0

I used a script python from radare2-bindings to write a code analysing a binary file, i extracted the name , the start address and the size of each function , but i can't dump the hexa of each function , i am asking if there is a methode or python script in radare2 or another tool (capstone , miasm , angr ...) to solve this problem .

the script is :

    import sys
    import sqlite3 as lite
    try:
        import os, signal
        from r_core import *
    except:
        from r2.r_core import *

    rc = RCore()
    rc.file_open("/home/younes/Bureau/a.out", 0, 0)
    rc.bin_load("", 0)

    rc.anal_all()
    funcs = rc.anal.get_fcns()
    for f in funcs:
        blocks = f.get_bbs()
        print("+" + (72 * "-"))
        print("| FUNCTION: %s @ 0x%x" % (f.name, f.addr))
        print("| (%d blocks)" % (len (blocks)))
        print("+" + (72 * "-"))
        funcSize=0
        for b in blocks:
            end_byte = b.addr + b.size
            cur_byte = b.addr
            funcSize+=b.size

        print("   | f.size:      0x%x" %(funcSize))

    os.kill (os.getpid (), signal.SIGTERM) 
  • What does your "I can't" mean, in this context? Do regular Python file operations not work in this environment, don't you have direct access to the raw data ... or, literally, you can't do it because you don't know how to? – usr2564301 Jul 18 '16 at 18:03
  • yes i don't know how to access to the raw data – Y.hadj.younes Jul 18 '16 at 19:12
1

Already resolved on github repository: https://github.com/radare/radare2-bindings/issues/130#issuecomment-233662221

import r2pipe
import sys

r2 = r2pipe.open(sys.argv[1])
r2.cmdj("aaa") # http://radare.today/posts/analysis-by-default/
function_list = r2.cmdj("aflj") # Analysis Function List Json

for function in function_list:
    print r2.cmdj("p8j" + str(function["size"])+ " @ " + function["name"] ) # 8bit hexpair Json
  • thank you it already works , but what about address ? print("funcAddrs 0x%x" + %(function["address"])) ? – Y.hadj.younes Jul 26 '16 at 15:30
  • print("0x%x"%(function['offset'])) – Y.hadj.younes Jul 27 '16 at 14:32

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.