Mapping Files

Radare IO system allows you to map contents of files into the same IO space used to contain loaded binary. New contents can be placed at random offsets. This lets you create a static environment which emulate the view you would have when using a debugger, where the program and all its libraries are loaded in memory and can be accessed.

Using the S (sections) command you can define base address for each library to be loaded.

Mapping files is done using the o (open) command. Let's read the help:

[0x00000000]> o?
Usage: o[com- ] [file] ([offset])
o                  list opened files
oc [file]          open core file, like relaunching r2
oo                 reopen current file (kill+fork in debugger)
oo+                reopen current file in read-write
o 4                prioritize io on fd 4 (bring to front)
o-1                close file index 1
o /bin/ls          open /bin/ls file in read-only
o+/bin/ls          open /bin/ls file in read-write mode
o /bin/ls 0x4000   map file at 0x4000
on /bin/ls 0x4000  map raw file at 0x4000 (no r_bin involved)
om[?]              create, list, remove IO maps

Prepare a simple layout:

$ rabin2 -l /bin/ls
    [Linked libraries]
    libselinux.so.1
    librt.so.1
    libacl.so.1
    libc.so.6

    4 libraries

Map a file:

[0x00001190]> o /bin/zsh 0x499999

List mapped files:

[0x00000000]> o
- 6 /bin/ls @ 0x0 ; r
- 10 /lib/ld-linux.so.2 @ 0x100000000 ; r
- 14 /bin/zsh @ 0x499999 ; r

Print hexadecimal values from /bin/zsh:

[0x00000000]> px @ 0x499999

Unmap files using the o- command. Pass required file descriptor to it as an argument:

[0x00000000]> o-14

results matching ""

    No results matching ""