continue until" taking the address of the place to stop at. For example:

dcu main

Be warned that certain malware or other tricky programs can actually execute code before main() and thus you'll be unable to control them. (Like the program constructor or the tls initializers)

Below is a list of most common commands used with debugger:

> d? ; get help on debugger commands