Types

Most of the related commands are located in t namespace:

Note that the basic (atomic) types are not those from C standard - not char, _Bool, or short. Because those types can be different from one platform to another, radare2 uses definite types like as int8_t or uint64_t and will convert int to int32_t or int64_t depending on the binary or debuggee platform/compiler.

Basic types can be listed using t command. For the structured types you need to use ts, for unions use tu and for enums — te.

  1. [0x00000000]> t
  2. char
  3. char *
  4. double
  5. float
  6. gid_t
  7. int
  8. int16_t
  9. int32_t
  10. int64_t
  11. int8_t
  12. long
  13. long long
  14. pid_t
  15. short
  16. size_t
  17. uid_t
  18. uint16_t
  19. uint32_t
  20. uint64_t
  21. uint8_t
  22. unsigned char
  23. unsigned int
  24. unsigned short
  25. void *

There are three easy ways to define a new type:

  • Directly from the string using td command
  • From the file using to <filename> command
  • Open an $EDITOR to type the definitions in place using to -
  1. [0x00000000]> "td struct foo {char* a; int b;}"
  2. [0x00000000]> cat ~/radare2-regressions/bins/headers/s3.h
  3. struct S1 {
  4.     int x[3];
  5.     int y[4];
  6.     int z;
  7. };
  8. [0x00000000]> to ~/radare2-regressions/bins/headers/s3.h
  9. [0x00000000]> ts
  10. foo
  11. S1

Also note there is a config option to specify include directories for types parsing

  1. [0x00000000]> e? dir.types
  2. dir.types: Default path to look for cparse type files
  3. [0x00000000]> e dir.types

Printing types

Notice below we have used ts command, which basically converts the C type description (or to be precise it’s SDB representation) into the sequence of pf commands. See more about .

The tp command uses the pf string to print all the members of type at the current offset/given address:

  1. [0x00000000]> "td struct foo {char* a; int b;}"
  2. [0x00000000]> wx 68656c6c6f000c000000
  3. [0x00000000]> wz world @ 0x00000010 ; wx 17 @ 0x00000016
  4. [0x00000000]> px
  6. pf zd a b
  7. [0x00000000]> tp foo
  8.  a : 0x00000000 = "hello"
  9.  b : 0x00000006 = 12
  10. [0x00000000]> tp foo @ 0x00000010
  11.  a : 0x00000010 = "world"
  12.  b : 0x00000016 = 23

Also, you could fill your own data into the struct and print it using tpx command

  1. [0x00000000]> tpx foo 414243440010000000
  2.  a : 0x00000000 = "ABCD"
  3.  b : 0x00000005 = 16

The tp command just performs a temporary cast. But if we want to link some address or variable with the chosen type, we can use tl command to store the relationship in SDB.

  1. [0x000051c0]> tl S1 = 0x51cf
  2. [0x000051c0]> tll
  3. (S1)
  4.  x : 0x000051cf = [ 2315619660, 1207959810, 34803085 ]
  5.  y : 0x000051db = [ 2370306049, 4293315645, 3860201471, 4093649307 ]
  6.  z : 0x000051eb = 4464399

Moreover, the link will be shown in the disassembly output or visual mode:

  1. [0x000051c0 15% 300 /bin/ls]> pd $r @ entry0
  2.  ;-- entry0:
  3.  0x000051c0      xor ebp, ebp
  4.  0x000051c2      mov r9, rdx
  5.  0x000051c5      pop rsi
  6.  0x000051c6      mov rdx, rsp
  7.  0x000051c9      and rsp, 0xfffffffffffffff0
  8.  0x000051cd      push rax
  9.  0x000051ce      push rsp
  10. (S1)
  11.  x : 0x000051cf = [ 2315619660, 1207959810, 34803085 ]
  12.  y : 0x000051db = [ 2370306049, 4293315645, 3860201471, 4093649307 ]
  13.  z : 0x000051eb = 4464399
  14.  0x000051f0      lea rdi, loc._edata         ; 0x21f248
  15.  0x000051f7      push rbp
  16.  0x000051f8      lea rax, loc._edata         ; 0x21f248
  17.  0x000051ff      cmp rax, rdi
  18.  0x00005202      mov rbp, rsp

Once the struct is linked, radare2 tries to propagate structure offset in the function at current offset, to run this analysis on whole program or at any targeted functions after all structs are linked you have aat command:

  1. [0x00000000]> aa?
  2. | aat [fcn]           Analyze all/given function to convert immediate to linked structure offsets (see tl?)

The return value of malloc may differ between two emulations, so you have to set the hint for return value manually using ahr command, so run tl or aat command after setting up the return value hint.

  1. [0x000006da]> ah?
  2. | ahr val            set hint for return value of a function

There is one more important aspect of using types in radare2 - using aht you can change the immediate in the opcode to the structure offset. Lets see a simple example of [R]SI-relative addressing

  1. [0x000052f0]> pd 1
  2. 0x000052f0      mov rax, qword [rsi + 8]    ; [0x8:8]=0

Here 8 - is some offset in the memory, where rsi probably holds some structure pointer. Imagine that we have the following structures

  2. [0x000052f0]> "td struct ms { char b[8]; int member1; int member2; };"
  3. [0x000052f0]> "td struct ms1 { uint64_t a; int member1; };"
  4. [0x000052f0]> "td struct ms2 { uint16_t a; int64_t b; int member1; };"

Now we need to set the proper structure member offset instead of 8 in this instruction. At first, we need to list available types matching this offset:

  1. [0x000052f0]> ahts 8
  2. ms.member1

Note, that ms2 is not listed, because it has no members with offset 8. After listing available options we can link it to the chosen offset at the current address:

  1. [0x000052f0]> aht ms1.member1
  2. [0x000052f0]> pd 1
  3. 0x000052f0      488b4608       mov rax, qword [rsi + ms1.member1]    ; [0x8:8]=0
  • Printing all fields in enum using te command
  1. [0x00000000]> "td enum Foo {COW=1,BAR=2};"
  3. COW = 0x1
  4. BAR = 0x2
  • Finding matching enum member for given bitfield and vice-versa
  1. [0x00000000]> te Foo 0x1
  2. COW
  3. [0x00000000]> teb Foo COW
  4. 0x1

To see the internal representation of the types you can use tk command:

  1. [0x000051c0]> tk~S1
  2. S1=struct
  3. struct.S1=x,y,z
  4. struct.S1.x=int32_t,0,3
  5. struct.S1.x.meta=4
  6. struct.S1.y=int32_t,12,4
  7. struct.S1.y.meta=4
  8. struct.S1.z=int32_t,28,0
  9. struct.S1.z.meta=0
  10. [0x000051c0]>

Defining primitive types requires an understanding of basic pf formats, you can find the whole list of format specifier in pf??:

there are basically 3 mandatory keys for defining basic data types: X=type type.X=format_specifier type.X.size=size_in_bits For example, let’s define UNIT, according to Microsoft documentation UINT is just equivalent of standard C unsigned int (or uint32_t in terms of TCC engine). It will be defined as:

  1. UINT=type
  2. type.UINT=d
  3. type.UINT.size=32

Now there is an optional entry:

X.type.pointto=Y

This one may only be used in case of pointer type.X=p, one good example is LPFILETIME definition, it is a pointer to _FILETIME which happens to be a structure. Assuming that we are targeting only 32-bit windows machine, it will be defined as the following:

  1. LPFILETIME=type
  2. type.LPFILETIME=p
  3. type.LPFILETIME.size=32
  4. type.LPFILETIME.pointto=_FILETIME

There is also one more optional entry:

  1. type.UINT.meta=4

This entry is for integration with C parser and carries the type class information: integer size, signed/unsigned, etc.

Structures

Those are the basic keys for structs (with just two elements):

  1. X=struct
  2. struct.X=a,b
  3. struct.X.a=a_type,a_offset,a_number_of_elements
  4. struct.X.b=b_type,b_offset,b_number_of_elements

The first line is used to define a structure called X, the second line defines the elements of X as comma separated values. After that, we just define each element info.

For example. we can have a struct like this one:

  1. struct _FILETIME {
  2.     DWORD dwLowDateTime;
  3.     DWORD dwHighDateTime;
  4. }

assuming we have DWORD defined, the struct will look like this

  1.  _FILETIME=struct
  2. struct._FILETIME=dwLowDateTime,dwHighDateTime
  3. struct._FILETIME.dwLowDateTime=DWORD,0,0
  4. struct._FILETIME.dwHighDateTime=DWORD,4,0

Note that the number of elements field is used in case of arrays only to identify how many elements are in arrays, other than that it is zero by default.

Unions are defined exactly like structs the only difference is that you will replace the word struct with the word union.

Function prototypes

Function prototypes representation is the most detail oriented and the most important one of them all. Actually, this is the one used directly for type matching

  1. X=func
  2. func.X.args=NumberOfArgs
  3. func.x.arg0=Arg_type,arg_name
  4. .
  5. .
  6. .
  7. func.X.ret=Return_type
  8. func.X.cc=calling_convention

It should be self-explanatory. Let’s do strncasecmp as an example for x86 arch for Linux machines. According to man pages, strncasecmp is defined as the following:

    When converting it into its sdb representation it will look like the following:

    1. func.x.noreturn=true/false

    This key is used to mark functions that will not return once called, such as exit and .