debuggingreverse-engineeringdisassemblyradare2

radare2 print data of pointer to pointer


I am debugging a program with radare2. I have a char** saved in %rax, so essentially a array of strings. It is already offset to the right position in the array. Now I want to print that string.

In GDB I would just do

(gdb) x/s *((char **)($rax))
0x7fffffffdf2c: "123456789001234567890"

which gives me the right result.

In radare2 on the other hand, I can only print out the address to the string:

px 8 @rax
- offset -      5051 5253 5455 5657 5859 5A5B 5C5D 5E5F  0123456789ABCDEF
0x7ffd371ff750  c70e 2037 fd7f 0000                      .. 7....

And then I need reverse the byte order because of endianness and print out the pointer manually:

> ps @0x00007ffd37200ec7
123456789001234567890

Which then prints the string.

Is there a faster way, like in GDB?


Solution

  • ps @[rax]

    you could also use pxq @rax or even pv @rax instead of px 8 @rax to get the "reversed" pointer