Radare2 supports various types of graph available trough commands starting with
[0x00005000]> ag? |Usage: ag<graphtype><format> [addr] | Graph commands: | agc[format] [fcn addr] Function callgraph | agf[format] [fcn addr] Basic blocks function graph | agx[format] [addr] Cross references graph | agr[format] [fcn addr] References graph | aga[format] [fcn addr] Data references graph | agd[format] [fcn addr] Diff graph | agi[format] Imports graph | agC[format] Global callgraph | agR[format] Global references graph | agA[format] Global data references graph | agg[format] Custom graph | ag- Clear the custom graph | agn[?] title body Add a node to the custom graph | age[?] title1 title2 Add an edge to the custom graph | | Output formats: | <blank> Ascii art | v Interactive ascii art | t Tiny ascii art | d Graphviz dot | j json ('J' for formatted disassembly) | g Graph Modelling Language (gml) | k SDB key-value | * r2 commands | w Web/image (see graph.extension and graph.web)
The structure of the commands is as follows:
ag <graph type> <output format>.
agid displays the imports graph in dot format, while
outputs the custom graph in json format.
Here's a short description for every output format avaliable:
Ascii Art (e.g.
Displays the graph directly to stdout using ascii art to represent blocks and edges.
Warning: displaying large graphs directly to stdout might prove to be computationally expensive and will make r2 not responsive for some time. In case of doubt prefer using the interactive view (explained below).
Interactive Ascii Art (e.g.
Displays the ascii graph in an interactive view similar to
VVwhich allows to move the screen, zoom in / zoom out, ...
Tiny Ascii Art (e.g.
Displays the ascii graph directly to stdout in tiny mode (which is the same as reaching the maximum zoom out level in the interactive view).
Graphviz dot (e.g.
Prints a json string representing the graph.
- In case of the
fformat (basic blocks of function), it will have detailed information about the function and will also contain the disassembly of the function (use
Jformat for the formatted disassembly.
- In all other cases it will only have basic information about the nodes of the graph (id, title, body, and edges).
- In case of the
Graph Modelling Language (e.g.
Prints the gml source code representing the graph, which can be interpreted by programs such as yEd
SDB key-value (e.g.
Prints key-value strings representing the graph that were stored by sdb (radare2's string database).
R2 custom graph commands (e.g.
Prints r2 commands that would recreate the desired graph. The commands to construct the graph are
agn [title] [body]to add a node and
age [title1] [title2]to add an edge. The
[body]field can be expressed in base64 to include special formatting (such as newlines).
To easily execute the printed commands, it is possible to prepend a dot to the command (
Web / image (e.g.
Radare2 will convert the graph to dot format, use the
dotprogram to convert it to a
.gifimage and then try to find an already installed viewer on your system (
open, ...) and display the graph there. The extension of the output image can be set with the
graph.extensionconfig variable. Available extensions are
png, jpg, gif, pdf, ps.
Note: for particularly large graphs, the most recommended extension is
svgas it will produce images of much smaller size
graph.webconfig variable is enabled, radare2 will try to display the graph using the browser (this feature is experimental and unifinished, and disabled by default)