Radare2 - "/c pointer; offset" command not giving expected response to search instances of the same pair of similar instructions

Question

I am trying to find an offset IOSURFACEROOTUSERCLIENT_VTAB from an iOS kext(IOSurface) using radare2 and there is a need to use the command "/c pointer; offset" as per the instructions in this gist. On performing the command the expected out put is a list of locations where the specific instruction occurs.

But when i try to run, the previous commands do work as expected. Except for the above command which gives the following output:

[0xfffffff00688b0d4]> "/c 0xfffffff007622000; 0x898"
Usage: /c   Search for crypto materials
| /ca                 Search for AES keys expanded in memory
| /cc[algo] [digest]  Find collisions (bruteforce block length values until given checksum is found)
| /cd                 Search for ASN1/DER certificates
| /cr                 Search for ASN1/DER private keys (RSA and ECC)

I'm getting the same response when the double quotes are dropped.

Please help me understand what is wrong here, or if the format for radare2 has changed over the course of time or if I missed something.

I did read the radare2 docs and but could not find any format in this form: "/c pointer; offset"

Thanks!

Answer 1

The gist contains some old (create 3 yrs ago) r2 instructions and according to, also outdated, r2 book, it looks like /c command was responsible for "search for asm code matching the given string". Currently (radare2 5.2.0-git 26093 @ linux-x86-64 git.5.1.1) the similar instruction could be one from /a group

Usage: /a[?] [arg]  Search for assembly instructions matching given properties
| /a push rbp           Assemble given instruction and search the bytes
| /a1 [number]          Find valid assembly generated by changing only the nth byte
| /aI                   Search for infinite loop instructions (jmp $$)
| /aa mov eax           Linearly find aproximated assembly (case insensitive strstr)
| /ac mov eax           Same as /aa, but case-sensitive
| /ad[/*j] push;mov     Match ins1 followed by ins2 in linear disasm
| /ad/ ins1;ins2        Search for regex instruction 'ins1' followed by regex 'ins2'
| /ad/a instr           Search for every byte instruction that matches regexp 'instr'
| /ae esil              Search for esil expressions matching substring
| /af[l] family         Search for instruction of specific family (afl=list
| /ai[j] 0x300 [0x500]  Find all the instructions using that immediate (in range)
| /al                   Same as aoml, list all opcodes
| /am opcode            Search for specific instructions of specific mnemonic
| /ao instr             Search for instruction 'instr' (in all offsets)
| /as[l] ([type])       Search for syscalls (See /at swi and /af priv)
| /at[l] ([type])       Search for instructions of given type  

It looks like especially /ad/ should work as it can find sections of code where two instructions are following each other matching some regexp.

Based on this I think the following should work for you:

[0x00000000]>"/ad/ 0xfffffff007622000;0x898"