Radare2 has an option, p-,

Usage: p-[hj] [nblocks]   bar|json|histogram blocks
| p-   show ascii-art bar of metadata in file boundaries
| p-h  show histogram analysis of metadata per block
| p-j  show json format

Using it though, I get a

[0x08048340]> p-
0x8048000 [..______ssss_ss__s_ssssfss^fsffssffsffsfszz] 0x8048538

without a legend. What do these different symbols mean f, s, z, _, ., and ^?

You could get that by looking at the source code here.

Each caracter represent a different things that a block can contain. They are checked in order (so that it doesn't mean only one thing can be in any section) and each symbol marks the block that...

  • ^ - you are in
  • z - has strings
  • s - has symbols
  • F - has functions starting in
  • c - has comments
  • . - has flags
  • f - has functions partially in
  • _ - has something else

But I agree a legend would be helpful. Maybe this should be documented in r2 book or p-? should actually print the legend.

Your Answer

 

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.