Assembly Commands Cheat Sheet

admin



Command line options

  1. Summary: This page is a printf formatting cheat sheet. I originally created this cheat sheet for my own purposes, and then thought I would share it here. A great thing about the printf formatting syntax is that the format specifiers you can use are very similar — if not identical — between different languages, including C, C, Java, Perl, PHP, Ruby, Scala, and others.
  2. MIPS Reference Sheet Branch Instructions Instruction Operation beq $s, $t, label if ($s $t) pc += i 0)pc+=i.

Format a Pointer. C Read as integer, print as character. D Integer, signed decimal. F Floating point number. O Integer, print as octal. S Try to treat as C string.

Configuration properties

They can be used in evaluations:? ${asm.tabs}

You will want to set your favourite options in ~/.radare2rc since every line there will be interpreted at the beginning of each session. Mine for reference:

There is an easier interface accessible from the Visual mode, just typing Ve

Basic Commands

Command syntax: [.][times][cmd][~grep][@[@iter]addr!size][|>pipe]; Command chaining: x 3;s+3;pi 3;s+3;pxo 4;| Pipe with shell commands: pd | less! Run shell commands: !cat /etc/passwd!! Escapes to shell, run command and pass output to radare buffer Note: The double exclamation mark tells radare to skip the plugin list to find an IO plugin handling this command to launch it directly to the shell. A single one will walk through the io plugin list.` Radare commands: wx `!ragg2 -i exec`~ grep~! grep -v~[n] grep by columns afl~[0]~:n grep by rows afl~:0

  • .cmd Interprets command output
  • . repeats last commands (same as enter n)
  • ( Used to define and run macros
  • $ Used to define alias
  • $$: Resolves to current address
  • Offsets (@) are absolute, we can use $$ for relative ones @ $$+4
  • ? Evaluate expression
  • ?$? Help for variables used in expressions
  • $$: Here
  • $s: File size
  • $b: Block size
  • $l: Opcode length
  • $j: When $$ is at a jmp, $j is the address where we are going to jump to
  • $f: Same for jmp fail address
  • $m: Opcode memory reference (e.g. mov eax,[0x10] => 0x10)
  • ??? Help for ? command
  • ?i Takes input from stdin. Eg ?i username
  • ?? Result from previous operations
  • ?s from to [step]: Generates sequence from to every
  • ?p: Get physical address for given virtual address
  • ?P: Get virtual address for given physical one
  • ?v Show hex value of math expr
  • ?l str: Returns the length of string
  • @@: Used for iterations

Positioning

Block size

The block size is the default view size for radare. All commands will work with this constraint, but you can always temporally change the block size just giving a numeric argument to the print commands for example (px 20)

JSON Output

Most of commands such as (i)nfo and (p)rint commands accept a j to print their output in json

Analyze

Function analysis (normal mode)

Function analysis (visual mode)

Opcode analysis:

Information

Mitigations:

Get function address in GOT table:pd 1 @ sym.imp<funct>Returns a jmp [addr] where addr is the address of function in the GOT. Similar to objdump -R | grep <func>

Write

Flags

Flags are labels for offsets. They can be grouped in namespaces as sym for symbols ..

yank & paste

Visual Mode:

V enters visual mode

ROP

Search depth can be configure with following properties:

Searching

Example: Searching function preludes:

Its possible to run a command for each hit. Use the cmd.hit property:

Magic files

Search for magic numbers

Search can be controlled with following properties:

Yara

Yara can also be used for detecting file signatures to determine compiler types, shellcodes, protections and more.

Zignatures

Zignatures are useful when dealing with stripped binaries. We can take a non-stripped binary, run zignatures on it and apply it to a different binary that was compiled statically with the same libraries.

Zignatures are applied as comments:

Assembly Commands Cheat Sheet Pdf

Compare files

Graphs

Assembly Commands Cheat Sheet

Basic block graphs

Call graphs

Convert .dot in .png

Generate graph for file:

Debugger

Assembly Commands Cheat Sheet Download

Start r2 in debugger mode. r2 will fork and attach

5 ecommerce website design tips to attract more customers. To pass arguments:

Option 2 june 1st payment. To pass stdin:

Commands

To follow child processes in forks (set-follow-fork-mode in gdb)

PEDA like details: drr;pd 10@-10;pxr 40@esp

Debug in visual mode

Assembly Commands Cheat Sheet For Beginners

WebGUI (Enyo)

All suite commands include a -r flag to generate instructions for r2

rax2 - Base conversion

rahash2 - Entropy, hashes and checksums

radiff2 - File diffing

Examples:

rasm2 - Assembly/Disassembly

rafind2 - Search

ragg2 - Shellcode generator, C/opcode compiler

Example:

rabin2 - Executable analysis: symbols, imports, strings ..

Assembly Commands Cheat Sheet 2020

rarun2 - Launcher to run programs with different environments, args, stdin, permissions, fds

Assembly Commands Cheat Sheet Free

Examples: