1

when I am using the radare2 debugger, it happens that I have sometimes to examine variables and memory. Consider the following instruction

0x08048498      8b4508         mov eax, dword [ebp+arg2]

Assuming that I know that what in eax pointer to array of characters with null termination at the end (I mean string). So, ebp+arg2 is pointer to that string.

when I type ps @eax I get what I expect, a string. But, I can get the same result by accessing [ebp+arg_2]. I tried many things including ps and ps/ etc.

5

Check out the afa command (a for analysis, f for function, and the latest a for arguments), you should find the value of the args.

You can then use pxr (p as in print, x and in hexdump, r as in reference): pxr 1 @ ebp+0x8, 1 to get the first reference.

  • actually it is right except for it should be pxr 4 @ ebp+0x8 to get the first reference – Ahmed Abd El Mawgood Jan 16 '16 at 14:38
3

You should get the same result by pf S @ ebp+arg2.

pf[?][.nam] [fmt]              print formatted data (pf.name, pf.name $<expr>)
S       64bit pointer to string (8 bytes)

pf S stands for print formatted null terminated string referenced by a 64 bit pointer.

You might have to use arg2's actually value like 0x8.

I guess it is a renamed argument so you should look up in the function header what is it's value.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.