3

How to make Radare2 automatically disassemble next instruction after each ds debug single-step?

I thought that e asm.bytes=1 would achieve this, but that doesn't help.

In particular, GDB supports disassembling the next instruction after each debug single-step, so I guess this should be possible with Radare2 as well.

1 Answer 1

3

If you want to execute another command after doing ds you can simply use ; to add a new command. So for example, the command ds; pd 1 @ rip will step one instruction and disassemble the instruction at rip.

You can also define a macro (an alias) for a set of commands. Let's define for example the macro foo to do the following things:

  1. Single step
  2. Print hexdump of 16 bytes at rip
  3. Disassemble 1 instruction at rip

To do this you can simply run:

[0x7f46fea5ee00]> (foo, ds, px 16 @ rip, pd 1 @ rip)

And then use it with .(foo):

[0x7f46fea5ee00]> .(foo)
- offset -       0 1  2 3  4 5  6 7  8 9  A B  C D  E F  0123456789ABCDEF
0x7f46fea5ee1a  89c0 48c1 e220 4809 c248 8b05 0e70 0200  ..H.. H..H...p..
            ;-- rip:
            0x7f46fea5ee1a      89c0           mov eax, eax

[0x7f46fea5ee00]> .(foo)
- offset -       0 1  2 3  4 5  6 7  8 9  A B  C D  E F  0123456789ABCDEF
0x7f46fea5ee1c  48c1 e220 4809 c248 8b05 0e70 0200 4889  H.. H..H...p..H.
            ;-- rip:
            0x7f46fea5ee1c      48c1e220       shl rdx, 0x20

[0x7f46fea5ee00]> .(foo)
- offset -       0 1  2 3  4 5  6 7  8 9  A B  C D  E F  0123456789ABCDEF
0x7f46fea5ee20  4809 c248 8b05 0e70 0200 4889 156f 6802  H..H...p..H..oh.
            ;-- rip:
            0x7f46fea5ee20      4809c2         or rdx, rax

Visual Modes

Now, after all this was said, I want to add that in my opinion, interactive debugging using ds, dso, dc and similar are the wrong approach. For a debugging session, it is preferred to use the Visual Modes of radare2. Visual Panels mode is ideal for debugging session but you can also enjoy from a good experience while using the regular Visual and Visual Graph modes.

The following GIF shows the Visual Panels mode (V!) as well as the regular Visual mode. You can also see that by pressing : I can execute radare2 commands (in the gif I executed px). Visual Panels mode is very configurable and you can tweak it as you see fit. Simply use the ? key to see the help and the available commands.

enter image description here


Read more:

3
  • thank you a lot. Now, how do I save the macro, so that it is loaded at next startup of Radare2? Furthermore, do you know why ds doesn't update the prompt address in reverseengineering.stackexchange.com/questions/20114/…? The prompt address only updates after pressing like 5-10 ds's, but that varies.
    – Shuzheng
    Dec 11, 2018 at 13:53
  • You can simply write (echo) it to your radare2rc file (default is: ~/.radare2rc). And for the seek, I don't know if it should be changed at all. If you think so, you can open an issue on GitHub or just ask in the radare2 telegram/irc group. Alos, you can add s rip to your macro in order to make r2 seek to the IP.
    – Megabeets
    Dec 11, 2018 at 14:24
  • Ahh yes, you are probably right. However, it is just wierd then that after pressing ds many times, the seek address is suddenly updated. That doesn't make sense does it? Anyway, thanks for your answer. I will accept it :)
    – Shuzheng
    Dec 11, 2018 at 14:28

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.