7

I'm practicing with Radare2, latest commit.

radare2 2.3.0-git 16814 @ linux-x86-64 git.2.2.0-5-g61a903315

During my sessions, I need to rename local variables to a more understandable name, e.g.

var int local_110h @ rbp-0x110
:> afvn local_110h commandLine

Is there a command to inspect what's inside this variable and, eventually, what's pointing to?

I was expecting this:

px @ commandLine
px @ [commandLine]

But it doesn't work:

:>px @ commandLine
Invalid address (commandLine)
|ERROR| Invalid command 'px @ commandLine' (0x70)

Passing through rbp works flawlessly.

px @ rbp-0x100
5

You should use afvd.

[0x00402a00]> afv?
...
...
| afvd name     output r2 command for displaying the value of args/locals in the debugger
...
...

Executing only afvd will print you the values of all the local variables in the function, and if you'll execute it with a variable name you'll get radare2 command as a result:

[0x00402a00]> afvn local_110h commandLine
[0x00402a00]> afvd commandLine
pxr $w @rsp+0x110

you'll get pxr $w @rsp+0x110, which is a radare2 command.

You can add a dot . before it to execute it:

[0x00402a00]> .afvd commandLine
0x7fffdc9e9258  0x28ffedf4ccd19d64   d......(

If, for example, you only want the address, you can use radare's internal grep.

[0x00402a00]> .afvd commandLine~[0]
0x7fffdc9e9258

For more information about radare's grep, execute ~?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.