6

I want to find an address of a symbol (e.g strcpy) inside a binary using radare2. I tried to use the f command to list all flags which are recognized by r2 but the list is enormous and it's not comfortable to find the address of a specific symbol that way.

What is the best way, if there's any, to do so.

8

The f command is used to list all the flags from the selected flagspace. By default all the available flagspaces are selected. In order to select the 'symbols' flagspace and list only the flags inside it, use:

[0x004049a0]> fs symbols
[0x004049a0]> f
0x00402a00 261 main
0x004049a0 41 entry0
0x0061e600 8 obj.__bss_start
0x00413c8c 9 sym._fini
0x0061e610 4 obj.optind
0x004022b8 26 sym._init
0x0061e620 8 obj.program_invocation_name
0x0061e600 0 loc.__bss_start
0x0061f368 0 loc._end
0x00412960 38 sym._obstack_memory_used
0x0061e5f8 8 obj.obstack_alloc_failed_handler
0x00412780 17 sym._obstack_begin
0x0061e640 8 obj.stderr
0x004128f0 106 sym._obstack_free
0x004128c0 48 sym._obstack_allocated_p
0x0061e618 8 obj.optarg
0x004127a0 21 sym._obstack_begin_1
0x004127c0 245 sym._obstack_newchunk
0x0061e608 8 obj.stdout

However, my preferred way to list all the symbols is to use the i command which actually uses 'rabin2' (man rabin2) to retrieve information about the binary. Use i? to get help about the command.

In order to list all the symbols run is. If you want to "grep" for a specific symbol use radare's internal grep ~:

[0x004049a0]> is~strcpy
vaddr=0x004023c0 paddr=0x000023c0 ord=013 fwd=NONE sz=16 bind=GLOBAL type=FUNC name=imp.strcpy

And if you want only the address, use:

[0x004049a0]> is~strcpy[1]
0x004023c0

More information about flags and flagspaces can be found here
More information about symbols can be found here

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.