2

How can i examine/edit stack contents using radare2, just like gdb ?
Is there a way to examine memory using $rbp or $rsp register like below.
x $rbp-10 <--- something like this which can dump from this particular offset.

How do i change the memory contents during debugging ?
example: something like set (address)=0xff

  • For examine : we can use x same as gdb. Still searching for how to write to the memory location while debugging. – sourav punoriyar Apr 9 at 16:25
3

To examine in radare2 you can think as 'print values' and you can use:

px show hexdump
pxl display N lines (rows) of hexdump
pxr[j] show words with references to flags and code (q=quiet)

Example:
> px [nBytes] @[address][offset]
"Print hex 10 bytes at rbp plus 10"

[0x5618eccbf77a]> px 10 @rbp+10

> pxl [nLines] @[address][offset]
> pxr [nBytes] @[address][offset]

To edit you can think as 'write' use:

w[1248][+-][n] increment/decrement byte,word..

Example:
> w [str] @[address]
"Write \x38\x38 at rbp"

[0x5618eccbf77a]> w \x38\x38 @rbp
  • Thanks @Ricardo. I tried it .. it worked fine. – sourav punoriyar Apr 11 at 9:56

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.