1

When I use a command like fs, I get output like

0    0 * strings
1    6 * symbols
2   14 * sections
3    0 * relocs

It's clear to me on the left is an incrementing number that represents the flagspace. It's not clear to me what the number on the right is; fs is defined as

Usage: fs [*] [+-][flagspace|addr] # Manage flagspaces
3

As @blabb said, this number represents the amount of flags in each flagspace.

So for your example:

0    0 * strings
1    6 * symbols
2   14 * sections
3    0 * relocs
  • The flagspace "strings" has 0 flags
  • The flagspace "symbols" has 6 flags
  • The flagspace "sections" has 14 flags
  • The flagspace "relocs" has 0 flags

But more generally, the title of your question asks whether there's "a way to get the headers with the Radare output?", the answer for this is yes.

Getting the headers

Some of radare's informative commands (which print information) shows you a key-value output. Take for example the ie command to print the entrypoints of the program:

[0x00400530]> ie
[Entrypoints]
vaddr=0x00400530 paddr=0x00000530 baddr=0x00400000 laddr=0x00000000 haddr=0x00000018 type=program

1 entrypoints

You can see that each value is printed with its key (vaddr, paddr, type and so on).

Other commands would not show you the headers, just as your example with the fs command. So what can you do to show this information? Simply, use the JSON representation of the output. Most of radare2's informative commands can be appended with a j to format the output as JSON.

So, for example, printing fsj will show you the flagspaces in JSON. I'll add ~{} to format the output with JSON indention for readabilty:

[0x00400530]> fsj~{}
[
  {
    "name": "strings",
    "count": 5,
    "selected": true
  },
  {
    "name": "symbols",
    "count": 36,
    "selected": false
  },
  {
    "name": "sections",
    "count": 82,
    "selected": false
  },
  {
    "name": "relocs",
    "count": 6,
    "selected": false
  },
  {
    "name": "imports",
    "count": 6,
    "selected": false
  }
]

As you can see, radare presents us with a simple JSON output that contains the headers (keys) for each value. This way you can easily spot the "count" header which is corresponding to the output without j.

  • 1
    Heh nice trick. Love it – Evan Carroll Feb 5 '18 at 15:58
0

Are you querying about The Count of Specific flagspace ?

[0x01012d6c]> fs
0 2105 . strings
1    1 . symbols
2    8 * sections
3  381 . relocs
4  381 . imports
5    0 . resources
[0x01012d6c]> fs symbols; f| wc -l
1
[0x01012d6c]> fs sections  ; f | wc -l
8
[0x01012d6c]> fs imports  ; f | wc -l
381
[0x01012d6c]>

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.