2

Let's say I have a byte sequence where U is an unsigned int (4 bytes), and ccccccccccccccc is a 15 byte character array

UcccccccccccccccU

Is it possible to print this structure using pf? I can print this with

pf i;
ps 15 @ 4;
pf i @ 19;

If both of those integers were next to each other, I could do pf ii, and what I would like to do is something like pf is15i -- which doesn't work because s is for * char[] to a string, and not a char array.

If I do something like pf 5c, I get them outputted as single characters (ex.,)

0x00000008 [0] {
  0x00000008 = '6'
}
0x00000009 [1] {
  0x00000009 = '0'
}
0x0000000a [2] {
  0x0000000a = '0'
}
4

To understand how to use pf the way you want, we should go over it step-by-step.

I opened an empty memory for a radare2 playground:

$ r2 malloc://200
[0x00000000]>

Next, I wrote date to this playground, inspired by your example:

[0x00000000]> wx AABBCCDD @ 0
[0x00000000]> w ccccccccccccccc @ 4
[0x00000000]> wx 11223344 @ 19

Basically, I wrote 4 bytes, followed by 15 characters and then other 4 bytes. This is how it looks in the memory:

[0x00000000]> px 32
- offset -   0 1  2 3  4 5  6 7  8 9  A B  C D  E F  0123456789ABCDEF
0x00000000  aabb ccdd 6363 6363 6363 6363 6363 6363  ....cccccccccccc
0x00000010  6363 6311 2233 4400 0000 0000 0000 0000  ccc."3D.........

To print this structure I did something like this:

[0x00000000]> pf x[15]zx
0x00000000 = 0xddccbbaa
0x00000004 = ccccccccccccccc
0x00000013 = 0x44332211

As you already know, pf is used to print formatted data. By using pf?? and pf??? you can see examples and understand each part of my command.

You can use i instead of x if you want to print integers.

[0x00000000]> pf i[15]zi 1st 2nd third
   1st : 0x00000000 = -573785174
   2nd : 0x00000004 = ccccccccccccccc
 third : 0x00000013 = 1144201745

My structure consists of 4 parts:

  • pf command
  • x where x is being used to print hex value (of 4 bytes)
  • [15]z to print 15 characters of a string
  • x to print another hex value

You can also name the fields:

[0x00000000]> pf x[15]zx 1st 2nd third
   1st : 0x00000000 = 0xddccbbaa
   2nd : 0x00000004 = ccccccccccccccc
 third : 0x00000013 = 0x44332211

You can use other format characters such as e to swap endians, etc

  • I understand most of that, but where did you [15]z from the syntax? I tried c15 as a syntax which seemed more intuitive. Also what will yours do if the 15-characters is \0\0foo\0\bar, ie not a c-string? – Evan Carroll Jun 27 '18 at 19:56
  • Lol it's documented like this pf: pf[.k[.f[=v]]|[v]]|[n]|[0|cnt][fmt] [a0 a1 ...] That's the [0|cnt] with the mandatory [] ....well that's totally user-friendly. – Evan Carroll Jun 27 '18 at 19:59
  • It is documented at pf???. And for your foo-bar example -- assume we have the following bytes in memory: aabbccdd0000666f6f0062617200eeff1122, You can print it with: pf x..zzx and you'll get 4 fields: 4 bytes hex, "foo", "bar" and another 4 bytes hex. – Megabeets Jun 27 '18 at 20:09
  • Yep, all this checks out and works -- though I have to wonder why for z the length [15]z and for N, it's N1 – Evan Carroll Jun 27 '18 at 22:38

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.