4

When I disassemble a jmp I get:

[0x004073d4]> pd 1
            0x004073d4      ff2584804000   jmp dword [sym.imp.kernel32.dll_GetModuleHandleA] ; 0x408084 ; "j\x85"

Is there a command I can get the information contained in sym.imp.kernel32.dll_GetModuleHandleA by providing the address 0x408084? Preferably in Json as I'm using this for a script.

I searched a bit but could not find anything.

4

sym.imp.kernel32.dll_GetModuleHandleA is a flag radare2 defined for this address.

This flag name is combined from 4 parts:

  • sym for Symbols
  • imp for Imports
  • kernel32.dll is the name of the library
  • GetModuleHandleA is the name of the imported function in the library

To handle flags with radare2 you should use the f command and its subcommands. Use f? to list all of them.

For your case, the right way to get the flag name for a given address is to use the fd command like this:

[0x004073d4]> fd 0x408084 
sym.imp.kernel32.dll_GetModuleHandleA

You can split it to the function and the DLL name by using simple string manipulation with the programming language you are using to script radare.


On a personal note I will say that the best way to script with radare2 is to use r2pipe which is a very simple interface to radare2. You may already started using it but just in case, here's how simple it looks like with Python:

import r2pipe

r2 = r2pipe.open("/bin/ls")
r2.cmd("aa")
print(r2.cmd("afl"))
print(r2.cmdj("aflj"))  # evaluates JSONs and returns an object
r2.quit()

I suggest you to read the Radare2 Book to learn more about radare2 and how to use it.

| improve this answer | |
1
[0x01012d6c]> pd 1 @ 0x1012d89

| 0x01012d89    ff154c110001  call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]; 0x100114c

[0x01012d6c]> pxrj  4 @ 0x100114c

[{"addr":16781644,"value":2011045392,"ref":"reloc.KERNEL32.dll_GetStartupInfoA_16"}]
[0x01012d6c]>
| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.