3

If I'm using radare2, and I run, lets say dr while debugging, it'll print pointers for some of the registers. Lets pretend like esp is resolving to 0x04084308 or something similar. If I want to get the value that esp is pointing to, how could I do that?

Thanks in advance.

Sam Clarke
  • 120
  • 1
  • 11

2 Answers2

3

print rsp register value

[0x560207c7275a]> dr?rsp
0x7fffa5e429c8

print 4 bytes hex at 0x7fffa5e429c8

[0x560207c7275a]> px 4 @rsp
- offset -       0 1  2 3  4 5  6 7  8 9  A B  C D  E F  0123456789ABCDEF
0x7fffa5e429c8  9b00 dae7                                ....

print 8 bytes hex at 0x7fffa5e429c8 ( command px == x )

[0x560207c7275a]> x 8 @rsp
- offset -       0 1  2 3  4 5  6 7  8 9  A B  C D  E F  0123456789ABCDEF
0x7fffa5e429c8  9b00 dae7 347f 0000                      ....4...
[0x560207c7275a]>
mug896
  • 1,777
  • 1
  • 19
  • 17
0

This can be solved with drr, which will show more information about the registers, such as where they point :).

Otherwise, if you want to get a value in the programs memory, you can s 0xaddr and then V to show information near there.

Sam Clarke
  • 120
  • 1
  • 11