4

Radare2 supports a w which writes a string.

w foobar             write string 'foobar'

However, it doesn't seem to work for me,

$ touch foo

$ radare2 ./foo
w foobar

The file foo remains empty. Am I supposed to flush or save?

6

TLDR

  • radare2 opens a file in read-only mode by default. (see the manual r2 -h for further information.)
  • to allow writing to a file, start radare2 in write mode (r2 -w file).
  • when in a read-only session already, oo+ will re-open the file in write mode.
  • the cache mode (e io.cache=true) mimics writing access but changes in radare2 are not actually written to disk.

Write Mode - Example


  1. Open the file foo in write mode:
    $ r2 -w foo
    

  1. Print 32 bytes (with px 32):
    [0x00000000]> px 32
    - offset -   0 1  2 3  4 5  6 7  8 9  A B  C D  E F  0123456789ABCDEF
    0x00000000  ffff ffff ffff ffff ffff ffff ffff ffff  ................
    0x00000010  ffff ffff ffff ffff ffff ffff ffff ffff  ................
    

Note: The first 32 bytes (and the rest of the file) are empty.


  1. Let's write "Hello World!" into the file:

    [0x00000000]> w Hello World!
    
  2. And print the 32 bytes again:

    [0x00000000]> px 32
    - offset -   0 1  2 3  4 5  6 7  8 9  A B  C D  E F  0123456789ABCDEF
    0x00000000  4865 6c6c 6f20 576f 726c 6421 ffff ffff  Hello World!....
    0x00000010  ffff ffff ffff ffff ffff ffff ffff ffff  ................
    

Great! Now we can see that "Hello World!" is written to the file.


  1. Let's quit radare2 and cat the file to see the content:
     [0x00000000]> q
    
    $ cat foo
    Hello World!
    

Cache Mode - Example

  1. Open the file foo in write mode:
    $ r2 foo
    
  2. Print the first 32 bytes@
    [0x00000000]> px 32
    - offset -   0 1  2 3  4 5  6 7  8 9  A B  C D  E F  0123456789ABCDEF
    0x00000000  4865 6c6c 6f20 576f 726c 6421 ffff ffff  Hello World!....
    0x00000010  ffff ffff ffff ffff ffff ffff ffff ffff  ................
    
  3. Activate 'cache mode`:
    [0x00000000]> e io.cache=true
    
  4. Make some changes in radare2:
    [0x00000000]> w Goodbyte World! :)
    
  5. Proof that radare2 mimicked writing as if in write mode:
    [0x00000000]> px 32
    - offset -   0 1  2 3  4 5  6 7  8 9  A B  C D  E F  0123456789ABCDEF
    0x00000000  476f 6f64 6279 7465 2057 6f72 6c64 2120  Goodbyte World!
    0x00000010  3a29 ffff ffff ffff ffff ffff ffff ffff  :)..............
    
  6. Quit radare2:
    [0x00000000]> q
    
  7. Examine actual file contents:
    $ cat foo
    Hello World!
    
    Note: The file didn't change! That's the effect of cache mode.
4
  • What does -w do outside of write mode? Nov 13 '18 at 20:50
  • 1
    Well, it allows radare2 to write to the file. i.e modifying the original file. This is risky and should be careful while using it. While working with write-mode you can work regularly with radare2 as you are used to. It doesn't change a thing. Also, please see my edition the the answer -- regardless your comment, I elaborated more :)
    – Megabeets
    Nov 13 '18 at 20:54
  • The follow up question is though what does w foobar do if radare opens the file in read-only mode? Is it just a noop? Nov 13 '18 at 20:56
  • 1
    yup. Not doing a thing. I suggest you explore the powers of the w command and subcommands of radare2. I use it on a daily basis - check out w? for commands like wtf, wox, wopD...
    – Megabeets
    Nov 13 '18 at 20:57
0

Just to update @Megabeets answer.

When you start with an empty file (created by touch), the w command will not work by default even if the r2 will be started in write mode. The missing information is, in that case, the mapping

[0x00000000]> om
[0x00000000]

Returns an empty result. Apart from listing, the om command can also be used to create the mapping:

Usage: om[-] [arg]   # map opened files
| om                                       list all defined IO maps
...
| om fd vaddr [size] [paddr] [rwx] [name]  create new io map
...

In order to do the mapping, one needs to specify (for example) the following command

[0x00000000]> om 3 0x0 12
[0x00000000]> om
 1 fd: 3 +0x00000000 0x00000000 - 0x0000000b rwx

That will create, for the file description 3, a 12 bytes in size mapping starting from an address 0x0.

After that w will work:

[0x00000000]> w Hello world!
[0x00000000]> px 32
- offset -   0 1  2 3  4 5  6 7  8 9  A B  C D  E F  0123456789ABCDEF
0x00000000  4865 6c6c 6f20 776f 726c 6421 ffff ffff  Hello world!....
0x00000010  ffff ffff ffff ffff ffff ffff ffff ffff  ................
[0x00000000]>
0

Create an input/output mapping to allow writing to a non-mapped file

To allow writing up to 64 byte starting at offset 0x00000000, map changes in radare2 to file descriptor 3 (the file opened in radare2).

[0x00000000]> om 3 0x0 64
[0x00000000]> om
1 fd: 3 +0x00000000 0x00000000 - 0x0000000b rwx

Explanation

An empty file (as created by touch) has no input/output mappings (even when opened with in write mode). To confirm no region has been mapped, you can list all defined IO maps with the radare2-command om.)

To create an i/o-mapping use om with parameters:

om fd vaddr [size] [paddr] [rwx] [name] create new io map

Example

radare2 -w test_file
 -- What has been executed cannot be unexecuted
[0x00000000]> w This won't be written anywhere, because no mapping exists.
[0x00000000]> om
[0x00000000]> om 3 0 64
[0x00000000]> om
 1 fd: 3 +0x00000000 0x00000000 - 0x0000003f rwx 
[0x00000000]> w Hello World!
[0x00000000]> V

hexview of file after mapping and writing

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.