Disassembling at a memory address

Question

I started to use radare2 to debug a PE file because it stops working as soon as I run it. When I attach my debugger and continue execution to the point where the exception is thrown I get a memory address in which the exception occurred.

What can I do with this address to further analyze the problem at hand?

c484f\mscorlib.ni.dll) mscorlib.ni.dll
(14116) loading library at 77130000 (C:\Windows\SysWOW64\ole32.dll) ole32.dll
(14116) loading library at 70100000 (C:\Windows\SysWOW64\uxtheme.dll) uxtheme.dll
(14116) loading library at 700A0000 (C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorjit.dll) mscorjit.dll
(14116) loading library at 6C3C0000 (C:\Windows\Microsoft.NET\Framework\v2.0.50727\Culture.dll) Culture.dll
(14116) unloading library at 6C3C0000 (C:\Windows\Microsoft.NET\Framework\v2.0.50727\Culture.dll) Culture.dll
(14116) Unknown exception e06d7363 in thread 10352

Answer 1

Since the question in the subject is slightly different than the question in the body of your question, I'll focus on the first one.

Disassemble at a specific address

In order to disassemble the code at a specific memory address using radare2 you should use the pd @ <address> command.

pd[?] [sz] [a] [b] — disassemble N opcodes (pd) or N bytes (pD)

After attaching radare to the program you should be able to print the disassembly in this specific address. Assuming the pid of the program is 317:

$ radare2 -d 317
= attach 317 317
bin.baddr 0x00400000
Using 0x400000
asm.bits 64

[0x7f2e51727230]> pd @ <address>

pd is a subcommand of p and stands for print disassembly. You can check p? and especially pd? for more relevant subcommands. Adding ? at the end of most of the commands in radare will print its help and its subcommands. By default, pd prints b instructions from the specified address where b is the default basic-block size. The default size of b is 0x100 but you can change it easily using b <size>.

The @ sign is radare's temporary seek address so whenever you want to print the disassembly in a specific address you should use it. The number specified before the @ sign is the number of instructions to print. A common mistake is executing pd with the address before @. Thus, executing pd 0x400000 would print 0x400000 instructions from the current seek.

---

The exception

You received "Unknown exception e06d7363" which is an exception generated by Microsoft Visual C++ compiler.

As stated in Microsoft's support page:

Cause
All Visual C++ exceptions thrown from code generated by the Microsoft Visual C++ compiler contain this error code. Because this is a compiler-generated error, the code is not listed in the Win32 API header files. The code is actually a cryptic mnemonic device, with the initial "E" standing for "exception" and the final 3 bytes (0x6D7363) representing the ASCII values of "msc".

To continue your analysis I'd suggest you to read Decoding the parameters of a thrown C++ exception (0xE06D7363) and its revisited article.

Note that the addresses of the executable in the memory might change in each run, depends on your system and the program itself. Therefore, sometimes you won't be able to predict what would be the address which causes the exception.

Check the Migration from ida, GDB or WinDBG page from radare2 book to see radare's corresponding commands to WinDBG's.

Answer 2

From the manual:

• 'p' stands for print.
• 'd' stands for disassemble (raw usually)

Try:

pd @ 0xYourAddress

Note: I am unsure if this will work in the event of an exception.