How can you get the symbol visibility with radare?

Question

I created a quick x86_64 Assembly file with NASM to generate the four different visibility classes for ELF 64. With readelf --symbols I get the Symbol Visibility in the Vis column: DEFAULT, INTERNAL, HIDDEN, PROTECTED.

Symbol table '.symtab' contains 16 entries:
   Num:    Value          Size Type    Bind   Vis      Ndx Name
     4: 000000000040007e     0 OBJECT  GLOBAL PROTECTED    1 gdp
     5: 0000000000400082     0 FUNC    GLOBAL HIDDEN     2 gfh
     6: 000000000040007a     0 OBJECT  GLOBAL INTERNAL    1 gdi
     8: 000000000040007c     0 OBJECT  GLOBAL HIDDEN     1 gdh
     9: 0000000000400083     0 FUNC    GLOBAL PROTECTED    2 gfp
    11: 0000000000400078     0 OBJECT  GLOBAL DEFAULT    1 gdd
    14: 0000000000400081     0 FUNC    GLOBAL INTERNAL    2 gfi
    15: 0000000000400080     0 FUNC    GLOBAL DEFAULT    2 gfd

These symbols are encoded such that

• First character: g means they're GLOBAL (NASM) -- they all are.
• Middle character: f means they're "Function", d means they're Data
• Last character: default, internal, hidden, protected.

However with radare I can't figure out how to see the visibility that readelf --symbols shows is available. Using fs symbols; f

0x0040007e 0 obj.gdp
0x00400082 0 sym.gfh
0x0040007a 0 obj.gdi
0x0040007c 0 obj.gdh
0x00400083 0 sym.gfp
0x00400078 0 obj.gdd
0x00400081 0 sym.gfi
0x00400080 0 sym.gfd

Clearly, sym is a function and obj is data. But how can I get radare to show me the visibility?

Answer 1

afaik, Symbol Visibility is not available in radare2. The closest to this you can get are the symbol bindings and types. You can do this with the is command which is responsible for showing symbols.

$ r2 /bin/echo
 -- What do you want to debug today?
[0x00401800]> is
[Symbols]
050 0x00007228 0x00607228 GLOBAL    OBJ    8 stdout
051 0x00007220 0x00607220 GLOBAL    OBJ    8 program_invocation_short_name
052 0x00007230 0x00607230   WEAK    OBJ    8 __progname_full
053 0x00007230 0x00607230 GLOBAL    OBJ    8 __progname_full
054 0x00007220 0x00607220   WEAK    OBJ    8 program_invocation_short_name
055 0x00007240 0x00607240 GLOBAL    OBJ    8 stderr
001 0x00001070 0x00401070 GLOBAL   FUNC   16 imp.__uflow
002 0x00001080 0x00401080 GLOBAL   FUNC   16 imp.getenv
003 0x00001090 0x00401090 GLOBAL   FUNC   16 imp.free
...
026 0x00001200 0x00401200 GLOBAL   FUNC   16 imp.calloc
027 0x00001210 0x00401210 GLOBAL   FUNC   16 imp.strcmp
028 0x00000000 0x00400000   WEAK NOTYPE   16 imp.__gmon_start__
029 0x00001220 0x00401220 GLOBAL   FUNC   16 imp.memcpy
...

You can also print it in a formatted Json format by appending j~{} to the command:

[0x00401800]> isj~{}
[
  {
    "name": "stdout",
    "demname": "",
    "flagname": "obj.stdout",
    "ordinal": 50,
    "bind": "GLOBAL",
    "size": 8,
    "type": "OBJ",
    "vaddr": 6320680,
    "paddr": 29224
  },
  {
    "name": "program_invocation_short_name",
    "demname": "",
    "flagname": "obj.program_invocation_short_name",
    "ordinal": 51,
    "bind": "GLOBAL",
    "size": 8,
    "type": "OBJ",
    "vaddr": 6320672,
    "paddr": 29216
  },
  {
    "name": "__progname_full",
    "demname": "",
    "flagname": "obj.__progname_full",
    "ordinal": 52,
    "bind": "WEAK",
    "size": 8,
    "type": "OBJ",
    "vaddr": 6320688,
    "paddr": 29232
  },