# How do you print fixed width strings with radare's print format pf?

Let's say I have a byte sequence where U is an unsigned int (4 bytes), and ccccccccccccccc is a 15 byte character array

UcccccccccccccccU


Is it possible to print this structure using pf? I can print this with

pf i;
ps 15 @ 4;
pf i @ 19;


If both of those integers were next to each other, I could do pf ii, and what I would like to do is something like pf is15i -- which doesn't work because s is for * char[] to a string, and not a char array.

If I do something like pf 5c, I get them outputted as single characters (ex.,)

0x00000008 [0] {
0x00000008 = '6'
}
0x00000009 [1] {
0x00000009 = '0'
}
0x0000000a [2] {
0x0000000a = '0'
}


To understand how to use pf the way you want, we should go over it step-by-step.

I opened an empty memory for a radare2 playground:

\$ r2 malloc://200
[0x00000000]>


Next, I wrote date to this playground, inspired by your example:

[0x00000000]> wx AABBCCDD @ 0
[0x00000000]> w ccccccccccccccc @ 4
[0x00000000]> wx 11223344 @ 19


Basically, I wrote 4 bytes, followed by 15 characters and then other 4 bytes. This is how it looks in the memory:

[0x00000000]> px 32
- offset -   0 1  2 3  4 5  6 7  8 9  A B  C D  E F  0123456789ABCDEF
0x00000000  aabb ccdd 6363 6363 6363 6363 6363 6363  ....cccccccccccc
0x00000010  6363 6311 2233 4400 0000 0000 0000 0000  ccc."3D.........


To print this structure I did something like this:

[0x00000000]> pf x[15]zx
0x00000000 = 0xddccbbaa
0x00000004 = ccccccccccccccc
0x00000013 = 0x44332211


As you already know, pf is used to print formatted data. By using pf?? and pf??? you can see examples and understand each part of my command.

You can use i instead of x if you want to print integers.

[0x00000000]> pf i[15]zi 1st 2nd third
1st : 0x00000000 = -573785174
2nd : 0x00000004 = ccccccccccccccc
third : 0x00000013 = 1144201745


My structure consists of 4 parts:

• pf command
• x where x is being used to print hex value (of 4 bytes)
• [15]z to print 15 characters of a string
• x to print another hex value

You can also name the fields:

[0x00000000]> pf x[15]zx 1st 2nd third
1st : 0x00000000 = 0xddccbbaa
2nd : 0x00000004 = ccccccccccccccc
third : 0x00000013 = 0x44332211


You can use other format characters such as e to swap endians, etc

• I understand most of that, but where did you [15]z from the syntax? I tried c15 as a syntax which seemed more intuitive. Also what will yours do if the 15-characters is \0\0foo\0\bar, ie not a c-string? – Evan Carroll Jun 27 '18 at 19:56
• Lol it's documented like this pf: pf[.k[.f[=v]]|[v]]|[n]|[0|cnt][fmt] [a0 a1 ...] That's the [0|cnt] with the mandatory [] ....well that's totally user-friendly. – Evan Carroll Jun 27 '18 at 19:59
• It is documented at pf???. And for your foo-bar example -- assume we have the following bytes in memory: aabbccdd0000666f6f0062617200eeff1122, You can print it with: pf x..zzx and you'll get 4 fields: 4 bytes hex, "foo", "bar" and another 4 bytes hex. – Megabeets Jun 27 '18 at 20:09
• Yep, all this checks out and works -- though I have to wonder why for z the length [15]z and for N, it's N1 – Evan Carroll Jun 27 '18 at 22:38