As usual, we start with our
$ r2 -A /bin/ls [0x004048c5]>
We can enter visual mode with the command
You will be presented with a hex view of the binary. You can cycle between view modes using
P. You can identify each mode by reading the prompt, which shows you which command is being run to generate the output.
[0x004048c5 15% 512 /bin/ls]> x @ entry0 # Hex mode [0x004048c5 15% 512 /bin/ls]> pd $r @ entry0 # Disassembly mode [0x004048c5 15% 160 /bin/ls]> ?0;f tmp;s.. @ entry0 # Hex|Registers|Disassembly [0x004048c5 15% 512 /bin/ls]> pxw @ entry0 # Hex words [0x004048c5 15% 160 /bin/ls]> pc @ entry0 # C buffers [0x004048c5 15% 4096 /bin/ls]> pxA @ entry0 # Operation analysis [0x004048c5 15% 512 /bin/ls]> pxa @ entry0 # Annotated hexdump
For now, we are going to focus on the disassembly view (by pressing
As always, you can press
? to view available shortcuts in this mode. For now, we will focus on navigation; there are a few shortcuts which are not so obvious.
You can move up or down (instruction by instruction) via the arrow keys or
j (down) and
k (up), similar to Vim. Move up or down over entire functions via
When the current instruction is a
jmp or a
call, you can follow it by pressing
<Enter>. But there's a faster way. Notice that the
call sym.imp.__libc_start_main instruction has a comment with the number
1 between square brackets. If you press
1, even if you are not currently positioned on the call instruction, you will follow that call. The same goes for the
jmp instruction further down, with
2 commented in square brackets.
You can go to any offset with
o. You can undo any seek at any time via the
u key and redo it with
You can set marks at any point using
m followed by any key (case-sensitive). To go to a mark, press
' followed by the mark key. Be aware that marks are not highlighted in any way in contrast to flags.
Fuzzy flag searcher
A fuzzy-like searcher can be accessed with the
_ key, very handy for quickly finding and switching between functions, strings and other flags.
You can get a list of cross-references (xrefs, for short) from/to data using
For example, pressing
X in main will yield
Again, using the numbers
1-9, you can quickly go to any of these references.