info

Informative commands (:i)

[0x00000000]> :?~^i
i                          Show target information
ii[*]                      List imports
il                         List libraries
is[*] <lib>                List symbols of lib (local and global ones)
iE[*] <lib>                Same as is, but only for the export global ones
iEa[*] (<lib>) <sym>       Show address of export symbol
isa[*] (<lib>) <sym>       Show address of symbol
ic <class>                 List Objective-C classes or methods of <class>
ip <protocol>              List Objective-C protocols or methods of <protocol>

• \i: Shows target information

[0x00000000]> \i
arch  arm
bits  64
os  linux
pid  14473
uid  10127
objc  false
java  true
cylang  false

• \i*: Shows target information in r2 form

[0x00000000]> \i*
e asm.arch=arm
e asm.bits=64
e asm.os=linux

• .\i*: Radare2 imports all the dynamic binary data from Frida. E.g: which architecture, endianness, pointer size, etc...

• .\iE*: Radare2 imports all the dynamic export data from Frida for all the dynamic libraries.

• .\iE* <lib>: Radare2 imports all the dynamic export data from Frida for only one specific library.

• .\ii*: Radare2 imports all the dynamic import data from Frida.

• \ii <lib>: List imports. Commonly used with the symbol ~, which is the internal grep of r2.

[0x00000000]> \ii libssl.so~+aes
0x7f9419f510 f EVP_aes_128_cbc /system/lib64/libcrypto.so
0x7f941a2740 f EVP_aead_aes_128_cbc_sha1_ssl3 /system/lib64/libcrypto.so
0x7f941a3314 f EVP_aead_aes_128_cbc_sha1_tls /system/lib64/libcrypto.so
0x7f941a3320 f EVP_aead_aes_128_cbc_sha1_tls_implicit_iv /system/lib64/libcrypto.so
0x7f941a332c f EVP_aead_aes_128_cbc_sha256_tls /system/lib64/libcrypto.so
0x7f9419f5b8 f EVP_aead_aes_128_gcm /system/lib64/libcrypto.so
0x7f941a274c f EVP_aead_aes_256_cbc_sha1_ssl3 /system/lib64/libcrypto.so
0x7f941a3338 f EVP_aead_aes_256_cbc_sha1_tls /system/lib64/libcrypto.so
0x7f941a3344 f EVP_aead_aes_256_cbc_sha1_tls_implicit_iv /system/lib64/libcrypto.so
0x7f941a3350 f EVP_aead_aes_256_cbc_sha256_tls /system/lib64/libcrypto.so
0x7f941a335c f EVP_aead_aes_256_cbc_sha384_tls /system/lib64/libcrypto.so
0x7f9419f5c4 f EVP_aead_aes_256_gcm /system/lib64/libcrypto.so
0x7f9419f600 f EVP_has_aes_hardware /system/lib64/libcrypto.so

• \ii* <lib>: List imports in r2 form.

[0x00000000]> \ii* libssl.so~+aes
f sym.imp.EVP_aes_128_cbc = 0x7f9419f510
f sym.imp.EVP_aead_aes_128_cbc_sha1_ssl3 = 0x7f941a2740
f sym.imp.EVP_aead_aes_128_cbc_sha1_tls = 0x7f941a3314
f sym.imp.EVP_aead_aes_128_cbc_sha1_tls_implicit_iv = 0x7f941a3320
f sym.imp.EVP_aead_aes_128_cbc_sha256_tls = 0x7f941a332c
f sym.imp.EVP_aead_aes_128_gcm = 0x7f9419f5b8
f sym.imp.EVP_aead_aes_256_cbc_sha1_ssl3 = 0x7f941a274c
f sym.imp.EVP_aead_aes_256_cbc_sha1_tls = 0x7f941a3338
f sym.imp.EVP_aead_aes_256_cbc_sha1_tls_implicit_iv = 0x7f941a3344
f sym.imp.EVP_aead_aes_256_cbc_sha256_tls = 0x7f941a3350
f sym.imp.EVP_aead_aes_256_cbc_sha384_tls = 0x7f941a335c
f sym.imp.EVP_aead_aes_256_gcm = 0x7f9419f5c4
f sym.imp.EVP_has_aes_hardware = 0x7f9419f600

• \il: List libraries. Commonly used with the symbol ~, which is the internal grep of r2.

[0x00000000]> \il~+keystore,ssl,crypto
0x0000007f94133000 libcrypto.so
0x0000007f93059000 libssl.so
0x0000007f879d8000 libjavacrypto.so
0x0000007f879d3000 libkeystore-engine.so
0x0000007f87985000 libkeystore_binder.so
0x0000007f5c491000 libvisacrypto.so

• \iE <lib>: List exports of library(ies)

[0x00000000]> \iE
Do you want to print 111759 lines? (y/N) n

Filtering by library name:

[0x00000000]> \iE libssl.so~AES
0x7f9307afb4 f SSL_CIPHER_is_AES256CBC
0x7f9307af64 f SSL_CIPHER_is_AES
0x7f9307af8c f SSL_CIPHER_is_AESGCM
0x7f9307af9c f SSL_CIPHER_is_AES128GCM
0x7f9307afa8 f SSL_CIPHER_is_AES128CBC

Filtering by library name in r2 form: (notice the *)

[0x00000000]> \iE* libssl.so~AES
f sym.fun.SSL_CIPHER_is_AES256CBC = 0x7f9307afb4
f sym.fun.SSL_CIPHER_is_AES = 0x7f9307af64
f sym.fun.SSL_CIPHER_is_AESGCM = 0x7f9307af8c
f sym.fun.SSL_CIPHER_is_AES128GCM = 0x7f9307af9c
f sym.fun.SSL_CIPHER_is_AES128CBC = 0x7f9307afa8

• \iEa (<lib>) <sym>: Show address of export symbol

[0x00000000]> \iEa libDexHelper.so JNI_OnLoad
0xd1c2b859

• \iEa* (<lib>) <sym>: Show address of export symbol in r2 format

[0x00000000]> \iEa* libDexHelper.so JNI_OnLoad
f sym.JNI_OnLoad = 0xd1c2b859

• \isa[*] (<lib>) <sym>: Show address of symbol

[0xd5d26859]> \is libc.so~sprintf
0x0 f bionic/libc/upstream-openbsd/lib/libc/stdio/asprintf.c
0x0 f bionic/libc/upstream-openbsd/lib/libc/stdio/vasprintf.c
0x0 f bionic/libc/upstream-openbsd/lib/libc/stdio/vsprintf.c
0x0 f bionic/libc/bionic/__vsprintf_chk.cpp
0x0 f bionic/libc/stdio/sprintf.c
0xf5140be5 f asprintf
0xf5142dbd f vasprintf
0xf5148da9 f vsprintf
0xf5153c01 f __vsprintf_chk
0xf5153c29 f __sprintf_chk
0xf5155885 f sprintf

[0xd5d26859]> \isa sprintf
0xf5155885

• \ic: List classes

[0x00000000]> \ic
Do you want to print 5769 lines? (y/N) n

Filtering by keyword (e.g package name):

[0x00000000]> \ic~+security
android.security.net.config.TrustAnchor
android.security.net.config.UserCertificateSource
android.security.net.config.CertificatesEntryRef
android.security.net.config.DirectoryCertificateSource$CertSelector
android.security.net.config.RootTrustManager
android.security.net.config.PinSet
android.security.net.config.CertificateSource
android.security.keystore.AndroidKeyStoreProvider
android.security.net.config.NetworkSecurityConfig$Builder
android.security.net.config.ApplicationConfig
android.security.NetworkSecurityPolicy