2

How can i examine/edit stack contents using radare2, just like gdb ?
Is there a way to examine memory using $rbp or $rsp register like below.
x $rbp-10 <--- something like this which can dump from this particular offset.

How do i change the memory contents during debugging ?
example: something like set (address)=0xff

1
  • For examine : we can use x same as gdb. Still searching for how to write to the memory location while debugging. Commented Apr 9, 2019 at 16:25

1 Answer 1

3

To examine in radare2 you can think as 'print values' and you can use:

px show hexdump
pxl display N lines (rows) of hexdump
pxr[j] show words with references to flags and code (q=quiet)

Example:
> px [nBytes] @[address][offset]
"Print hex 10 bytes at rbp plus 10"

[0x5618eccbf77a]> px 10 @rbp+10

> pxl [nLines] @[address][offset]
> pxr [nBytes] @[address][offset]

To edit you can think as 'write' use:

w[1248][+-][n] increment/decrement byte,word..

Example:
> w [str] @[address]
"Write \x38\x38 at rbp"

[0x5618eccbf77a]> w \x38\x38 @rbp
1
  • Thanks @Ricardo. I tried it .. it worked fine. Commented Apr 11, 2019 at 9:56

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.