The current seek position is changed with
s command. It accepts a math expression as argument. The expression can be composed of shift operations, basic math operations, or memory access operations.
[0x00000000]> s? Usage: s[+-] [addr] s print current address s 0x320 seek to this address s- undo seek s+ redo seek s* list undo seek history s++ seek blocksize bytes forward s-- seek blocksize bytes backward s+ 512 seek 512 bytes forward s- 512 seek 512 bytes backward sg/sG seek begin (sg) or end (sG) of section or file s.hexoff Seek honoring a base from core->offset sa [[+-]a] [asz] seek asz (or bsize) aligned to addr sn/sp seek next/prev scr.nkey s/ DATA search for next occurrence of 'DATA' s/x 9091 search for next occurrence of \x90\x91 sb seek aligned to bb start so [num] seek to N next opcode(s) sf seek to next function (f->addr+f->size) sC str seek to comment matching given string sr pc seek to register > 3s++ ; 3 times block-seeking > s 10+0x80 ; seek at 0x80+10
If you want to inspect the result of a math expression, you can evaluate it using the
? command. Simply pass the expression as an argument. The result can be displayed in hexadecimal, decimal, octal or binary formats.
> ? 0x100+200 0x1C8 ; 456d ; 710o ; 1100 1000
In the visual mode you can press
u (undo) or
U (redo) inside the seek history to return back to previous or forward to the next location.
As test file let's use a simple hello_world.c compiled in Linux ELF format. After we compile it let's open it with radare2:
Now we have the command prompt:
Now we are ready to go deeper.
Seeking at any position
All seeking commands that have address in command parameters can use any base such as hex/octal/binary or decimal.
Seek to address 0x0, alternative command is just
[0x00400410]> s 0x0 [0x00000000]>
Print current address
[0x00000000]> s 0x0 [0x00000000]>
there is an alternate way to print current position:
Seek N positions forward, space is optional
[0x00000000]> s+ 128 [0x00000080]>
Undo last two seeks to return to the initial address
[0x00000080]> s- [0x00000000]> s- [0x00400410]>
we are back at 0x00400410.
There's also a command for showing the seek history:
[0x00400410]> s* f undo_3 @ 0x400410 f undo_2 @ 0x40041a f undo_1 @ 0x400410 f undo_0 @ 0x400411 # Current undo/redo position. f redo_0 @ 0x4005b4