Command |
IDA Pro |
radare2 |
r2 (visual mode) |
GDB |
WinDbg |
Analysis |
|
|
|
|
|
Analysis of everything |
Automatically launched when opening a binary |
aaa or -A (aaaa or -AA for even experimental analysis) |
N/A |
N/A |
N/A |
Navigation |
|
|
|
|
|
xref to |
x |
axt |
x |
N/A |
N/A |
xref from |
ctrl + j |
axf |
X |
N/A |
N/A |
xref to graph |
? |
agt [offset] |
? |
N/A |
N/A |
xref from graph |
? |
agf [offset] |
? |
N/A |
N/A |
list functions |
alt + 1 |
afl;is |
t |
N/A |
N/A |
listing |
alt + 2 |
pdf |
p |
N/A |
N/A |
hex mode |
alt + 3 |
pxa |
P |
N/A |
N/A |
imports |
alt + 6 |
ii |
:ii |
N/A |
N/A |
exports |
alt + 7 |
is~FUNC |
? |
N/A |
N/A |
follow jmp/call |
enter |
s offset |
enter or 0-9 |
N/A |
N/A |
undo seek |
esc |
s- |
u |
N/A |
N/A |
redo seek |
ctrl+enter |
s+ |
U |
N/A |
N/A |
show graph |
space |
agv |
V |
N/A |
N/A |
Edit |
|
|
|
|
|
rename |
n |
afn |
dr |
N/A |
N/A |
graph view |
space |
agv |
V |
N/A |
N/A |
define as data |
d |
Cd [size] |
dd,db,dw,dW |
N/A |
N/A |
define as code |
c |
C- [size] |
d- or du |
N/A |
N/A |
define as undefined |
u |
C- [size] |
d- or du |
N/A |
N/A |
define as string |
A |
Cs [size] |
ds |
N/A |
N/A |
define as struct |
Alt+Q |
Cf [size] |
dF |
N/A |
N/A |
Debugger |
|
|
|
|
|
Start Process/ Continue execution |
F9 |
dc |
F9 |
r and c |
g |
Terminate Process |
Ctrl+F2 |
dk 9 |
? |
kill |
q |
Detach |
? |
o- |
? |
detach |
|
step into |
F7 |
ds |
s |
n |
t |
step into 4 instructions |
? |
ds 4 |
F7 |
n 4 |
t 4 |
step over |
F8 |
dso |
S |
s |
p |
step until a specific address |
? |
dsu |
? |
s |
g |
Run until return |
Ctrl+F7 |
dcr |
? |
finish |
gu |
Run until cursor |
F4 |
#249 |
#249 |
N/A |
N/A |
Show Backtrace |
? |
dbt |
? |
bt |
|
display Register |
On register Windows |
dr all |
Shown in Visual mode |
info registers |
r |
display eax |
On register Windows |
dr?eax |
Shown in Visual mode |
info registers eax |
r rax |
display old state of all registers |
? |
dro |
? |
? |
? |
display function addr + N |
? |
afi $$ - display function information of current offset ($$) |
? |
? |
? |
display frame state |
? |
pxw rbp-rsp@rsp |
? |
i f |
? |
How to step until condition is true |
? |
dsi |
? |
? |
? |
Update a register value |
? |
dr rip=0x456 |
? |
set $rip=0x456 |
r rip=456 |
Disassembly |
|
|
|
|
|
disassembly forward |
N/A |
pd |
Vp |
disas |
uf, u |
disassembly N instructions |
N/A |
pd X |
Vp |
x/i |
u LX |
disassembly N (backward) |
N/A |
pd -X |
Vp |
disas |
ub |
Information on the bin |
|
|
|
|
|
Sections/regions |
Menu sections |
iS or S (append j for json) |
N/A |
maint info sections |
!address |
Load symbol file |
|
|
|
|
|
Sections/regions |
pdb menu |
asm.dwarf.file, pdb.XX) |
N/A |
add-symbol-file |
r |
BackTrace |
|
|
|
|
|
Stack Trace |
N/A |
dbt |
N/A |
bt |
k |
Stack Trace in Json |
N/A |
dbtj |
N/A |
|
|
Partial Backtrace (innermost) |
N/A |
dbt (dbg.btdepth dbg.btalgo) |
N/A |
bt |
k |
Partial Backtrace (outermost) |
N/A |
dbt (dbg.btdepth dbg.btalgo) |
N/A |
bt - |
|
Stacktrace for all threads |
N/A |
dbt@t |
N/A |
thread apply all bt |
~* k |
Breakpoints |
|
|
|
|
|
Breakpoint list |
Ctrl+Alt+B |
db |
? |
info breakpoints |
bl |
add breakpoint |
F2 |
db [offset] |
F2 |
break |
bp |
Threads |
|
|
|
|
|
Switch to thread |
Thread menu |
dp |
N/A |
thread |
~s |
Frames |
|
|
|
|
|
Frame Numbers |
N/A |
? |
N/A |
any bt command |
kn |
Select Frame |
N/A |
? |
N/A |
frame |
.frame |
Parameters/Locals |
|
|
|
|
|
Display parameters |
N/A |
afv |
N/A |
info args |
dv /t /i /V |
Display parameters |
N/A |
afv |
N/A |
info locals |
dv /t /i /V |
Display parameters/locals in json |
N/A |
afvj |
N/A |
info locals |
dv /t /i /V |
list addresses where vars are accessed(R/W) |
N/A |
afvR/afvW |
N/A |
? |
? |
Project Related |
|
|
|
|
|
open project |
|
Po [file] |
|
? |
|
save project |
automatic |
Ps [file] |
|
? |
|
show project informations |
|
Pi [file] |
|
? |
|
Miscellaneous |
|
|
|
|
|
Dump byte char array |
N/A |
pc? (json, C, char, etc.) |
Vpppp |
x/bc |
db |
options |
option menu |
e? |
e |
|
|
search |
search menu |
/? |
Select the zone with the cursor c then / |
|
s |