2

Is there any way to indentify structs in radare2?

when i tried to look them, they look like normal variables, i seen people using td and tl command but I don't know how to use them. If you know please explain...

2
  • 1
    it is possible that structure recovery might not be implemented yet. Did you check using debug info?
    – R4444
    Mar 19, 2021 at 4:13
  • how to do that?
    – Mr. rc
    Mar 21, 2021 at 8:10

1 Answer 1

3

According to the official radare2 book, you have to reverse the struct manually by understanding the features of the program. Then you can overwrite the variable by struct names such as for instance:

If you have this code:

mov rax, qword [rsi + 8]

You can do:

"td struct ms1 { uint64_t a; int member1; };"
aht ms1.member1

Then the code will be documented:

[0x000052f0]> pd 1
0x000052f0      488b4608       mov rax, qword [rsi + ms1.member1]

There is nothing automatic in this process.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.