I am trying the recursive traversal disassembler of the radare2
tool. But, I cannot use it properly.
First, according to the radare2
manual, we can use recursive traversal disassembler by using the pdr
:
[0x00404890]> pd?
Usage: pd[f|i|l] [len] @ [addr]
pda : disassemble all possible opcodes (byte per byte)
pdj : disassemble to json
pdb : disassemble basic block
pdr : recursive disassemble across the function graph
pdf : disassemble function
pdi : like 'pi', with offset and bytes
pdl : show instruction sizes
But I always get this error message:
Cannot find function at 0x004028c0
Here is a full session of radare2
on the ls
command with, first, a linear sweep disassembly and, then, an attempt of recursive traversal disassembly:
$> radare2 /bin/ls
syntax error: error in error handling
syntax error: error in error handling
[0x00404890]> pd@main
;-- main:
0x004028c0 4157 push r15
0x004028c2 4156 push r14
0x004028c4 4155 push r13
0x004028c6 4154 push r12
0x004028c8 55 push rbp
0x004028c9 4889f5 mov rbp, rsi
0x004028cc 53 push rbx
0x004028cd 89fb mov ebx, edi
0x004028cf 4881ec88030. sub rsp, 0x388
...
0x00402dff 8b0567772100 mov eax, [rip+0x217767] ; 0x0040a56c
0x00402e05 488b0d64772. mov rcx, [rip+0x217764] ; 0x0040a570
0x00402e0c 83f801 cmp eax, 0x1
0x00402e0f 0f84de0d0000 jz 0x403bf3
0x00402e15 83f802 cmp eax, 0x2
0x00402e18 be0f384100 mov esi, 0x41380f
0x00402e1d b80e384100 mov eax, str.vdir
0x00402e22 480f45f0 cmovnz rsi, rax
0x00402e26 488b3de3772. mov rdi, [rip+0x2177e3] ; 0x0040a610
0x00402e2d 48c70424000. mov qword [rsp], 0x0
0x00402e35 41b9bd384100 mov r9d, str.DavidMacKenzie
0x00402e3b 41b8cd384100 mov r8d, str.RichardM.Stallman
[0x00404890]> pdr@main
Cannot find function at 0x004028c0
In fact, I strongly suppose that I am missing a step here. It seems that we should first build the call graph of the program, but I didn't manage to find how to do it (I obviously have missed some documentation somewhere, sorry for that!).
So, if somebody can give me a hint about it, I would be pleased !