How to print from pointers in radare2 in debug session

Question

when I am using the radare2 debugger, it happens that I have sometimes to examine variables and memory. Consider the following instruction

0x08048498      8b4508         mov eax, dword [ebp+arg2]

Assuming that I know that what in eax pointer to array of characters with null termination at the end (I mean string). So, ebp+arg2 is pointer to that string.

when I type ps @eax I get what I expect, a string. But, I can get the same result by accessing [ebp+arg_2]. I tried many things including ps and ps/ etc.

Answer 1

Check out the afa command (a for analysis, f for function, and the latest a for arguments), you should find the value of the args.

You can then use pxr (p as in print, x and in hexdump, r as in reference): pxr 1 @ ebp+0x8, 1 to get the first reference.

Answer 2

You should get the same result by pf S @ ebp+arg2.

pf[?][.nam] [fmt]              print formatted data (pf.name, pf.name $<expr>)
S       64bit pointer to string (8 bytes)

pf S stands for print formatted null terminated string referenced by a 64 bit pointer.

You might have to use arg2's actually value like 0x8.

I guess it is a renamed argument so you should look up in the function header what is it's value.