What means sym prefix in disassembly? For examle, sym.main?

  • RTFM ! wx 90 @@ sym.* Writes a nop on every symbol (github.com/pwntester/cheatsheets/blob/master/radare2.md) – yaspr Dec 21 '16 at 8:30
  • Ok, wx 90 @@ sym.* writes a nop on every symbol. But what means sym? Acronym or what? – Alex T Dec 21 '16 at 9:46
  • Sym ==> symbol ! RTFM again. – yaspr Dec 21 '16 at 9:59
  • What means sym prefix It means you need to understand file formats before you try to disassemble them. – Parthian Shot Dec 21 '16 at 23:49

As pointed out by users in comments sym stands for symbol.

From Wikipedia:

A debug symbol is information that expresses which programming-language constructs generated a specific piece of machine code in a given executable module. Sometimes the symbolic information is compiled together with the module's binary file, or distributed in a separate file, or simply discarded during the compilation and/or linking. This information enables a person using a symbolic debugger to gain additional information about the binary, such as the names of variables and routines from the original source code. This information can be extremely helpful while trying to investigate and fix a crashing application or any other fault.

As previously stated, a symbol may be used to referer to a specific address in the binary (i.e. sym.main => main function).


Here are symbol prefixes with examples, as output by the Radare2 command "axj" from C:\Windows\system32\gdi32.dll:

  • sym.imp.* : "sym.imp.KERNEL32.dll_UnhandledExceptionFilter"
  • sub.* : "sub.KERNEL32.dll_RtlCaptureContext_614+410" or "sym.imp.ole32.dll_ReleaseStgMedium+56" (Note the library name in upper- or lowercase)
  • fcn.* : "fcn.18000587c+41"
  • str.* : "str.._AUIDropTarget+584" or "str.PyShellExt::GetArguments___failed_to_lock_CF_HDROP_hGlobal+124" or "str.memset" (One or two dots)
  • section.* : "section..data+16"
  • switch.* : "switch.0x180004860"
  • case.* : "case.default.0x180004820"
  • resource.* : "resource.1"

The only explanation I could find is:

"Flags generally have a prefix in their name, such as str., sym., sub., fcn."

Those names are called ‘flags’. Flags can be grouped into ‘flag spaces’.

As suggested, "fs" command displays:

[0x180005218]> fs
0  247 * strings
1    5 * symbols
2    8 * sections
3    0 * segments
4   79 * relocs
5   79 * imports
6    2 * resources
7  104 * functions

More information about flags and flagspaces here: Radare2, basic commands, flags

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.