0

I have a .so file from an android app, and I know how to list all functions in IDA Pro.

How can I do this with radare2?

2

There are several ways to show the different functions of a binary file in radare2.

Start by opening the binary file and analyze it.

$ r2 -A libdbm64.so

Command: afl

The simplest way to list the functions, is the afl command which stands for analysis function list. The command will list all the functions in the binary and print it with four columns: Offset, Number of blocks, Length, and Name.

[0x00001ba0]> afl
0x00001ba0    4 50   -> 44   entry0
0x00001ed9    1 114          sym.startWatchDbus
0x00001b70    1 6            sym.imp.g_bus_watch_name
0x00003115    1 43           sym.setItemEnabled
0x00001b60    1 6            sym.imp.dbusmenu_menuitem_property_set_bool
0x000033f0    1 9            sym._fini
0x00001f4b    1 20           sym.stopWatchDbus
0x00001a70    1 6            sym.imp.g_bus_unwatch_name
0x000030eb    1 42           sym.setItemLabel

...
...

Command: afll

The afll command is more verbose than the afl command. It will show more columns and their headers.

address            size  nbbs edges    cc cost          min bound range max bound          calls locals args xref frame name
================== ==== ===== ===== ===== ==== ================== ===== ================== ===== ====== ==== ==== ===== ====
0x0000000000001ba0   44     4     4     4   19 0x0000000000001ba0    50 0x0000000000001bd2     0    0      0    1     8 entry0
0x0000000000001ed9  114     1     0     1   30 0x0000000000001ed9   114 0x0000000000001f4b     1    3      3    0    56 sym.startWatchDbus
0x0000000000001b70    6     1     0     1    3 0x0000000000001b70     6 0x0000000000001b76     0    0      0    1     0 sym.imp.g_bus_watch_name
0x0000000000003115   43     1     0     1   18 0x0000000000003115    43 0x0000000000003140     1    2      2    0    24 sym.setItemEnabled
0x0000000000001b60    6     1     0     1    3 0x0000000000001b60     6 0x0000000000001b66     0    0      0    3     0 sym.imp.dbusmenu_menuitem_property_set_bool
0x00000000000033f0    9     1     0     1    5 0x00000000000033f0     9 0x00000000000033f9     0    0      0    0     8 sym._fini
0x0000000000001f4b   20     1     0     1   12 0x0000000000001f4b    20 0x0000000000001f5f     1    0      0    0     8 sym.stopWatchDbus
0x0000000000001a70    6     1     0     1    3 0x0000000000001a70     6 0x0000000000001a76     0    0      0    1     0 sym.imp.g_bus_unwatch_name
0x00000000000030eb   42     1     0     1   17 0x00000000000030eb    42 0x0000000000003115     1    2      2    0    24 sym.setItemLabel


Command: aflt

The aflt command is using the newly introduced Table API in radare2. By default it will return a table of data like this:

[0x00001ba0]> aflt
╭─────────────────────────────────────────────────────────────────────────────────────────────────────────╮
│ addr        │ size  │ name                                               │ nbbs  │ xref  │ calls  │ cc  │
│─────────────────────────────────────────────────────────────────────────────────────────────────────────│
│ 0x00001ba0  │ 50    │ entry0                                             │ 4     │ 3     │ 0      │ 4   │
│ 0x00001ed9  │ 114   │ sym.startWatchDbus                                 │ 1     │ 0     │ 1      │ 1   │
│ 0x00001b70  │ 6     │ sym.imp.g_bus_watch_name                           │ 1     │ 1     │ 0      │ 1   │
│ 0x00003115  │ 43    │ sym.setItemEnabled                                 │ 1     │ 0     │ 1      │ 1   │
│ 0x00001b60  │ 6     │ sym.imp.dbusmenu_menuitem_property_set_bool        │ 1     │ 3     │ 0      │ 1   │
│ 0x000033f0  │ 9     │ sym._fini                                          │ 1     │ 0     │ 0      │ 1   │
│ 0x00001f4b  │ 20    │ sym.stopWatchDbus                                  │ 1     │ 0     │ 1      │ 1   │
│ 0x00001a70  │ 6     │ sym.imp.g_bus_unwatch_name                         │ 1     │ 1     │ 0      │ 1   │
│ 0x000030eb  │ 42    │ sym.setItemLabel                                   │ 1     │ 0     │ 1      │ 1   │
...
...

╰─────────────────────────────────────────────────────────────────────────────────────────────────────────╯


The Table API allows you to query the data you want to see. For example, if I want to only see Name, Offset, and Size I can do it like this:

[0x00001ba0]> aflt name/cols/addr/size
╭──────────────────────────────────────────────────────────────────────────╮
│ name                                               │ addr        │ size  │
│──────────────────────────────────────────────────────────────────────────│
│ entry0                                             │ 0x00001ba0  │ 50    │
│ sym.startWatchDbus                                 │ 0x00001ed9  │ 114   │
│ sym.imp.g_bus_watch_name                           │ 0x00001b70  │ 6     │
│ sym.setItemEnabled                                 │ 0x00003115  │ 43    │
│ sym.imp.dbusmenu_menuitem_property_set_bool        │ 0x00001b60  │ 6     │
│ sym._fini                                          │ 0x000033f0  │ 9     │
│ sym.stopWatchDbus                                  │ 0x00001f4b  │ 20    │
│ sym.imp.g_bus_unwatch_name                         │ 0x00001a70  │ 6     │
│ sym.setItemLabel                                   │ 0x000030eb  │ 42    │
...
...
│ fcn.00001930                                       │ 0x00001930  │ 6     │
│ loc.imp.XKeysymToString                            │ 0x00001b50  │ 6     │
╰──────────────────────────────────────────────────────────────────────────╯



JSON

If you are using radare2 for scripting, it is recommended to use the JSON output of every command. aflj will show you a json output with all the functions. I appended the {} to make it prettier.

[0x00001ba0]> aflj~{}
[
  {
    "offset": 7072,
    "name": "entry0",
    "size": 50,
    "is-pure": "false",
    "realsz": 44,
    "stackframe": 8,
    "calltype": "amd64",
    ...
    ...
  }, {
      ...
  }



Cutter

Finally, if you don't find it comfortable to use the command line for your reverse engineering session. I recommend using Cutter which is a GUI Reverse Engineering framework powered by radare2 and created by the radare organization.

enter image description here

By default, you will have a list of functions on the left. You can expand it to reveal more information. enter image description here

| improve this answer | |
0

I'd recommend you to use this or this cheat-sheets for radare2.

From the document:

list functions: afl

| improve this answer | |
0
0x00000000]> \iE* libjni.so

It shows a list of exported function signatures with their absolute address in memory, like this:

f sym.fun._Znaj = 0xc5a3f8b5
f sym.fun._ZdaPv = 0xc5a3e579
f sym.fun._ZdlPv = 0xc5a3e575
f sym.fun.__cxa_begin_catch = 0xc5a3ebd5
f sym.fun._ZSt9terminatev = 0xc5a3f4bd
f sym.fun._Znwj = 0xc5a3f861
f sym.var._ZTVN10__cxxabiv117__class_type_infoE = 0xc5a97290
f sym.fun.JNI_OnLoad = 0xc5a257a9
f sym.fun.__cxa_allocate_exception = 0xc5a3e655
f sym.fun.__cxa_throw = 0xc5a3f571
f sym.fun.__cxa_free_exception = 0xc5a3e6fd
f sym.fun.__cxa_rethrow = 0xc5a3f5f1
f sym.fun.__cxa_end_catch = 0xc5a3ec65
f sym.var._ZSt7nothrow = 0xc5a94138
f sym.fun._ZNSt8_Rb_treeISsSsSt9_IdentityISsESt4lessISsESaISsEE5clearEv = 0xc5a36c99
f sym.fun._ZNSt8_Rb_treeISsSsSt9_IdentityISsESt4lessISsESaISsEE16_M_insert_uniqueISsEESt4pairISt17_Rb_tree_iteratorISsEbEOT_ = 0xc5a36d3d
f sym.fun._ZNSt8_Rb_treeISsSsSt9_IdentityISsESt4lessISsESaISsEE4findERKSs = 0xc5a38701
f sym.fun._ZNSt6vectorISsSaISsEED2Ev = 0xc5a2df71
f sym.fun._ZNSt8_Rb_treeISsSsSt9_IdentityISsESt4lessISsESaISsEED2Ev = 0xc5a36f11
f sym.fun._ZNSt6vectorISsSaISsEE7reserveEj = 0xc5a32455
f sym.fun._ZNSt6vectorISsSaISsEE19_M_emplace_back_auxIJSsEEEvDpOT_ = 0xc5a39361
f sym.fun.__cxa_guard_acquire = 0xc5a3f665
f sym.fun.__cxa_guard_release = 0xc5a3f7dd
f sym.fun._ZNSt9exceptionD2Ev = 0xc5a3ed01
...
| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.