Radare IO system allows you to map contents of files into the same IO space used to contain loaded binary. New contents can be placed at random offsets. This lets you create a static environment which emulate the view you would have when using a debugger, where the program and all its libraries are loaded in memory and can be accessed.
S (sections) command you can define base address for each library to be loaded.
Mapping files is done using the
o (open) command. Let's read the help:
[0x00000000]> o? |Usage: o [com- ] [file] ([offset]) | o list opened files | o= list opened files (ascii-art bars) | o* list opened files in r2 commands | oa[?] [addr] Open bin info from the given address | ob[?] [lbdos] [...] list open binary files backed by fd | oc [file] open core file, like relaunching r2 | oi[-|idx] alias for o, but using index instead of fd | oj[?] list opened files in JSON format | oL list all IO plugins registered | om[?] create, list, remove IO maps | on [file] 0x4000 map raw file at 0x4000 (no r_bin involved) | oo[?] reopen current file (kill+fork in debugger) | oo+ reopen current file in read-write | ood [args] reopen in debugger mode (with args) | oo[bnm] [...] see oo? for help | op [so] open r2 native plugin (asm, bin, core, ..) | o 4 Switch to open file on fd 4 | o-1 close file descriptor 1 | o-* close all opened files | o-- close all files, analysis, binfiles, flags, same as !r2 -- | o [file] open [file] file in read-only | o+ [file] open file in read-write mode | o [file] 0x4000 map file at 0x4000
Prepare a simple layout:
$ rabin2 -l /bin/ls [Linked libraries] libselinux.so.1 librt.so.1 libacl.so.1 libc.so.6 4 libraries
Map a file:
[0x00001190]> o /bin/zsh 0x499999
List mapped files:
[0x00000000]> o - 6 /bin/ls @ 0x0 ; r - 10 /lib/ld-linux.so.2 @ 0x100000000 ; r - 14 /bin/zsh @ 0x499999 ; r
Print hexadecimal values from /bin/zsh:
[0x00000000]> px @ 0x499999
Unmap files using the
o- command. Pass required file descriptor to it as an argument: