Выбрать главу

│ 0x0804840c 83f800 var = eax - 0

│ 0x0804840f 7405 if (!var) goto 0x8048416

It can be useful while disassembling obscure architectures.

Selects a target operating system of currently loaded binary. Usually, OS is automatically detected by rabin -rI. Yet, asm.os can be used to switch to a different syscall table employed by another OS.

If defined to "true", disassembler view will have flags column.

If set to "true", draw lines at the left of the disassemble output (pd, pD commands) to graphically represent control flow changes (jumps and calls) that are targeted inside current block. Also, see asm.lines.out.

When defined as "true", the disassembly view will also draw control flow lines that go outside of the block.

A boolean value which changes the direction of control flow analysis. If set to "false", it is done from top to bottom of a block; otherwise, it goes from bottom to top. The "false" setting seems to be a better choice for improved readability and is the default one.

Boolean value which controls the visibility of offsets for individual disassembled instructions.

A boolean value that controls displaying of tracing information (sequence number and counter) at the left of each opcode. It is used to assist with programs trace analysis.

A boolean value used to show or hide displaying of raw bytes of instructions.

A boolean value used to replace register names with arguments or their associated role alias.

For example, if you have something like this:

│ 0x080483ea 83c404 add esp, 4

│ 0x080483ed 68989a0408 push 0x8049a98

│ 0x080483f7 e870060000 call sym.imp.scanf

│ 0x080483fc 83c408 add esp, 8

│ 0x08048404 31c0 xor eax, eax

This variable changes it to:

│ 0x080483ea 83c404 add SP, 4

│ 0x080483ed 68989a0408 push 0x8049a98

│ 0x080483f7 e870060000 call sym.imp.scanf

│ 0x080483fc 83c408 add SP, 8

│ 0x08048404 31c0 xor A0, A0

A boolean value used to substitute jump, call and branch targets in disassembly.

For example, when turned on, it'd display jal 0x80001a40 as jal fcn.80001a40 in the disassembly.

A boolean value which substitutes pc relative expressions in disassembly. When turned on, it shows the references as string references.

For example:

0x5563844a0181 488d3d7c0e00. lea rdi, [rip + 0xe7c] ; str.argv__2d_:__s

When turned on, this variable lets you display the above instruction as:

0x5563844a0181 488d3d7c0e00. lea rdi, str.argv__2d_:__s ; 0x5563844a1004 ; "argv[%2d]: %s\n"

Boolean which shows offsets in disassembly prefixed with the name of the section or map.

That means, from something like:

0x000067ea 488d0def0c01. lea rcx, [0x000174e0]

to the one below, when toggled on.

0x000067ea 488d0def0c01. lea rcx, [fmap.LOAD1.0x000174e0]

Boolean which substitutes the variable expression with the local variable name.

For example: var_14h as rbp - var_14h, in the disassembly.

Change endianness. "true" means big-endian, "false" is for little-endian. "file.id" and "file.flag" both to be true.

If this variable is enabled, help messages will be displayed along with command names in tab completion for commands.

This variable specifies the mode for colorized screen output: "false" (or 0) means no colors, "true" (or 1) means 16-colors mode, 2 means 256-colors mode, 3 means 16 million-colors mode. If your favorite theme looks weird, try to bump this up.

This variable accepts a full-featured expression or a pointer/flag (eg. eip). If set, radare will set seek position to its value on startup.

If you have set up any flagzones (fz?), this variable will let you display the scrollbar with the flagzones, in Visual mode. Set it to 1 to display the scrollbar at the right end, 2 for the top and 3 to display it at the bottom.

A boolen variable to show UTF-8 characters instead of ANSI.

Enables or disables "fortune" messages displayed at each radare start.

Fortunes are classified by type. This variable determines which types are allowed for displaying when cfg.fortunes is true, so they can be fine-tuned on what's appropriate for the intended audience. Current types are tips, fun, nsfw, creepy.

This variable lets you set the size of stack in bytes.

Use r2 -H to list all the environment variables that matter to know where it will be looking for files. Those paths depend on the way (and operating system) you have built r2 for.

R2_PREFIX=/usr

MAGICPATH=/usr/share/radare2/2.8.0-git/magic

PREFIX=/usr

INCDIR=/usr/include/libr

LIBDIR=/usr/lib64

LIBEXT=so

RCONFIGHOME=/home/user/.config/radare2

RDATAHOME=/home/user/.local/share/radare2

RCACHEHOME=/home/user/.cache/radare2

LIBR_PLUGINS=/usr/lib/radare2/2.8.0-git

USER_PLUGINS=/home/user/.local/share/radare2/plugins

USER_ZIGNS=/home/user/.local/share/radare2/zigns

RC files are r2 scripts that are loaded at startup time. Those files must be in 3 different places: