Visual Disassembly

Navigation

Move within the Disassembly using arrow keys or hjkl. Use g to seek directly to a flag or an offset, type it when requested by the prompt: [offset]>. Follow a jump or a call using the number of your keyboard [0-9] and the number on the right in disassembly to follow a call or a jump. In this example typing 1 on the keyboard would follow the call to sym.imp.__libc_start_main and therefore, seek at the offset of this symbol.

0x00404894 e857dcffff call sym.imp.__libc_start_main ;[1]

Seek back to the previous location using u, U will allow you to redo the seek.

d
as define

d can be used to change the type of data of the current block, several basic types/structures are available as well as more advanced one using pf template:

d → ...

0x004048f7 48c1e83f shr rax, 0x3f

d → b

0x004048f7 .byte 0x48

d → B

0x004048f7 .word 0xc148

d → d

0x004048f7 hex length=165 delta=0

0x004048f7 48c1 e83f 4801 c648 d1fe 7415 b800 0000

...

To improve code readability you can change how radare2 presents numerical values in disassembly, by default most of disassembly display numerical value as hexadecimal. Sometimes you would like to view it as a decimal, binary or even custom defined constant. To change value format you can use d following by i then choose what base to work in, this is the equivalent to ahi:

d → i → ...

0x004048f7 48c1e83f shr rax, 0x3f

d → i → 10

0x004048f7 48c1e83f shr rax, 63

d → i → 2

0x004048f7 48c1e83f shr rax, '?'

Usage of the Cursor for Inserting/Patching...

Remember that, to be able to actually edit files loaded in radare2, you have to start it with the -w option. Otherwise a file is opened in read-only mode.

Pressing lowercase c toggles the cursor mode. When this mode is active, the currently selected byte (or byte range) is highlighted.

The cursor is used to select a range of bytes or simply to point to a byte. You can use the cursor to create a named flag at specifc location. To do so, seek to the required position, then press f and enter a name for a flag. If the file was opened in write mode using the -w flag or the o+ command, you can also use the cursor to overwrite a selected range with new values. To do so, select a range of bytes (with HJKL and SHIFT key pressed), then press i and enter the hexpair values for the new data. The data will be repeated as needed to fill the range selected. For example: