Reverse Engineering Stack Exchange is a question and answer site for researchers and developers who explore the principles of a system through analysis of its structure, function, and operation. It only takes a minute to sign up.
Sign up to join this community
I want to find an address of a symbol (e.g strcpy) inside a binary using radare2. I tried to use the f command to list all flags which are recognized by r2 but the list is enormous and it's not comfortable to find the address of a specific symbol that way.
What is the best way, if there's any, to do so.
The f command is used to list all the flags from the selected flagspace. By default all the available flagspaces are selected. In order to select the 'symbols' flagspace and list only the flags inside it, use:
[0x004049a0]> fs symbols
[0x004049a0]> f
0x00402a00 261 main
0x004049a0 41 entry0
0x0061e600 8 obj.__bss_start
0x00413c8c 9 sym._fini
0x0061e610 4 obj.optind
0x004022b8 26 sym._init
0x0061e620 8 obj.program_invocation_name
0x0061e600 0 loc.__bss_start
0x0061f368 0 loc._end
0x00412960 38 sym._obstack_memory_used
0x0061e5f8 8 obj.obstack_alloc_failed_handler
0x00412780 17 sym._obstack_begin
0x0061e640 8 obj.stderr
0x004128f0 106 sym._obstack_free
0x004128c0 48 sym._obstack_allocated_p
0x0061e618 8 obj.optarg
0x004127a0 21 sym._obstack_begin_1
0x004127c0 245 sym._obstack_newchunk
0x0061e608 8 obj.stdout
However, my preferred way to list all the symbols is to use the i command which actually uses 'rabin2' (man rabin2) to retrieve information about the binary. Use i? to get help about the command.
In order to list all the symbols run is.
If you want to "grep" for a specific symbol use radare's internal grep ~:
[0x004049a0]> is~strcpy
vaddr=0x004023c0 paddr=0x000023c0 ord=013 fwd=NONE sz=16 bind=GLOBAL type=FUNC name=imp.strcpy
And if you want only the address, use:
[0x004049a0]> is~strcpy[1]
0x004023c0
More information about flags and flagspaces can be found here
More information about symbols can be found here
