debugging with radare2

Question

I am using radare2 for disassemble an x86 binary:

$ r2 ./mynbinary
[0x00001000]> aaa
...
[0x00001000]> pdf
            ;-- section..text:
            ;-- section.LOAD1:
            ;-- rip:
/ (fcn) entry0 53
|   entry0 ();
|           ; UNKNOWN XREF from 0x00001000 (entry0)
|           0x00001000      e800000000     call loc.suite              ; [15] m-r-x section size 53 named LOAD1
            ;-- suite:
|           ; CALL XREF from 0x00001000 (entry0)
|           0x00001005      48b968656c6c.  movabs rcx, 0x3332316f6c6c6568
...

As you can see it works great.

Now, i am doing the same thing, on the same binary but with -d option in order to debug the binary

[0x7ff5a7183210]> aaa
...
[0x7ff5a7183210]> pdf
p: Cannot find function at 0x7ff5a7183210

I don't know why it does not work in debuging...

Thanks

Answer 1

The issue is that address 0x7ff5a7183210 is not part of your binary but rather part of the kernel code that will run your code. So running aaa will not create any functions there. What you need to create a breakpoint in your code (i.e running db main) and only when your breakpoint is hit you could run pdf and it should should show you the disassembly.