SYNOPSIS

radare [-s seek ] [-b size ] [-i script ] [-P project ] [-l plugin ] [-e key=val ] [-d program ] [-fLcwxnvVuh ] target-file

DESCRIPTION

radare is a commandline hexadecimal editor.

This software package contains another utilities related to the hex and asm world. Read the 'see also' section for more information.

You can use radare as in pipes, from the shell, entering the visual mode with the 'V' command, or just graphically using gradare or the ag command to generate and visualize code analysis graphs from the current seek.

Most of the commands accept a '?' mark at the end to show the help for it.

The commands are composed in the following way:

> [repeat][.!][command] [arg] @ [offset:blocksize]

These are the supported flags:

-S minlen

Enters into the 'strings' mode, and defines a minimum length required for the strings.

-s offset

Start at a certain offset inside the file.

-d prg|pid

Run radare in debugger mode and open the program path or attach to pid

-b size

Change the block size (default is 512, 4096 should be useful for filesystems).

-f

Set block size = file size

-i script

Interprets a script of radare commands

-l plugin

Links radare against the desired plugin. Read about io plugins for more information. See -L

-P prj.rdb

Define a project file for this session. The projects can be managed with the 'P' command.

-e key=val

Change the default value for an eval configuration key variable

-L

List all available plugins embedded inside radare.

-n

Do not load ~/.radarerc or ./radarerc

-c

Enable color. Same as -e scr.color=true

-u

Unknown size. Avoid limit when seeking. Useful for devices or attaching to processes.

-v

Drops verbosity. Useful flag for scripts, to use radare in pipe mode.

-V

Show version information and exits.

-w

Opens the target file in write mode. In write mode changes are made inmediately. So take care because no commit command exist.

-h

Show help message

SHELL

The command line interface of radare have multiple commands to be entered. Type '?' for help.

The readline extension allows you to autocomplete commands and arguments. Numberic argument can be converted into hexadecimal or decimal bases by using the 'tab' key. For example: $ s 10<tab> $ s 0xa

-b size

(b) Change blocksize.

-c[dxf] arg

compares memory from string, offset or file contents against current block. Outputs bindiff.

-e 0|1

(endian) Changes environment endian into little (0) or big (1).

-f -|name

(flag) This command allows you to manage flags. Flags are bookmarks around the file. The search engine store the results as flags. You can list flags by typing 'f' or 'flag' without arguments. 'flag name' sets a new flag using the current environment settings (seek, block size). By prefixing a name with the '-' character you will be able to remove a named flag.

i

(info) Shows radare's environment information (file, endian, count, mode, size, block size, seek, limit, ...)

m [s] [d]

(m) moves 's' bytes from the current block to the 'd' destination offset. This command requires the write mode to be enabled. Run radare with '-w' flag or type '%WRITE_MODE 1' into the shell.

o [file]

(open) opens a file in the mode defined by the %WRITE_MODE environment variable closing the current working file.

p[f] [n]

(pa, pb, pc, pd, po, pr, ps, pu, px, pX) Prints 'n' bytes in the 'f' print format. Available print formats are documented in the 'print format' section.

-R arg

Manipulates RDB files and data structures. Allows to store code analysis, bindiff them, dump to memory, graph it in cairo or dump/restore them from/to disk

r [size]

(resize) Changes the size of the file by truncating or extending the file padding zeros at the end.

s [+-]off

Seeks to an absolute or relative (using the '+' or '-' prefixes) offset. The 'off' argument can be a numeric value or a flag name. (Read 'f' command for more information).

-y len

Copies len bytes from current seek to a clipboard. Use the 'yy' command to paste it to current seek again.

-e key=val

Change the default value for an eval configuration key variable

V

(Visual) Enters into the visual mode. Use the 'q' key to exit this mode.

w[aAdfwx] str

Write a formatted string or an hexadecimal space separated string. 'wf' is for specifying a file as contents for write. 'wa' is for assembly, etc.. See 'w?' for details. f.ex: '$ w foo\x90' or '$ wx 90 90 90'

x [len]

(x) eXamine current block. This is an alias for the 'px' command. To be gdb friendly.

. [file]

(.) Interpret a file as a radare command scripting file. A simple example can be found in 'libexec/elf-entry-point'. You can read 'libexec/elf-flag-header' too. This script creates a flag for each field of an elf header.

[-+]off

Alias of 'seek [+-]off'.

[<] [>]

Move data block window to the previous ('<') aligned block offset or the next one ('>').

/ str

Searchs a string from the current offset until the end of file or 'cfg.limit' if defined (see 'e' command). To enter a hexadecimal string you can type '\x01\x02\x03...' or use the '/x' command with hexpairs. Here's the supported arguments:

/s [string]

search for an plain ascii string (use \x## for binary inclusion)

/w [string]

search for an wide char string ('a\x00b\x00')

/x [string]

search using hexpair format (00 33 4a f2)

/a

look for expanded aes keys (victor mun~oz algorithm)

//

repeat last search

You can define multiple keywords at a time and launch ranged searches:

/k# [string]

Set keyword number '#' to ascii format string (with esc. chars). f.ex: "/k0 lib"

/m# [mask]

Define a binary mask for matching with the keyword number '#'.

/r [range]

Perform a search using the keywords in the defined range. f.ex: "/r 0-2,4"

jajaj

! cmd

Runs a commandline shell program.

#[hash]

Calculates the sha1, sha256, sha384, sha512, par, xor, xorpair, hamdist, mod255, crc16, crc32, md4, md5, entropy of the current block from the selected seek

q

(quit) Quits the program.

VISUAL

Visual mode allows you to move around the data with 'hjkl' arrows. The '0' and 'G' command are used to go at the first of the file or at the end. 'H' 'L' keys are used to move two bytes forward or backward (double 'h', 'l'). 'J' and 'K' keys are used to seek one block forward or backward.

<

Go seek to the previous or next offset aligned to a multiple of the data block size (use the :b command to read the value).

p

The 'p' command allows you to circle around the different available print mode formats (binary, hexadecimal, disassembler, octal, url, shellcode, c array, ...)

[+-*/]

The basic math ops keys are used to change the size of the working data block. Use '+' and '-' to increase and decrease the size by 1 byte. And '*' and '/' to add or substract one row of bytes (screen depend).

d

Change data type for the current block or selected bytes with cursor mode. (dd = hex bytes, dc = code, ds = string)

i

Enter interactive write mode (use tab to move between hex and ascii columns)

:

The double-dot sign is used to temporally enter into the command line interface and use the desired radare shell commands. f.e: $ Visual :!ls.

PRINT FORMAT

Print formats are used to format current working block into a certain format. Use p? to list supported ones.

The output is affected by cfg.endian (see eval command)

A

[-P] Analyze data from current seek. Tries to find memory pointers, strings, pointers to strings, etc. Useful to see stack contents and data structures in memory.

m [format]

[-P] Formats memory contents as byte, dword, pointers, strings, etc.. Useful to parse data structures (see 'rsc spcc' fmi)

b

[VP] Binary format

%

[VP] print progress bar of the whole file marking current seek and flag positions

B

[VP] LSB steganography (take each less significat bit of each byte to complete bytes)

o

[VP] Octal format

O

[VP] Zoom out view (see 'eval zoom.' fmi)

x

[VP] Hexadecimal value. The view command also have (vx, vw, vW, wq) commands for visualizing one, two, four or eight bytes in hexadecimal (endian affected).

f

[V-] Floating point value (4 first bytes)

i

[V-] Integer value (4 first bytes)

l

[V-] long (4 bytes)

L

[V-] long long (8 bytes)

o

[V-] octal value (1 byte)

s

[V-] ascii string (until end of block escapping chars)

S

[V-] string with printable chars until end of block

z

[V-] ascii string (until \0)

Z

[V-] wide ascii string (until \0 with interlaced \0)

F

[-P] WINDOWS filetime format (64 bit)

t

[-P] UNIX timestamp (4 bytes, probably 8 in the future)

T

[-P] DOS timestamp (4 bytes)

c

[-P] C array format (unsigned char buffer[ (block size) ] = { 0x90, 0x90, ... };

a

[-P] Shows the current block as if it was a shellcode in hexadecimal.

r

[-P] Prints out the current data block to stdout.

u

[-P] URL encoding format f.ex: '$ pu' -> %4c%69%63...

d

[VP] disassemble N opcodes

D

[VP] disassemble N bytes fg

DEBUGGER

The debugger supports multiple commands accessible from the io_system() hook of the plugin. Use !help to list the available commands.

!load

Reload the process into the debugger

!maps

Show process memory maps (marks current with '*')

!step

Perform a step on the attached process

!stepu

step until user code

!stepbp

emulate a step using breakpoints and code analysis

!run

run the program

!attach [tid|pid]

attach to another thread or process id

!detach

silent unplug

!kill [-signal] [pid]

send a signal to the process

!jmp [addr]

change the program counter of the process

!call [addr]

simulate a call (jmp + stack return address)

!regs

get register values

!fpregs

get floating point register values

!oregs

get old register values (previous step)

!dr[rwx-]

manipulate the DRX hardware registers (x86 only)

!set [reg] [val]

change the register value (eax, eflags, r0, etc..)

!fd

manage the file descriptors of the child process (dup, open, close, seek)

!bt

Show backtrace

!st

Show stacktrace (low level backtrace)

!cont

continue util user code

!contu [addr]

continue execution until address

alloc [size]

Allocate 'size' bytes on the child process

free [address]

frees the memory previously allocated in the selected address

mmap [file] [offset]

mmaps a file into a certain offset in the child process

!contsc

continue until syscall

!contfork

continue until new process is created

!contuh

continue until here (useful for loop analysis)

!bp [addr]

set or remove a breakpoint (use !bp? for help, and prefix the address with '-' to remove it)

!mp [rwx] [addr]

change memory page protections (useful for watchpoints and so)

!dump [dir]

Performs a dump of all the process memory pages and register state to disk (with no arguments it is auto-incremental)

!restore [dir]

Restores a previous dump of the process memory from disk

MOVEMENT

To move around the file you can use the hjkl in visual mode or the 'seek' command in the command line interface.

To move around the blocks you can use the '<' '>' commands to align your current seek to a block size multiple. Same keys for the visual mode.

You can seek to a relative offset by prefixing your offset by the '+' or '-' characters. For example: $ seek +10

You can also use the temporal seek format for commands appending the '@' to the end of the command

AUTHORS

pancake <@youterm.com>