radare2 get API library and name from address

Question

When I disassemble a jmp I get:

[0x004073d4]> pd 1
            0x004073d4      ff2584804000   jmp dword [sym.imp.kernel32.dll_GetModuleHandleA] ; 0x408084 ; "j\x85"

Is there a command I can get the information contained in sym.imp.kernel32.dll_GetModuleHandleA by providing the address 0x408084? Preferably in Json as I'm using this for a script.

I searched a bit but could not find anything.

Answer 1

sym.imp.kernel32.dll_GetModuleHandleA is a flag radare2 defined for this address.

This flag name is combined from 4 parts:

• sym for Symbols
• imp for Imports
• kernel32.dll is the name of the library
• GetModuleHandleA is the name of the imported function in the library

To handle flags with radare2 you should use the f command and its subcommands. Use f? to list all of them.

For your case, the right way to get the flag name for a given address is to use the fd command like this:

[0x004073d4]> fd 0x408084 
sym.imp.kernel32.dll_GetModuleHandleA

You can split it to the function and the DLL name by using simple string manipulation with the programming language you are using to script radare.

---

On a personal note I will say that the best way to script with radare2 is to use r2pipe which is a very simple interface to radare2. You may already started using it but just in case, here's how simple it looks like with Python:

import r2pipe

r2 = r2pipe.open("/bin/ls")
r2.cmd("aa")
print(r2.cmd("afl"))
print(r2.cmdj("aflj"))  # evaluates JSONs and returns an object
r2.quit()

I suggest you to read the Radare2 Book to learn more about radare2 and how to use it.

Answer 2

[0x01012d6c]> pd 1 @ 0x1012d89

| 0x01012d89    ff154c110001  call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]; 0x100114c

[0x01012d6c]> pxrj  4 @ 0x100114c

[{"addr":16781644,"value":2011045392,"ref":"reloc.KERNEL32.dll_GetStartupInfoA_16"}]
[0x01012d6c]>