How do you print fixed width strings with radare's print format `pf`?

Question

Let's say I have a byte sequence where U is an unsigned int (4 bytes), and ccccccccccccccc is a 15 byte character array

UcccccccccccccccU

Is it possible to print this structure using pf? I can print this with

pf i;
ps 15 @ 4;
pf i @ 19;

If both of those integers were next to each other, I could do pf ii, and what I would like to do is something like pf is15i -- which doesn't work because s is for * char[] to a string, and not a char array.

If I do something like pf 5c, I get them outputted as single characters (ex.,)

0x00000008 [0] {
  0x00000008 = '6'
}
0x00000009 [1] {
  0x00000009 = '0'
}
0x0000000a [2] {
  0x0000000a = '0'
}

Answer 1

To understand how to use pf the way you want, we should go over it step-by-step.

I opened an empty memory for a radare2 playground:

$ r2 malloc://200
[0x00000000]>

Next, I wrote date to this playground, inspired by your example:

[0x00000000]> wx AABBCCDD @ 0
[0x00000000]> w ccccccccccccccc @ 4
[0x00000000]> wx 11223344 @ 19

Basically, I wrote 4 bytes, followed by 15 characters and then other 4 bytes. This is how it looks in the memory:

[0x00000000]> px 32
- offset -   0 1  2 3  4 5  6 7  8 9  A B  C D  E F  0123456789ABCDEF
0x00000000  aabb ccdd 6363 6363 6363 6363 6363 6363  ....cccccccccccc
0x00000010  6363 6311 2233 4400 0000 0000 0000 0000  ccc."3D.........

To print this structure I did something like this:

[0x00000000]> pf x[15]zx
0x00000000 = 0xddccbbaa
0x00000004 = ccccccccccccccc
0x00000013 = 0x44332211

As you already know, pf is used to print formatted data. By using pf?? and pf??? you can see examples and understand each part of my command.

You can use i instead of x if you want to print integers.

[0x00000000]> pf i[15]zi 1st 2nd third
   1st : 0x00000000 = -573785174
   2nd : 0x00000004 = ccccccccccccccc
 third : 0x00000013 = 1144201745

My structure consists of 4 parts:

• pf command
• x where x is being used to print hex value (of 4 bytes)
• [15]z to print 15 characters of a string
• x to print another hex value

You can also name the fields:

[0x00000000]> pf x[15]zx 1st 2nd third
   1st : 0x00000000 = 0xddccbbaa
   2nd : 0x00000004 = ccccccccccccccc
 third : 0x00000013 = 0x44332211

You can use other format characters such as e to swap endians, etc