循环
One of the most common task in automation is looping through something, there are multiple ways to do this in radare2.
We can loop over flags:
For example, we want to see function information with afi command:
Now let's say, for example, that we'd like see a particular field from this output for all functions found by analysis. We can do that with a loop over all function flags (whose names begin with fcn.):
This command will extract the name field from the afi output of every flag with a name matching the regexp fcn.*.
We can also loop over a list of offsets, using the following syntax:
For example, say we want to see the opcode information for 2 offsets: the current one, and at current + 2:
Note we're using the $$ variable which evaluates to the current offset. Also note that $$+2 is evaluated before looping, so we can use the simple arithmetic expressions.
A third way to loop is by having the offsets be loaded from a file. This file should contain one offset per line.
radare2 also offers various foreach constructs for looping. One of the most useful is for looping through all the instructions of a function:
In this example the command pi 1 runs over all the instructions in the current function (entry0). There are other options too (not complete list, check @@? for more information):
@@k sdbquery- iterate over all offsets returned by that sdbquery@@t- iterate over on all threads (see dp)@@b- iterate over all basic blocks of current function (see afb)@@f- iterate over all functions (see aflq)
The last kind of looping lets you loop through predefined iterator types:
symbols
imports
registers
threads
comments
functions
flags
This is done using the @@@ command. The previous example of listing information about functions can also be done using the @@@ command:
This will extract name field from afi output and will output a huge list of function names. We can choose only the second column, to remove the redundant name: on every line:
Beware, @@@ is not compatible with JSON commands.
最后更新于
这有帮助吗？