8

I'm practicing with Radare2, latest commit.

radare2 2.3.0-git 16814 @ linux-x86-64 git.2.2.0-5-g61a903315

During my sessions, I need to rename local variables to a more understandable name, e.g.

var int local_110h @ rbp-0x110
:> afvn local_110h commandLine

Is there a command to inspect what's inside this variable and, eventually, what's pointing to?

I was expecting this:

px @ commandLine
px @ [commandLine]

But it doesn't work:

:>px @ commandLine
Invalid address (commandLine)
|ERROR| Invalid command 'px @ commandLine' (0x70)

Passing through rbp works flawlessly.

px @ rbp-0x100
Megabeets
  • 8,989
  • 2
  • 24
  • 48
Kartone
  • 439
  • 4
  • 14

1 Answers1

5

You should use afvd. 

[0x00402a00]> afv?
...
...
| afvd name     output r2 command for displaying the value of args/locals in the debugger
...
...

Executing only afvd will print you the values of all the local variables in the function, and if you'll execute it with a variable name you'll get radare2 command as a result:

[0x00402a00]> afvn local_110h commandLine
[0x00402a00]> afvd commandLine
pxr $w @rsp+0x110

you'll get pxr $w @rsp+0x110, which is a radare2 command.

You can add a dot . before it to execute it:

[0x00402a00]> .afvd commandLine
0x7fffdc9e9258  0x28ffedf4ccd19d64   d......(

If, for example, you only want the address, you can use radare's internal grep.

[0x00402a00]> .afvd commandLine~[0]
0x7fffdc9e9258

For more information about radare's grep, execute ~?

Megabeets
  • 8,989
  • 2
  • 24
  • 48