Since the question in the subject is slightly different than the question in the body of your question, I'll focus on the first one.
Disassemble at a specific address
In order to disassemble the code at a specific memory address using radare2 you should use the pd @ <address>
command.
pd[?] [sz] [a] [b] — disassemble N opcodes (pd) or N bytes
(pD)
After attaching radare to the program you should be able to print the disassembly in this specific address. Assuming the pid
of the program is 317:
$ radare2 -d 317
= attach 317 317
bin.baddr 0x00400000
Using 0x400000
asm.bits 64
[0x7f2e51727230]> pd @ <address>
pd
is a subcommand of p
and stands for print disassembly. You can check p?
and especially pd?
for more relevant subcommands. Adding ?
at the end of most of the commands in radare will print its help and its subcommands. By default, pd
prints b instructions from the specified address where b is the default basic-block size. The default size of b is 0x100 but you can change it easily using b <size>
.
The @
sign is radare's temporary seek address so whenever you want to print the disassembly in a specific address you should use it. The number specified before the @
sign is the number of instructions to print. A common mistake is executing pd
with the address before @
. Thus, executing pd 0x400000
would print 0x400000 instructions from the current seek.
The exception
You received "Unknown exception e06d7363" which is an exception generated by Microsoft Visual C++ compiler.
As stated in Microsoft's support page:
Cause
All Visual C++ exceptions thrown from code generated by the
Microsoft Visual C++ compiler contain this error code. Because this is
a compiler-generated error, the code is not listed in the Win32 API
header files. The code is actually a cryptic mnemonic device, with the
initial "E" standing for "exception" and the final 3 bytes (0x6D7363)
representing the ASCII values of "msc".
To continue your analysis I'd suggest you to read Decoding the parameters of a thrown C++ exception (0xE06D7363) and its revisited article.
Note that the addresses of the executable in the memory might change in each run, depends on your system and the program itself. Therefore, sometimes you won't be able to predict what would be the address which causes the exception.
Check the Migration from ida, GDB or WinDBG page from radare2 book to see radare's corresponding commands to WinDBG's.
r2 -d program.exe