• r2 -d /bin/ls: Opens radare2 with file /bin/ls in debugger mode using the radare2 native debugger, but does not run the program. You’ll see a prompt (radare2) - all examples are from this prompt.
• db flag: place a breakpoint at flag, where flag can be either an address or a function name
• db - flag: remove the breakpoint at flag, where flag can be either an address or a function name
• db: show list of breakpoint
• dc: run the program
• dr: Show registers state
• drr: Show registers references (telescoping) (like peda)
• ds: Step into instruction
• dso: Step over instruction
• dbt: Display backtrace
• dm: Show memory maps
• dk <signal>: Send KILL signal to child
• ood: reopen in debug mode
• ood arg1 arg2: reopen in debug mode with arg1 and arg2
r2 -d /bin/ls - start in debugger mode => [video]
r2 -d <pid> - attach to process
r2 ptrace://pid - same as above, but only for io (not debugger backend hooked)
[0x7fff6ad90028]> o-225 - close fd=225 (listed in o~[1]:0)
r2 -D gdb gdb://localhost:1234 - attach to gdbserver
Use rarun2 (libpath=$PWD:/tmp/lib, arg2=hello, setenv=FOO=BAR ...) see rarun2 -h / man rarun2
r2 -i <scriptfile> ... - run a script after loading the file => [video]
r2 -I <scriptfile> ... - run a script before loading the file
r2 -c $@ | awk $@ - run through awk to get asm from function => [link]
[0x80480423]> . scriptfile - interpret this file => [video]
[0x80480423]> #!c - enter C repl (see #! to list all available RLang plugins) => [video], everything have to be done in a oneliner or a .c file must be passed as an argument.
To get #!python and much more, just build radare2-bindings
CL @ sym.main - though the feature is highly experimental
| Command | IDA Pro | radare2 | r2 (visual mode) | GDB | WinDbg |
|---|---|---|---|---|---|
| Analysis | |||||
| Analysis of everything | Automatically launched when opening a binary | aaa or -A (aaaa or -AA for even experimental analysis) | N/A | N/A | N/A |
| Navigation | |||||
| xref to | x | axt | x | N/A | N/A |
| xref from | ctrl + j | axf | X | N/A | N/A |
| xref to graph | ? | agt [offset] | ? | N/A | N/A |
| xref from graph | ? | agf [offset] | ? | N/A | N/A |
| list functions | alt + 1 | afl;is | t | N/A | N/A |
| listing | alt + 2 | p | N/A | N/A | |
| hex mode | alt + 3 | pxa | P | N/A | N/A |
| imports | alt + 6 | ii | :ii | N/A | N/A |
| exports | alt + 7 | is~FUNC | ? | N/A | N/A |
| follow jmp/call | enter | s offset | enter or 0-9 | N/A | N/A |
| undo seek | esc | s- | u | N/A | N/A |
| redo seek | ctrl+enter | s+ | U | N/A | N/A |
| show graph | space | agv | V | N/A | N/A |
| Edit | |||||
| rename | n | afn | dr | N/A | N/A |
| graph view | space | agv | V | N/A | N/A |
| define as data | d | Cd [size] | dd,db,dw,dW | N/A | N/A |
| define as code | c | C- [size] | d- or du | N/A | N/A |
| define as undefined | u | C- [size] | d- or du | N/A | N/A |
| define as string | A | Cs [size] | ds | N/A |