How To Print Addresses in Radare2

Question

I'm switching over to Radare2 from GDB mixed with peda. One of the things I love about GDB, is the p command. For example, p system prints out the address of system. As well, peda's searchmem function is wonderful for uses such as searchmem SHELL. In Radare2, I have no idea how to achieve this. I've been Google'ing to the high heavens to no avail. Does anyone know if Radare2 has this ability?

Answer 1

To print the address of system export of libc with radare2 you can use dmi libc system

First you need to open radare2 and continue executing until you reach the program’s entrypoint. You have to do this because radare2 is starting its debugging before libc is loaded. When you’ll reach the entrypoint, the library would probably be loaded.

Now use the dmi command and pass it libc and the desired function.

$ r2 -d binary_name

[0xf771ab30]> dcu entry0
Continue until 0x080483d0 using 1 bpsize
hit breakpoint at: 80483d0

[0x080483d0]> dmi libc system

Worth to mention here, that after the analysis (see a?) radare2 associates names to interesting offsets in the file such as Sections, Function, Symbols, Strings, etc. Those names are called ‘flags’. You can print the flags and their addresses with f. For more help see f? and read the "flags" chapter in radare2 book.

To know how to print different addresses and flags in different ways I'd recommend trying the p? command and reading the "Printing" chapter.

---

Searching in radare2, including in memory, can be done with the / command. You can get more help about the available search commands by using /?. I highly recommend reading the "Search" chapter in radare2 book. See my answer here for example.

---

References

• radare2 book
• Exploitation using radare2

Answer 2

From the peda source code:

 def searchmem(self, start, end, search, mem=None):
        """
        Search for all instances of a pattern in memory from start to end
        Args:
            - start: start address (Int)
            - end: end address (Int)
            - search: string or python regex pattern (String)
            - mem: cached mem to not re-read for repeated searches (raw bytes)
        Returns:
            - list of found result: (address(Int), hex encoded value(String))
        """

This sounds quite similar to r2's searching capability:

The radare2 search engine is based on work done by esteve, plus multiple features implemented on top of it. It supports multiple keyword searches, binary masks, and hexadecimal values. It automatically creates flags for search hit locations ease future referencing.

Search is initiated by / command.

[0x00000000]> /?
|Usage: /[amx/] [arg]Search stuff (see 'e??search' for options)
| / foo\x00           search for string 'foo\0'
| /j foo\x00          search for string 'foo\0' (json output)
| /! ff               search for first occurrence not matching
| /+ /bin/sh          construct the string with chunks
| /!x 00              inverse hexa search (find first byte != 0x00)
| //                  repeat last search
| /h[t] [hash] [len]  find block matching this hash. See /#?
| /a jmp eax          assemble opcode and search its bytes
| /A jmp              find analyzed instructions of this type (/A? for help)
| /b                  search backwards
| /B                  search recognized RBin headers
| /c jmp [esp]        search for asm code
| /C[ar]              search for crypto materials
| /d 101112           search for a deltified sequence of bytes
| /e /E.F/i           match regular expression
| /E esil-expr        offset matching given esil expressions %%= here
| /f file [off] [sz]  search contents of file with offset and size
| /i foo              search for string 'foo' ignoring case
| /m magicfile        search for matching magic file (use blocksize)
| /o                  show offset of previous instruction
| /p patternsize      search for pattern of given size
| /P patternsize      search similar blocks
| /r[e] sym.printf    analyze opcode reference an offset (/re for esil)
| /R [grepopcode]     search for matching ROP gadgets, semicolon-separated
| /v[1248] value      look for an `cfg.bigendian` 32bit value
| /V[1248] min max    look for an `cfg.bigendian` 32bit value in range
| /w foo              search for wide string 'f\0o\0o\0'
| /wi foo             search for wide string ignoring case 'f\0o\0o\0'
| /x ff..33           search for hex string ignoring some nibbles
| /x ff0033           search for hex string
| /x ff43 ffd0        search for hexpair with mask
| /z min max          search for strings of given size