rabin2(1) Binary program info extractor


rabin2 [-ACeigsSMzIHlRrLxvVh [-a arch ] ] [-b bits ] [-B addr ] [-c fmt:C:[D] ] [-f subbin ] [-O str ] [-o str ] [-m addr ] [-@ addr ] [-n str ] file


This program allows you to get information about ELF/PE/MZ and CLASS files in a simple way.

List archs
-a arch
Set arch (x86, arm, .. accepts underscore for bits x86_32)
-b bits
Set bits (32, 64, ...)
-B addr
Override baddr
-c [fmt:C[:D]]
Create [elf,mach0,pe] for arm and x86-32/64 tiny binaries where 'C' is an hexpair list of the code bytes and ':D' is an optional concatenation to describe the bytes for the data section.
List classes
Show entrypoints for disk and on-memory
-f subbin
Select sub-binary architecture. Useful for fat-mach0 binaries
Same as -SMRevsiz (Show all possible information). See -r
Show imports (symbols imported from libraries)
Show exported symbols
Show sections
Show address of 'main' symbol
Show strings inside .data section (like gnu strings does)
Show binary info
Show header fields
List linked libraries to the binary
Show realocations
-O str
Write/extract operations (-O help)
-o str
Output file/folder for write operations (out by default)
Show output in radare format
Display virtual addressing offsets
-m addr
Show source line reference from a given address
List supported bin plugins
-@ addr
Show information (symbol, section, import) of the given address
-n str
Show information (symbol, section, import) at string offset
Extract all sub binaries from a fat binary (f.ex: fatmach0)
Show version information
Show usage help message.


List symbols of a program

  $ rabin2 -s a.out

Get offset of symbol

  $ rabin2 -n _main a.out

Get entrypoint

  $ rabin2 -e a.out

Load symbols and imports from radare

  .!rabin2 -vrsi a.out


Written by pancake <[email protected]> and nibble <[email protected]>.