1

Lets suppose I have a memory address. This address points to an instruction. This instruction is inside a function.

Is there a way to ask radare2 to search the beginning of this function, given the memory address of the instruction ?

1

Yes, you can do it.

If you are seeked on a given memory address you can get the current function where you are with:

afi.

Now if you want to seek to the beginning of the function you can make it with:

s `afi.`

If you just want to get the address of the beginning of the function but don't want to seek into it, just use the temporary modifier @:

s @ `afi.`

This will return the memory address where the function is located.

Of course you can get that information on any memory address without having to be seeked by using again the @ modifier.

s @ `afi. @ 0x????????`

Where 0x???????? is any memory address you want to know where the function it is contained in begins. This approach can be pretty useful while scripting with r2pipe, for example.

PS: backticks are used to get as input the output of command between them.

1

You need to go the address by using the s addr command but after that, you can just use a shorthand to going to the beginning of the function you are in.

Just type: sf. to get to the beginning.

Just refer to the help if needed:

> s?
Usage: s    # Help for the seek commands. See ?$? to see all variables

| s addr            Seek to address
...
| sf.               Seek to the beginning of current function
...

You can also combine the two commands with ;:

s 0x100001238; sf.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.