I have a .so file from an android app, and I know how to list all functions in IDA Pro.
How can I do this with radare2?
Add a comment
|
3 Answers
There are several ways to show the different functions of a binary file in radare2.
Start by opening the binary file and analyze it.
$ r2 -A libdbm64.so
Command: afl
The simplest way to list the functions, is the afl command which stands for analysis function list. The command will list all the functions in the binary and print it with four columns: Offset, Number of blocks, Length, and Name.
[0x00001ba0]> afl
0x00001ba0 4 50 -> 44 entry0
0x00001ed9 1 114 sym.startWatchDbus
0x00001b70 1 6 sym.imp.g_bus_watch_name
0x00003115 1 43 sym.setItemEnabled
0x00001b60 1 6 sym.imp.dbusmenu_menuitem_property_set_bool
0x000033f0 1 9 sym._fini
0x00001f4b 1 20 sym.stopWatchDbus
0x00001a70 1 6 sym.imp.g_bus_unwatch_name
0x000030eb 1 42 sym.setItemLabel
...
...
Command: afll
The afll command is more verbose than the afl command. It will show more columns and their headers.
address size nbbs edges cc cost min bound range max bound calls locals args xref frame name
================== ==== ===== ===== ===== ==== ================== ===== ================== ===== ====== ==== ==== ===== ====
0x0000000000001ba0 44 4 4 4 19 0x0000000000001ba0 50 0x0000000000001bd2 0 0 0 1 8 entry0
0x0000000000001ed9 114 1 0 1 30 0x0000000000001ed9 114 0x0000000000001f4b 1 3 3 0 56 sym.startWatchDbus
0x0000000000001b70 6 1 0 1 3 0x0000000000001b70 6 0x0000000000001b76 0 0 0 1 0 sym.imp.g_bus_watch_name
0x0000000000003115 43 1 0 1 18 0x0000000000003115 43 0x0000000000003140 1 2 2 0 24 sym.setItemEnabled
0x0000000000001b60 6 1 0 1 3 0x0000000000001b60 6 0x0000000000001b66 0 0 0 3 0 sym.imp.dbusmenu_menuitem_property_set_bool
0x00000000000033f0 9 1 0 1 5 0x00000000000033f0 9 0x00000000000033f9 0 0 0 0 8 sym._fini
0x0000000000001f4b 20 1 0 1 12 0x0000000000001f4b 20 0x0000000000001f5f 1 0 0 0 8 sym.stopWatchDbus
0x0000000000001a70 6 1 0 1 3 0x0000000000001a70 6 0x0000000000001a76 0 0 0 1 0 sym.imp.g_bus_unwatch_name
0x00000000000030eb 42 1 0 1 17 0x00000000000030eb 42 0x0000000000003115 1 2 2 0 24 sym.setItemLabel
Command: aflt
The aflt command is using the newly introduced Table API in radare2. By default it will return a table of data like this:
[0x00001ba0]> aflt
╭─────────────────────────────────────────────────────────────────────────────────────────────────────────╮
│ addr │ size │ name │ nbbs │ xref │ calls │ cc │
│─────────────────────────────────────────────────────────────────────────────────────────────────────────│
│ 0x00001ba0 │ 50 │ entry0 │ 4 │ 3 │ 0 │ 4 │
│ 0x00001ed9 │ 114 │ sym.startWatchDbus │ 1 │ 0 │ 1 │ 1 │
│ 0x00001b70 │ 6 │ sym.imp.g_bus_watch_name │ 1 │ 1 │ 0 │ 1 │
│ 0x00003115 │ 43 │ sym.setItemEnabled │ 1 │ 0 │ 1 │ 1 │
│ 0x00001b60 │ 6 │ sym.imp.dbusmenu_menuitem_property_set_bool │ 1 │ 3 │ 0 │ 1 │
│ 0x000033f0 │ 9 │ sym._fini │ 1 │ 0 │ 0 │ 1 │
│ 0x00001f4b │ 20 │ sym.stopWatchDbus │ 1 │ 0 │ 1 │ 1 │
│ 0x00001a70 │ 6 │ sym.imp.g_bus_unwatch_name │ 1 │ 1 │ 0 │ 1 │
│ 0x000030eb │ 42 │ sym.setItemLabel │ 1 │ 0 │ 1 │ 1 │
...
...
╰─────────────────────────────────────────────────────────────────────────────────────────────────────────╯
The Table API allows you to query the data you want to see. For example, if I want to only see Name, Offset, and Size I can do it like this:
[0x00001ba0]> aflt name/cols/addr/size
╭──────────────────────────────────────────────────────────────────────────╮
│ name │ addr │ size │
│──────────────────────────────────────────────────────────────────────────│
│ entry0 │ 0x00001ba0 │ 50 │
│ sym.startWatchDbus │ 0x00001ed9 │ 114 │
│ sym.imp.g_bus_watch_name │ 0x00001b70 │ 6 │
│ sym.setItemEnabled │ 0x00003115 │ 43 │
│ sym.imp.dbusmenu_menuitem_property_set_bool │ 0x00001b60 │ 6 │
│ sym._fini │ 0x000033f0 │ 9 │
│ sym.stopWatchDbus │ 0x00001f4b │ 20 │
│ sym.imp.g_bus_unwatch_name │ 0x00001a70 │ 6 │
│ sym.setItemLabel │ 0x000030eb │ 42 │
...
...
│ fcn.00001930 │ 0x00001930 │ 6 │
│ loc.imp.XKeysymToString │ 0x00001b50 │ 6 │
╰──────────────────────────────────────────────────────────────────────────╯
JSON
If you are using radare2 for scripting, it is recommended to use the JSON output of every command. aflj will show you a json output with all the functions. I appended the {} to make it prettier.
[0x00001ba0]> aflj~{}
[
{
"offset": 7072,
"name": "entry0",
"size": 50,
"is-pure": "false",
"realsz": 44,
"stackframe": 8,
"calltype": "amd64",
...
...
}, {
...
}
Cutter
Finally, if you don't find it comfortable to use the command line for your reverse engineering session. I recommend using Cutter which is a GUI Reverse Engineering framework powered by radare2 and created by the radare organization.
By default, you will have a list of functions on the left. You can expand it to reveal more information.
I'd recommend you to use this or this cheat-sheets for radare2.
From the document:
list functions: afl
answered Feb 17, 2020 at 15:02
-
That just returns a bunch of hex. I would want something like the function window output in this tutorial: github.com/byteandahalf/MCPE-NativeMods/wiki/4:-Setting-up-IDA Feb 18, 2020 at 5:38
-
0x00000000]> \iE* libjni.so
It shows a list of exported function signatures with their absolute address in memory, like this:
f sym.fun._Znaj = 0xc5a3f8b5
f sym.fun._ZdaPv = 0xc5a3e579
f sym.fun._ZdlPv = 0xc5a3e575
f sym.fun.__cxa_begin_catch = 0xc5a3ebd5
f sym.fun._ZSt9terminatev = 0xc5a3f4bd
f sym.fun._Znwj = 0xc5a3f861
f sym.var._ZTVN10__cxxabiv117__class_type_infoE = 0xc5a97290
f sym.fun.JNI_OnLoad = 0xc5a257a9
f sym.fun.__cxa_allocate_exception = 0xc5a3e655
f sym.fun.__cxa_throw = 0xc5a3f571
f sym.fun.__cxa_free_exception = 0xc5a3e6fd
f sym.fun.__cxa_rethrow = 0xc5a3f5f1
f sym.fun.__cxa_end_catch = 0xc5a3ec65
f sym.var._ZSt7nothrow = 0xc5a94138
f sym.fun._ZNSt8_Rb_treeISsSsSt9_IdentityISsESt4lessISsESaISsEE5clearEv = 0xc5a36c99
f sym.fun._ZNSt8_Rb_treeISsSsSt9_IdentityISsESt4lessISsESaISsEE16_M_insert_uniqueISsEESt4pairISt17_Rb_tree_iteratorISsEbEOT_ = 0xc5a36d3d
f sym.fun._ZNSt8_Rb_treeISsSsSt9_IdentityISsESt4lessISsESaISsEE4findERKSs = 0xc5a38701
f sym.fun._ZNSt6vectorISsSaISsEED2Ev = 0xc5a2df71
f sym.fun._ZNSt8_Rb_treeISsSsSt9_IdentityISsESt4lessISsESaISsEED2Ev = 0xc5a36f11
f sym.fun._ZNSt6vectorISsSaISsEE7reserveEj = 0xc5a32455
f sym.fun._ZNSt6vectorISsSaISsEE19_M_emplace_back_auxIJSsEEEvDpOT_ = 0xc5a39361
f sym.fun.__cxa_guard_acquire = 0xc5a3f665
f sym.fun.__cxa_guard_release = 0xc5a3f7dd
f sym.fun._ZNSt9exceptionD2Ev = 0xc5a3ed01
...
