Basic Debugger Session

In the second case, the debugger will fork and load the debugee ls program in memory.

It will pause its execution early in ld.so dynamic linker. As a result, you will not yet see the entrypoint or any shared libraries at this point.

You can override this behavior by setting another name for an entry breakpoint. To do this, add a radare command e dbg.bep=entry or e dbg.bep=main to your startup script, usually it is ~/.config/radare2/radare2rc.

Be warned that certain malware or other tricky programs can actually execute code before and thus you’ll be unable to control them. (Like the program constructor or the tls initializers)

Below is a list of most common commands used with debugger:

There is another option for debugging in radare, which may be easier: using visual mode.

To enter visual debugger mode use Vpp:

The initial view after entering visual mode is a hexdump view of the current target program counter (e.g., EIP for x86). Pressing p will allow you to cycle through the rest of visual mode views. You can press p and P to rotate through the most commonly used print modes. Use F7 or s to step into and F8 or S to step over current instruction. With the key you can toggle the cursor mode to mark a byte range selection (for example, to later overwrite them with nop). You can set breakpoints with F2 key.

In visual mode you can enter regular radare commands by prepending them with :. For example, to dump a one block of memory contents at ESI:

A frequently used command is dr, which is used to read or write values of the target’s general purpose registers. For a more compact register value representation you might use dr= command. You can also manipulate the hardware and the extended/floating point registers.