I have some rare cases with radare2.
when I try to display all string using "iz" it does the job.
but when I do "pdf" or "pd" I can't see actual value of string:
I see int puts(const char *s) instead of "incorrect password" or "Access granted!"
Reverse Engineering Stack Exchange is a question and answer site for researchers and developers who explore the principles of a system through analysis of its structure, function, and operation. It only takes a minute to sign up.
Sign up to join this communityThis is not a bug in radare2.
The comment that you see in red is merely the imported function prototype. In both cases seen in the picture, the parameter to puts
is pushed through eax
whereas it is loaded from a memory location based on ebx
. radare2 does not emulate the code [unless told], so it cannot display the actual string being pointed.
aa
(or aaa
if binary is not too complex). Then disassemble the function (e.g. main
) while setting emu.str
temporarily: pdf @e:emu.str=true @ main