2

I used rabin2 -Sr myfilename to get the size of the .text section of myfilename.

But, how can I dump the whole hexadecimal section of the .text onto an output file? My purpose is to read the byte code of the .text section of a PE file.

Improve this question
1
  • I managed to use 'pxw', but when I extract it to a text file, all the lines concatenated. How to keep the same display in a text file? Thanks.
    – lsamarahan
    Commented Mar 15, 2017 at 9:04

2 Answers 2

Reset to default
2

In fact, this is quite easy:

  1. First list the sections with S (see S? to know all the commands about the sections).

    [0x00005430]> S
[00] . 0x00000238 -r-- va=0x00000238 sz=0x001c vsz=0x001c .interp
[01] . 0x00000254 -r-- va=0x00000254 sz=0x0020 vsz=0x0020 .note.ABI_tag
[02] . 0x00000274 -r-- va=0x00000274 sz=0x0024 vsz=0x0024 .note.gnu.build_id
[03] . 0x00000298 -r-- va=0x00000298 sz=0x00b4 vsz=0x00b4 .gnu.hash
[04] . 0x00000350 -r-- va=0x00000350 sz=0x0cc0 vsz=0x0cc0 .dynsym
[05] . 0x00001010 -r-- va=0x00001010 sz=0x05dd vsz=0x05dd .dynstr
[06] . 0x000015ee -r-- va=0x000015ee sz=0x0110 vsz=0x0110 .gnu.version
[07] . 0x00001700 -r-- va=0x00001700 sz=0x0070 vsz=0x0070 .gnu.version_r
[08] . 0x00001770 -r-- va=0x00001770 sz=0x1368 vsz=0x1368 .rela.dyn
[09] . 0x00002ad8 -r-- va=0x00002ad8 sz=0x09f0 vsz=0x09f0 .rela.plt
[10] . 0x000034c8 -r-x va=0x000034c8 sz=0x0017 vsz=0x0017 .init
[11] . 0x000034e0 -r-x va=0x000034e0 sz=0x06b0 vsz=0x06b0 .plt
[12] . 0x00003b90 -r-x va=0x00003b90 sz=0x0020 vsz=0x0020 .plt.got
[13] * 0x00003bb0 -r-x va=0x00003bb0 sz=0x12099 vsz=0x12099 .text
[14] . 0x00015c4c -r-x va=0x00015c4c sz=0x0009 vsz=0x0009 .fini
[15] . 0x00015c60 -r-- va=0x00015c60 sz=0x4f14 vsz=0x4f14 .rodata
...

  2. You may have noticed the * on section 13 (.text), so we have already selected the .text section (this is the default). To be sure:

    [0x00005430]> S.
0x00007760 0x000197f9 .text

    Currently, I do not know how to change this current section.

  3. Then, you can print the whole section with the px command:

    [0x00005430]> px 0x00007760
Do you want to print 1911 lines? (y/N)
- offset -   0 1  2 3  4 5  6 7  8 9  A B  C D  E F  0123456789ABCDEF
0x00007760  0000 00e8 f8e0 ffff 84c0 0f84 c000 0000  ................
0x00007770  b910 0100 00e9 56fd ffff 660f 1f44 0000  ......V...f..D..
0x00007780  418b 97bc 0000 0048 8b35 c28d 2100 4183  A......H.5..!.A.
0x00007790  f401 4d89 e945 0fb6 c431 c948 89ef e82d  ..M..E...1.H...-
...

  4. Finally, you can dump the content of the whole .text section in a file like this:

    [0x00005430]> Sd text.bin
Dumped 73881 bytes into text.bin

Hope this helped.

Improve this answer
5
  • Thank you so much!! I followed your step above, to dump the .text section, and I can read my section is at 0x00401000 0x00401a00 .text, but now it keeps going down to 0x008xxxxx, ...though... have to kill me command prompt to stop it :-(
    – lsamarahan
    Commented Mar 15, 2017 at 10:13
  • You can limit the size of the displayed dump by giving a size in the arguments like this: px size start_address. For example, it could be: px 1000 0x00007760. But, I do not know how to add a page break like in gdb.
    – perror
    Commented Mar 15, 2017 at 10:17
  • I will give it a try. But when I open the text.bin in notepad, it gives me weird char like '冹h? 0@ 3膲D$d @ 吚u|V??@ h?@ 謲D$Ph?@ ?@ 兡锅 @ 岲$?:u勔t奝:Qu兝兞勔u?离纼?吚uh!@ 謍?@ h<!@ 謨??hX!@ 謨??@ ^婰$d3?' is it something wrong with my editor? thanks!
    – lsamarahan
    Commented Mar 15, 2017 at 10:46
  • It is a binary dump, so do not expect to read it with an ASCII text editor.
    – perror
    Commented Mar 15, 2017 at 11:00
  • I see. Well, i was hoping to get the hexdump. I managed to read the dump file in a hex editor. Thanks for your help!
    – lsamarahan
    Commented Mar 16, 2017 at 8:12
4

In accordance with the manual of radare, I notice that the command S and Sd of radare2 are depreciated. You can have a few issues with using it in some ways such as use it on a elf file. Use iS and iO instead.

If you want to launch the command in rabin2 then simply type:

rabin2 -O d/S/.text hello-world > text.bin

Else, if you prefer to the radare2 console, then in the aim to provide an usage example of how to get a whole hexadecimal representation of the .text section, I am going to give an example based on the case given by perror. Let's have a look.

First, use iS instead to list the sections.

$ r2 hello
-- Wrong argument
[0x00000580]> iS
[Sections]
00 0x00000000     0 0x00000000     0 ---- 
01 0x00000238    28 0x00000238    28 -r-- .interp
02 0x00000254    32 0x00000254    32 -r-- .note.ABI_tag
03 0x00000274    36 0x00000274    36 -r-- .note.gnu.build_id
04 0x00000298    28 0x00000298    28 -r-- .gnu.hash
05 0x000002b8   192 0x000002b8   192 -r-- .dynsym
06 0x00000378   150 0x00000378   150 -r-- .dynstr
07 0x0000040e    16 0x0000040e    16 -r-- .gnu.version
08 0x00000420    32 0x00000420    32 -r-- .gnu.version_r
09 0x00000440   216 0x00000440   216 -r-- .rela.dyn
10 0x00000518    24 0x00000518    24 -r-- .rela.plt
11 0x00000530    23 0x00000530    23 -r-x .init
12 0x00000550    32 0x00000550    32 -r-x .plt
13 0x00000570     8 0x00000570     8 -r-x .plt.got
14 0x00000580   466 0x00000580   466 -r-x .text
15 0x00000754     9 0x00000754     9 -r-x .fini
16 0x00000760    16 0x00000760    16 -r-- .rodata
17 0x00000770    60 0x00000770    60 -r-- .eh_frame_hdr
18 0x000007b0   268 0x000007b0   268 -r-- .eh_frame
19 0x00000dd8     8 0x00200dd8     8 -rw- .init_array
20 0x00000de0     8 0x00200de0     8 -rw- .fini_array
21 0x00000de8     8 0x00200de8     8 -rw- .jcr
22 0x00000df0   480 0x00200df0   480 -rw- .dynamic
23 0x00000fd0    48 0x00200fd0    48 -rw- .got
24 0x00001000    32 0x00201000    32 -rw- .got.plt
25 0x00001020    16 0x00201020    16 -rw- .data
26 0x00001030     0 0x00201030     8 -rw- .bss
27 0x00001030    45 0x00000000    45 ---- .comment
28 0x00001060  1632 0x00000000  1632 ---- .symtab
29 0x000016c0   565 0x00000000   565 ---- .strtab
30 0x000018f5   268 0x00000000   268 ---- .shstrtab

Second, use iS to check if we are nicely using the current section by printing the current section.

[0x00000580]> iS.
Current section
00 0x00000580   466 0x00000580   466 -r-x .text

Thirdly fill free to do px 0x00000580 to display the whole content.

[0x00000580]> px 0x00000580
- offset -   0 1  2 3  4 5  6 7  8 9  A B  C D  E F  0123456789ABCDEF
0x00000580  31ed 4989 d15e 4889 e248 83e4 f050 544c  1.I..^H..H...PTL
0x00000590  8d05 ba01 0000 488d 0d43 0100 0048 8d3d  ......H..C...H.=
0x000005a0  0c01 0000 ff15 2e0a 2000 f40f 1f44 0000  ........ ....D..
0x000005b0  488d 3d79 0a20 0048 8d05 790a 2000 5548  H.=y. .H..y. .UH
0x000005c0  29f8 4889 e548 83f8 0e76 1548 8b05 fe09  ).H..H...v.H....
0x000005d0  2000 4885 c074 095d ffe0 660f 1f44 0000   .H..t.]..f..D..
0x000005e0  5dc3 0f1f 4000 662e 0f1f 8400 0000 0000  ][email protected].........
0x000005f0  488d 3d39 0a20 0048 8d35 320a 2000 5548  H.=9. .H.52. .UH
0x00000600  29fe 4889 e548 c1fe 0348 89f0 48c1 e83f  ).H..H...H..H..?
0x00000610  4801 c648 d1fe 7418 488b 05d1 0920 0048  H..H..t.H.... .H
0x00000620  85c0 740c 5dff e066 0f1f 8400 0000 0000  ..t.]..f........
0x00000630  5dc3 0f1f 4000 662e 0f1f 8400 0000 0000  ][email protected].........
0x00000640  803d e909 2000 0075 2748 833d a709 2000  .=.. ..u'H.=.. .
0x00000650  0055 4889 e574 0c48 8b3d ca09 2000 e80d  .UH..t.H.=.. ...
0x00000660  ffff ffe8 48ff ffff 5dc6 05c0 0920 0001  ....H...].... ..
0x00000670  f3c3 0f1f 4000 662e 0f1f 8400 0000 0000  [email protected].........
0x00000680  488d 3d61 0720 0048 833f 0075 0be9 5eff  H.=a. .H.?.u..^.
0x00000690  ffff 660f 1f44 0000 488b 0549 0920 0048  ..f..D..H..I. .H
0x000006a0  85c0 74e9 5548 89e5 ffd0 5de9 40ff ffff  ..t.UH....].@...
0x000006b0  5548 89e5 4883 ec10 897d fc48 8975 f048  UH..H....}.H.u.H
0x000006c0  8d3d 9e00 0000 e895 feff ffb8 0000 0000  .=..............
0x000006d0  c9c3 662e 0f1f 8400 0000 0000 0f1f 4000  ..f...........@.
0x000006e0  4157 4156 4189 ff41 5541 544c 8d25 e606  AWAVA..AUATL.%..
0x000006f0  2000 5548 8d2d e606 2000 5349 89f6 4989   .UH.-.. .SI..I.
0x00000700  d54c 29e5 4883 ec08 48c1 fd03 e81f feff  .L).H...H.......
0x00000710  ff48 85ed 7420 31db 0f1f 8400 0000 0000  .H..t 1.........
0x00000720  4c89 ea4c 89f6 4489 ff41 ff14 dc48 83c3  L..L..D..A...H..
0x00000730  0148 39dd 75ea 4883 c408 5b5d 415c 415d  .H9.u.H...[]A\A]
0x00000740  415e 415f c390 662e 0f1f 8400 0000 0000  A^A_..f.........
0x00000750  f3c3 0000 4883 ec08 4883 c408 c300 0000  ....H...H.......
0x00000760  0100 0200 6865 6c6c 6f20 776f 726c 6400  ....hello world.
0x00000770  011b 033b 3c00 0000 0600 0000 e0fd ffff  ...;<...........
0x00000780  8800 0000 00fe ffff b000 0000 10fe ffff  ................
0x00000790  5800 0000 40ff ffff c800 0000 70ff ffff  [email protected]...
0x000007a0  e800 0000 e0ff ffff 3001 0000 0000 0000  ........0.......
0x000007b0  1400 0000 0000 0000 017a 5200 0178 1001  .........zR..x..
0x000007c0  1b0c 0708 9001 0710 1400 0000 1c00 0000  ................
0x000007d0  b0fd ffff 2b00 0000 0000 0000 0000 0000  ....+...........
0x000007e0  1400 0000 0000 0000 017a 5200 0178 1001  .........zR..x..
0x000007f0  1b0c 0708 9001 0000 2400 0000 1c00 0000  ........$.......
0x00000800  50fd ffff 2000 0000 000e 1046 0e18 4a0f  P... ......F..J.
0x00000810  0b77 0880 003f 1a3b 2a33 2422 0000 0000  .w...?.;*3$"....
0x00000820  1400 0000 4400 0000 48fd ffff 0800 0000  ....D...H.......
0x00000830  0000 0000 0000 0000 1c00 0000 5c00 0000  ............\...
0x00000840  70fe ffff 2200 0000 0041 0e10 8602 430d  p..."....A....C.
0x00000850  065d 0c07 0800 0000 4400 0000 7c00 0000  .]......D...|...
0x00000860  80fe ffff 6500 0000 0042 0e10 8f02 420e  ....e....B....B.
0x00000870  188e 0345 0e20 8d04 420e 288c 0548 0e30  ...E. ..B.(..H.0
0x00000880  8606 480e 3883 074d 0e40 720e 3841 0e30  [email protected]
0x00000890  410e 2842 0e20 420e 1842 0e10 420e 0800  A.(B. B..B..B...
0x000008a0  1400 0000 c400 0000 a8fe ffff 0200 0000  ................
0x000008b0  0000 0000 0000 0000 0000 0000 ffff ffff  ................
0x000008c0  ffff ffff ffff ffff ffff ffff ffff ffff  ................
0x000008d0  ffff ffff ffff ffff ffff ffff ffff ffff  ................
0x000008e0  ffff ffff ffff ffff ffff ffff ffff ffff  ................
0x000008f0  ffff ffff ffff ffff ffff ffff ffff ffff  ................
0x00000900  ffff ffff ffff ffff ffff ffff ffff ffff  ................
0x00000910  ffff ffff ffff ffff ffff ffff ffff ffff  ................
0x00000920  ffff ffff ffff ffff ffff ffff ffff ffff  ................
0x00000930  ffff ffff ffff ffff ffff ffff ffff ffff  ................
0x00000940  ffff ffff ffff ffff ffff ffff ffff ffff  ................
0x00000950  ffff ffff ffff ffff ffff ffff ffff ffff  ................
0x00000960  ffff ffff ffff ffff ffff ffff ffff ffff  ................
0x00000970  ffff ffff ffff ffff ffff ffff ffff ffff  ................
0x00000980  ffff ffff ffff ffff ffff ffff ffff ffff  ................
0x00000990  ffff ffff ffff ffff ffff ffff ffff ffff  ................
0x000009a0  ffff ffff ffff ffff ffff ffff ffff ffff  ................
0x000009b0  ffff ffff ffff ffff ffff ffff ffff ffff  ................
0x000009c0  ffff ffff ffff ffff ffff ffff ffff ffff  ................
0x000009d0  ffff ffff ffff ffff ffff ffff ffff ffff  ................
0x000009e0  ffff ffff ffff ffff ffff ffff ffff ffff  ................
0x000009f0  ffff ffff ffff ffff ffff ffff ffff ffff  ................
0x00000a00  ffff ffff ffff ffff ffff ffff ffff ffff  ................
0x00000a10  ffff ffff ffff ffff ffff ffff ffff ffff  ................
0x00000a20  ffff ffff ffff ffff ffff ffff ffff ffff  ................
0x00000a30  ffff ffff ffff ffff ffff ffff ffff ffff  ................
0x00000a40  ffff ffff ffff ffff ffff ffff ffff ffff  ................
0x00000a50  ffff ffff ffff ffff ffff ffff ffff ffff  ................
0x00000a60  ffff ffff ffff ffff ffff ffff ffff ffff  ................
0x00000a70  ffff ffff ffff ffff ffff ffff ffff ffff  ................
0x00000a80  ffff ffff ffff ffff ffff ffff ffff ffff  ................
0x00000a90  ffff ffff ffff ffff ffff ffff ffff ffff  ................
0x00000aa0  ffff ffff ffff ffff ffff ffff ffff ffff  ................
0x00000ab0  ffff ffff ffff ffff ffff ffff ffff ffff  ................
0x00000ac0  ffff ffff ffff ffff ffff ffff ffff ffff  ................
0x00000ad0  ffff ffff ffff ffff ffff ffff ffff ffff  ................
0x00000ae0  ffff ffff ffff ffff ffff ffff ffff ffff  ................
0x00000af0  ffff ffff ffff ffff ffff ffff ffff ffff  ................

And last but not least, do not use Sd text.bin

Instead use:

[0x00000580]> iO d/S/.text > text.bin
Improve this answer
3
  • 1
    If S doesn't work, why would Sd work?
    – Evan Carroll
    Commented Sep 1, 2019 at 18:43
  • 1
    I noticed your comment @EvanCarroll and I modified my post.
    – ultimate-anti-reversing
    Commented Feb 22, 2020 at 16:03
  • 1
    This should be the accepted answer. The old commands are deprecated.
    – jsaigle
    Commented Apr 2, 2022 at 4:28

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.