1

In gdb i can backtrace with core file and executable file.
It seems radare2 can read core file. like this

$ r2 core
Setting up coredump: asm.arch <-> x86 and asm.bits <-> 64
Setting up coredump: Registers have been set
Setting up coredump: 22 maps have been found and created
[0x00000000]> 

but after that i don't know what to do next?
I can't find any documentation about using core file in radare2.

1 Answer 1

1

It's more regular programming question than RE. Core dump file is a state of the process when the file was created (usually due to a crash) so debugger commands are the most suitable in such case. In Radare2 those are the ones from d? category.

Usage: d   # Debug commands
| db[?]                    Breakpoints commands
| dbt[?]                   Display backtrace based on dbg.btdepth and dbg.btalgo
| dc[?]                    Continue execution
| dd[?]                    File descriptors (!fd in r1)
| de[-sc] [perm] [rm] [e]  Debug with ESIL (see de?)
| dg <file>                Generate a core-file (WIP)
| dH [handler]             Transplant process to a new handler
| di[?]                    Show debugger backend information (See dh)
| dk[?]                    List, send, get, set, signal handlers of child
| dL[?]                    List or set debugger handler
| dm[?]                    Show memory maps
| do[?]                    Open process (reload, alias for 'oo')
| doo[args]                Reopen in debugger mode with args (alias for 'ood')
| dp[?]                    List, attach to process or thread id
| dr[?]                    Cpu registers
| ds[?]                    Step, over, source line
| dt[?]                    Display instruction traces (dtr=reset)
| dw <pid>                 Block prompt until pid dies
| dx[?]                    Inject and run code on target process (See gs)

You can get values of registers when coredump was created by issuing dr command or show the backtrace by one of the dbt.

but after that i don't know what to do next?

What are the next steps are really dependent on your case - what you want to obtain from this dump.

I can't find any documentation about using core file in radare2.

Probably this is not the most used function in r2 ;)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.