1

Is it possible to use radare2 to perform a search like the following:

first occurence of ldr r1 before address 0x000048b4

enter image description here

In the following example it should return:

0x000048b2 ldr r1, [pc, 0x20]

radare2 is able to guess the value of [pc, 0x20] (511). Would it be possible to retrieve that separately ?

enter image description here

3

You can tell radare2 how much results do you want with the search.count variable, and you can also adjust your search window with the search.from and search.to ones.

Feel free to check e??~search (e for evaluate, ?? to get help about the configuration variables (? is used to get help about e itself), and ~ for the internal filtering, here, on search).

To search for opcodes, you can use /a, to search assembled opcodes.

The matching offset will automatically have a hit0_0 flag attributed.

So, something like:

e search.count = 1
e search.to = 0x000048b4
/a ldr r1
pd 1 @ hit0_0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.