The Official Radare2 Book | страница 60



For Example:

[0x0040100]> om 4 0x00000100 0x00400000 0x0001ae08 rwx test

You can also use om command to view information about mapped sections:

[0x00401000]> om

6 fd: 4 +0x0001ae08 0x00000100 - 0x004000ff rwx test

5 fd: 3 +0x00000000 0x00000000 - 0x0000055f r-- fmap.LOAD0

4 fd: 3 +0x00001000 0x00001000 - 0x000011e4 r-x fmap.LOAD1

3 fd: 3 +0x00002000 0x00002000 - 0x0000211f r-- fmap.LOAD2

2 fd: 3 +0x00002de8 0x00003de8 - 0x0000402f r-- fmap.LOAD3

1 fd: 4 +0x00000000 0x00004030 - 0x00004037 rw- mmap.LOAD3

Use om? to get all the possible subcommands. To list all the defined maps use om (or omj to get the json format or om* to get the r2 commands format). To get the ascii art view use om=.

It is also possible to delete the mapped section using the om-mapid command.

For Example:

[0x00401000]> om-6

Radare's I/O subsystem allows you to map the contents of files into the same I/O space used to contain a loaded binary. New contents can be placed at random offsets.

The o command permits the user to open a file, this is mapped at offset 0 unless it has a known binary header and then the maps are created in virtual addresses.

Sometimes, we want to rebase a binary, or maybe we want to load or map the file in a different address.

When launching r2, the base address can be changed with the -B flag. But you must notice the difference when opening files with unknown headers, like bootloaders, so we need to map them using the -m flag (or specifying it as argument to the o command).

radare2 is able to open files and map portions of them at random places in memory specifying attributes like permissions and name. It is the perfect basic tooling to reproduce an environment like a core file, a debug session, by also loading and mapping all the libraries the binary depends on.

Opening files (and mapping them) is done using the o (open) command. Let's read the help:

[0x00000000]> o?

|Usage: o [com- ] [file] ([offset])

| o list opened files

| o-1 close file descriptor 1

| o-!* close all opened files

| o-- close all files, analysis, binfiles, flags, same as !r2 --

| o [file] open [file] file in read-only

| o+ [file] open file in read-write mode

| o [file] 0x4000 rwx map file at 0x4000

| oa[-] [A] [B] [filename] Specify arch and bits for given file

| oq list all open files