📕
Radare2手册
  • 简介
  • 历史
  • Radare2框架
  • 下载radare2
  • 编译与可移植性
  • Compilation on Windows
  • Compilation on Android
  • 用户界面
  • 快速上手
    • 命令行选项
    • 命令格式
    • 表达式
    • 基本的debug操作
    • Contributing to radare2
  • 配置
    • Colors
    • 配置项
    • radare2相关文件
  • 基本命令
    • 定位
    • 块大小
    • 节区
    • 映射文件
    • 输出模式
    • 标记符(Flags)
    • 写入数据
    • Zoom模式
    • 复制/粘贴
    • 字节比较
    • SDB
    • Dietline
  • 可视化模式
    • 反汇编界面
    • 汇编界面
    • 变量编辑器界面
    • 可视化面板
  • 搜索字节
    • 基本的搜索用法
    • 配置搜索引擎
    • 搜索重复字节序列
    • 搜索中的自动化
    • 回溯搜索
    • 搜索汇编指令
    • Searching for AES Keys
  • 反汇编
    • 为反汇编添加元数据
    • ESIL
  • 分析
    • 代码分析
    • 变量
    • 类型
    • 调用约定
    • 虚函数表
    • 系统调用
    • 模拟执行
    • Symbols 信息
    • 函数签名
    • 图形化命令
  • 脚本化
    • 循环(Loops)
    • 宏(Macros)
    • R2pipe
  • 调试器
    • 入门
    • 从ida, GDB 或 WinDBG迁移到radare2
    • 寄存器(Registers)
    • 内存映射(Memory Maps)
    • 堆(Heap)
    • 文件(Files)
    • 反向调试
    • Windows消息(Messages)
  • 远程访问
    • 远程GDB调试
    • 远程WinDbg
  • 命令行工具
    • Rax2
    • Rafind2
    • Rarun2
    • Rabin2
      • 文件信息识别
      • 入口点(EP)
      • 导入(Imports)
      • 导出(Exports)
      • Symbols (exports)
      • 库文件
      • 字符串(String)
      • 节区(Sections)
    • Radiff2
      • 二进制文件比较
    • Rasm2
      • 汇编
      • 反汇编
      • 配置项
    • Ragg2
      • Language
    • Rahash2
      • Rahash Tool
  • 插件
    • IO 插件
    • Asm 插件
    • Analysis 插件
    • Bin 插件
    • 其它插件
    • Python插件
    • 对插件进行调试
    • 测试
    • 打包
  • Crackmes
    • IOLI
      • IOLI 0x00
      • IOLI 0x01
    • Avatao R3v3rs3 4
      • .radare2
      • .first_steps
      • .main
      • .vmloop
      • .instructionset
      • .bytecode
      • .outro
  • Reference Card
  • Acknowledgments
由 GitBook 提供支持
在本页

这有帮助吗?

基本命令

上一页radare2相关文件下一页定位

最后更新于4年前

这有帮助吗?

Most command names in radare are derived from action names. They should be easy to remember, as they are short. Actually, all commands are single letters. Subcommands or related commands are specified using the second character of the command name. For example, / foo is a command to search plain string, while /x 90 90 is used to look for hexadecimal pairs.

The general format for a valid command (as explained in the chapter) looks like this:

[.][times][cmd][~grep][@[@iter]addr!size][|>pipe] ; ...

For example,

> 3s +1024    ; seeks three times 1024 from the current seek

If a command starts with =!, the rest of the string is passed to the currently loaded IO plugin (a debugger, for example). Most plugins provide help messages with =!? or =!help.

$ r2 -d /bin/ls
> =!help      ; handled by the IO plugin

If a command starts with !, posix_system() is called to pass the command to your shell. Check !? for more options and usage examples.

> !ls         ; run `ls` in the shell

The meaning of the arguments (iter, addr, size) depends on the specific command. As a rule of thumb, most commands take a number as an argument to specify the number of bytes to work with, instead of the currently defined block size. Some commands accept math expressions or strings.

> px 0x17     ; show 0x17 bytes in hexs at current seek
> s base+0x33 ; seeks to flag 'base' plus 0x33
> / lib       ; search for 'lib' string.

The @ sign is used to specify a temporary offset location or a seek position at which the command is executed, instead of current seek position. This is quite useful as you don't have to seek around all the time.

> p8 10 @ 0x4010  ; show 10 bytes at offset 0x4010
> f patata @ 0x10 ; set 'patata' flag at offset 0x10

Using @@ you can execute a single command on a list of flags matching the glob. You can think of this as a foreach operation:

> s 0
> / lib             ; search 'lib' string
> p8 20 @@ hit0_*   ; show 20 hexpairs at each search hit

The > operation is used to redirect the output of a command into a file (overwriting it if it already exists).

> pr > dump.bin   ; dump 'raw' bytes of current block to file named 'dump.bin'
> f  > flags.txt  ; dump flag list to 'flags.txt'

The | operation (pipe) is similar to what you are used to expect from it in a *NIX shell: an output of one command as input to another.

[0x4A13B8C0]> f | grep section | grep text
0x0805f3b0 512 section._text
0x080d24b0 512 section._text_end

You can pass several commands in a single line by separating them with a semicolon ;:

> px ; dr

Using _, you can print the result that was obtained by the last command.

[0x00001060]> axt 0x00002004
main 0x1181 [DATA] lea rdi, str.argv__2d_:__s
[0x00001060]> _
main 0x1181 [DATA] lea rdi, str.argv__2d_:__s
Command Format