I am trying to find an offset IOSURFACEROOTUSERCLIENT_VTAB from an iOS kext(IOSurface) using radare2 and there is a need to use the command "/c pointer; offset"
as per the instructions in this gist. On performing the command the expected out put is a list of locations where the specific instruction occurs.
But when i try to run, the previous commands do work as expected. Except for the above command which gives the following output:
[0xfffffff00688b0d4]> "/c 0xfffffff007622000; 0x898"
Usage: /c Search for crypto materials
| /ca Search for AES keys expanded in memory
| /cc[algo] [digest] Find collisions (bruteforce block length values until given checksum is found)
| /cd Search for ASN1/DER certificates
| /cr Search for ASN1/DER private keys (RSA and ECC)
I'm getting the same response when the double quotes are dropped.
Please help me understand what is wrong here, or if the format for radare2 has changed over the course of time or if I missed something.
I did read the radare2 docs and but could not find any format in this form: "/c pointer; offset"
Thanks!
brew info radare2
, it seems the version isradare2: stable 5.1.1 (bottled), HEAD