9

This is the stack view that I'm getting in radare2 after entering the visual panel mode:

enter image description here

This is the view from immunity debugger:

enter image description here

How can I get a view similar to immunity debugger in radare2?

1 Answer 1

13

You have several ways to print the stack. The specific way that you're searching for is called Stack Telescoping and you can print it like this:

pxr @ esp

Use sp, esp, and rsp according to your system.

pxr stands for Print heXadecimal References, you can see its description by using px?:

[0x7f8a672ee4]> px?
<...truncated...>
pxr[j]            show words with references to flags and code

Here are some other options to print the stack using radare2:

  • pxa @ rsp - to show annotated hexdump
  • pxw @ rsp - to show hexadecimal words dump (32bit)
  • pxq @ rsp - to show hexadecimal quad-words dump (64bit)
  • ad@r:SP - to analyze the stack data
9
  • Does it mean that I have to use a command after each step over to get an update on stack? Commented Nov 26, 2017 at 15:45
  • 1
    No, you can use Visual Panel Mode (v!) -- check out my answer here. If you want a view similar to PEDA's you can use e dbg.slow = true and then use Vpp. That's way you'll see a Visual Mode as well as Stack Telescoping.
    – Megabeets
    Commented Nov 26, 2017 at 15:50
  • Thanks! though I still can't scroll through the stack. When I use the arrow keys, it scrolls the code at the bottom of the page and the stack doesn't scroll. Do you know how to scroll through stack? Commented Nov 26, 2017 at 17:31
  • In visual panel mode you can use Tab to move between the panels and h, J, k, and l to scroll inside the panel.
    – Megabeets
    Commented Nov 26, 2017 at 21:23
  • No I mean how to scroll in Vpp. in visual panel mode the stack is like the figure I posted. So scrolling isn't useful Commented Nov 26, 2017 at 21:49

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.