rabin21

Usage

Overview

A binary information extractor supporting ELF, PE, MZ, and Mach-O formats, providing details on headers, sections, symbols, imports, exports, and debug data.

Most options are also available within the radare2 'i' command (type 'i?' for help).

-@ addr

Show section, symbol or import at given address

-A

List sub-binaries and their associated arch-bits pairs

-a arch

Set arch (x86, arm, .. or <arch>_<bits>)

-b bits

Set bits (32, 64, ...)

-B addr

Override base address (for address independent binaries)

-c

List classes

-cc

List classes in header format

-C [fmt:C[:D]]

Create [elf,mach0,pe] with Code and Data hexpairs (see -a)

-d

Show debug/dwarf information

-D lang symbolname|-

Demangle symbol name (or - to read from stdin) for lang (cxx, ibmxl, swift, java, msvc, ..)

-e

Program entrypoint

-ee

Constructor/destructor entrypoints

-E

Globally exportable symbols

-f subbin

Select sub-binary architecture. Useful for fat-mach0 binaries

-F binfmt

Force to use that bin plugin (ignore header check)

-g

Same as -SMZIHVResizcld -SS -SSS -ee (show all info)

-G addr

Load address . address to header

-h

Show this help message

-H

Header fields

-I

Binary info

-i

Imports (symbols imported from libraries)

-j

Output in json

-J var

Display environment variable

-k query

Perform SDB query on loaded file. For example: '*'

-K algo

Calculate section checksums (md5, sha1, ..)

-l

List linked libraries to the binary

-L plugin

List supported bin plugins or plugin details

-m addr

Show source line at addr

-M

Main (show address of main symbol)

-n str

Show section, symbol or import named str

-N minlen:maxlen

Force min:max number of chars per string (see -z and -zz)

-o str

Output file or extraction directory for write operations

-O binop

Perform binary operation on target binary (dump, resize, change sections, ...). Use -O help for more information:

 e/0x8048000       change entrypoint
 d/s/1024          dump symbols
 d/S/.text         dump section
 r/.data/1024      resize section
 R                 remove RPATH
 a/l/libfoo.dylib  add library
 p/.data/rwx       change section permissions
 c                 show Codesign data
 C                 show LDID entitlements

-p

Show always physical addresses

-P

Show debug/pdb information

-PP

Download pdb file for binary

-q

Be quiet, just show less data

-qq

Show less info (no addr/size for -z for ex.)

-Q

Show load address used by dlopen (non-aslr libs)

-r

Radare output

-R

Relocations

-s

Symbols

-S

Sections

-SS

Segments

-SSS

Sections mapping to segments

-t

Display file hashes

-T

Display file signature, certificates and signing details

-u

Resources

-v

Display version and quit

-V

Show binary version information

-w

Display try/catch blocks

-x

Extract sub-binaries contained in the file (for example, architectures inside a FAT Mach-O binary). Combine with -S, -SS, or -u to extract sections, segments, or raw resources instead. Thus, -xS extracts sections, -xSS extracts segments, and -xu extracts resources. Resource extraction may be combined with section or segment extraction. Section, segment, and resource filenames include their kind, sanitized name or type, and index; existing files are never overwritten. Use -o dir to select the output directory. Without it, sections, segments, and resources are written below <file>.sections, <file>.segments, and <file>.resources, respectively. Sub-binaries retain the traditional <file>.fat directory.

-X format file ...

Package in fat or zip the given files

-z

Strings (from data section)

-Z

Guess size of binary program

-zz

Show strings from raw bins

-zzz

Dump raw strings to stdout (for huge files)

Environment

R2_NOPLUGINS

Same as r2 -N. Do not load shared plugins

R2_PLUGINS_ORDER

Plugin load order: i=internal, e=env, h=home, s=system; default=iehs; ? prints help

RABIN2_ARGS

Ignore CLI and use these arguments instead

RABIN2_CHARSET

Set default value charset for -z strings

RABIN2_DEBASE64

Same as r2 -e bin.str.debase64 - try to decode all strings as base64 if possible

RABIN2_DEMANGLE

Same as r2 -e bin.demangle - demangle symbols

RABIN2_DEMANGLE_CMD

Same as r2 -e bin.demangle.cmd - try to purge false positives

RABIN2_DEMANGLE_TRYLIB

Same as r2 -e bin.demangle.trylib=<bool> - load Swift libs to demangle (default: false)

RABIN2_FILTER

Same as r2 -e bin.filter=<bool> - set to false to not rename duplicated symbols/sections (default: true)

RABIN2_LANG

Same as r2 -e bin.lang - assume lang for demangling

RABIN2_MACHO_NOFUNCSTARTS

If set it will ignore the FUNCSTART information

RABIN2_MACHO_NOSWIFT

Avoid parsing the swift metadata

RABIN2_MACHO_SKIPFIXUPS

Do not parse the mach-o chained fixups

RABIN2_MAXSTRBUF

Same as r2 -e bin.str.maxbuf - specify maximum buffer size

RABIN2_PDBSERVER

Same as r2 -e pdb.server - use alternative PDB server

RABIN2_PREFIX

Same as r2 -e bin.prefix - prefix symbols/sections/relocs with a specific string

RABIN2_RESRAW

Same as r2 -e bin.resraw=true - extract resources without decoding their contents

RABIN2_STRFILTER

Same as r2 -e bin.str.filter

RABIN2_STRPURGE

Same as r2 -e bin.str.purge - try to purge false positives

RABIN2_SYMSTORE

Same as r2 -e pdb.symstore - path to downstream symbol store

RABIN2_VERBOSE

Same as r2 -e bin.verbose=true - show debugging messages from the parser

Examples

List symbols of a program

$ rabin2 -s a.out

Get offset of symbol

$ rabin2 -n _main a.out

Get entrypoint

$ rabin2 -e a.out

Load symbols and imports from radare2

$ r2 -n /bin/ls
[0x00000000]> .!rabin2 -prsi $FILE