1

When I run is to show the symbols, I see

[Symbols]
004 0x000000f0 0x006000f0  LOCAL NOTYPE    0 text1
005 0x000000cb 0x004000cb  LOCAL NOTYPE    0 _print
006 0x000000d1 0x004000d1  LOCAL NOTYPE    0 _printLoop
008 0x000000f0 0x006000f0  LOCAL OBJECT    0 _GLOBAL_OFFSET_TABLE_
009 0x000000b0 0x004000b0 GLOBAL NOTYPE    0 _start
010 0x006000fe 0x006000fe GLOBAL NOTYPE    0 __bss_start
011 0x006000fe 0x006000fe GLOBAL NOTYPE    0 _edata
012 0x00600100 0x00600100 GLOBAL NOTYPE    0 _end

but when I run

[0x00000000]> s _start
[0x00000000]> s @_start
0x0

Nothing happens? How come that doesn't resolve to 0x004000b0? Doing afl, I see

[0x00000000]> afl
0x004000b0    3 63           entry0

I can seek to that

[0x00000000]> s entry0
[0x004000b0]> 

Why can I seek to entry0 but not to _start, they have the same address?

4

You can't seek to any symbol that shown by is, you can only seek to "flags" or addresses.

The f command is used to list all the flags from the selected flagspace. By default all the available flagspaces are selected. For example, in order to select the 'symbols' flagspace and list only the flags inside it, use:

[0x004049a0]> fs symbols
[0x004049a0]> f
0x00402a00 261 main
0x004049a0 41 entry0
0x0061e600 8 obj.__bss_start
0x00413c8c 9 sym._fini
0x0061e610 4 obj.optind
0x004022b8 26 sym._init
0x0061e620 8 obj.program_invocation_name
0x0061e600 0 loc.__bss_start
0x0061f368 0 loc._end
0x00412960 38 sym._obstack_memory_used
0x0061e5f8 8 obj.obstack_alloc_failed_handler
0x00412780 17 sym._obstack_begin
0x0061e640 8 obj.stderr
0x004128f0 106 sym._obstack_free
0x004128c0 48 sym._obstack_allocated_p
0x0061e618 8 obj.optarg
0x004127a0 21 sym._obstack_begin_1
0x004127c0 245 sym._obstack_newchunk
0x0061e608 8 obj.stdout

You can use radare's internal grep to find specific flags:

[0x00000000]> f~imp
0x004004d0 16 sym.imp.puts
0x004004e0 16 sym.imp.system
0x004004f0 16 sym.imp.__libc_start_main
0x00400500 16 sym.imp.strcmp
0x00400000 16 loc.imp.__gmon_start
0x00400510 16 sym.imp.__isoc99_scanf
1
  • Thanks a ton, I wonder why _start wasn't imported into the current flagspace, or how would I go about importing all symbols? Or specific symbols? – Evan Carroll Feb 4 '18 at 5:45

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.