Using radare2, I am reverse engineering a custom language interpreter. It stores compiled functions as a list of pointers to language primitives. I would like to seek to these locations, but typing in the hex addresses is very frustrating. I can't seem to find any syntax for saying "seek to the address stored at the current location".

E.g., say I am looking at the following in visual mode:

; UNKNOWN XREFS from entry0 @ 0x400382, 0x400384
; UNKNOWN XREF from entry0 @ +0x82
;-- section..text:
0x004000b0      .qword 0x00000000004002f3 ; aav.0x004002f3    ; [01] -r-x section size 736 named .text
0x004000b8      .qword 0x0000000000000064
0x004000c0      .qword 0x0000000000400301 ; aav.0x00400301
0x004000c8      .qword 0x000000000040032e ; aav.0x0040032e
0x004000d0      .qword 0x000000000040030c ; aav.0x0040030c
. . .

The "current location" is at 0x004000b0, and it stores the value 0x4002f3, which is where I'd like to seek. For now, I have to type g followed by reading and typing out, or selecting and pasting, the address 0x4002f3.

Is there some efficient way to say "seek to the value stored at $$"?


one can read a pointer value using * symbol
$$ is alias for current virtual seek
so *$$ will return the value stored at current seek

you can execute the command and pass the result to seek like

s `*$$`

a simple example showing how to seek to an address stored in 3rd DWORD from current seek

[0x01012d6c]> sentry0
[0x01012d6c]> x/4xw
0x01012d6c  0xfffd4be8 0x68586aff 0x01012ee8 0xff99ebe8  .K...jXh........
[0x01012d6c]> s `*$$+8`
| improve this answer | |
  • Thanks! I tried that, but without the backticks. Those make a lot of difference! I can keep "`*$$`" in my paste buffer, and use g followed by ^V and ENTER. This works great! – Josh5tone Feb 10 at 15:03

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.