1

I am using radare2 for disassemble an x86 binary:

$ r2 ./mynbinary
[0x00001000]> aaa
...
[0x00001000]> pdf
            ;-- section..text:
            ;-- section.LOAD1:
            ;-- rip:
/ (fcn) entry0 53
|   entry0 ();
|           ; UNKNOWN XREF from 0x00001000 (entry0)
|           0x00001000      e800000000     call loc.suite              ; [15] m-r-x section size 53 named LOAD1
            ;-- suite:
|           ; CALL XREF from 0x00001000 (entry0)
|           0x00001005      48b968656c6c.  movabs rcx, 0x3332316f6c6c6568
...

As you can see it works great.

Now, i am doing the same thing, on the same binary but with -d option in order to debug the binary

[0x7ff5a7183210]> aaa
...
[0x7ff5a7183210]> pdf
p: Cannot find function at 0x7ff5a7183210

I don't know why it does not work in debuging...

Thanks

2

The issue is that address 0x7ff5a7183210 is not part of your binary but rather part of the kernel code that will run your code. So running aaa will not create any functions there. What you need to create a breakpoint in your code (i.e running db main) and only when your breakpoint is hit you could run pdf and it should should show you the disassembly.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.