Migration from ida, GDB or WinDBG

How to run the program using the debugger

r2 -d /bin/ls - start in debugger mode => [video]

How do I attach/detach to running process ? (gdb -p)

r2 -d <pid> - attach to process

r2 ptrace://pid - same as above, but only for io (not debugger backend hooked)

[0x7fff6ad90028]> o-225 - close fd=225 (listed in o~[1]:0)

r2 -D gdb gdb://localhost:1234 - attach to gdbserver

How to set args/environment variable/load a specific libraries for the debugging session of radare

Use rarun2 (libpath=$PWD:/tmp/lib, arg2=hello, setenv=FOO=BAR ...) see rarun2 -h / man rarun2

How to script radare2 ?

r2 -i <scriptfile> ... - run a script after loading the file => [video]

r2 -I <scriptfile> ... - run a script before loading the file

r2 -c $@ | awk $@ - run through awk to get asm from function => [link]

[0x80480423]> . scriptfile - interpret this file => [video]

[0x80480423]> #!c - enter C repl (see #! to list all available RLang plugins) => [video], everything have to be done in a oneliner or a .c file must be passed as an argument.

To get #!python and much more, just build radare2-bindings

How to list Source code as in gdb list ?

CL @ sym.main - though the feature is highly experimental


CommandIDA Proradare2r2 (visual mode)GDBWinDbg
Analysis of everythingAutomatically launched when opening a binaryaaa or -A (aaaa or -AA for even experimental analysis)N/AN/AN/A
xref toxaxtxN/AN/A
xref fromctrl + jaxfXN/AN/A
xref to graph?agt [offset]?N/AN/A
xref from graph?agf [offset]?N/AN/A
list functionsalt + 1afl;istN/AN/A
listingalt + 2pdfpN/AN/A
hex modealt + 3pxaPN/AN/A
importsalt + 6ii:iiN/AN/A
exportsalt + 7is~FUNC?N/AN/A
follow jmp/callenters offsetenter or 0-9N/AN/A
undo seekescs-uN/AN/A
redo seekctrl+enters+UN/AN/A
show graphspaceagvVN/AN/A
graph viewspaceagvVN/AN/A
define as datadCd [size]dd,db,dw,dWN/AN/A
define as codecC- [size]d- or duN/AN/A
define as undefineduC- [size]d- or duN/AN/A
define as stringACs [size]dsN/AN/A
define as structAlt+QCf [size]dFN/AN/A
Start Process/ Continue executionF9dcF9r and cg
Terminate ProcessCtrl+F2dk 9?killq
step intoF7dssnt
step into 4 instructions?ds 4F7n 4t 4
step overF8dsoSsp
step until a specific address?dsu <addr>?sg <addr>
Run until returnCtrl+F7dcr?finishgu
Run until cursorF4#249#249N/AN/A
Show Backtrace?dbt?bt
display RegisterOn register Windowsdr allShown in Visual modeinfo registersr
display eaxOn register Windowsdr?eaxShown in Visual modeinfo registers eaxr rax
display old state of all registers?dro???
display function addr + N?afi $$ - display function information of current offset ($$)???
display frame state?pxw rbp-rsp@rsp?i f?
How to step until condition is true?dsi???
Update a register value?dr rip=0x456?set $rip=0x456r rip=456
disassembly forwardN/ApdVpdisasuf, u
disassembly N instructionsN/Apd XVpx/iu <addr> LX
disassembly N (backward)N/Apd -XVpdisas <a-o> <a>ub
Information on the bin
Sections/regionsMenu sectionsiS or S (append j for json)N/Amaint info sections!address
Load symbol file
Sections/regionspdb menuasm.dwarf.file, pdb.XX)N/Aadd-symbol-filer
Stack TraceN/AdbtN/Abtk
Stack Trace in JsonN/AdbtjN/A
Partial Backtrace (innermost)N/Adbt (dbg.btdepth dbg.btalgo)N/Abt k
Partial Backtrace (outermost)N/Adbt (dbg.btdepth dbg.btalgo)N/Abt -
Stacktrace for all threadsN/Adbt@tN/Athread apply all bt~* k
Breakpoint listCtrl+Alt+Bdb?info breakpointsbl
add breakpointF2db [offset]F2breakbp
Switch to threadThread menudpN/Athread <N>~<N>s
Frame NumbersN/A?N/Aany bt commandkn
Select FrameN/A?N/Aframe.frame
Display parametersN/AafvN/Ainfo argsdv /t /i /V
Display parametersN/AafvN/Ainfo localsdv /t /i /V
Display parameters/locals in jsonN/AafvjN/Ainfo localsdv /t /i /V
list addresses where vars are accessed(R/W)N/AafvR/afvWN/A??
Project Related
open projectPo [file]?
save projectautomaticPs [file]?
show project informationsPi [file]?
Dump byte char arrayN/Apc? (json, C, char, etc.)Vppppx/bcdb
optionsoption menue?e
searchsearch menu/?Select the zone with the cursor c then /s

Equivalent of "set-follow-fork-mode" gdb command

This can be done using 2 commands:

  1. dcf - until a fork happen
  2. then use dp to select what process you want to debug.

Common features

  • r2 accepts FLIRT signatures
  • r2 can connect to GDB, LLVM and WinDbg
  • r2 can write/patch in place
  • r2 have fortunes and [s]easter eggs[/s]balls of steel
  • r2 can do basic loading of ELF core files from the box and MDMP (Windows minidumps)