Registers

The registers are part of a user area stored in the context structure used by the scheduler. This structure can be manipulated to get and set the values of those registers, and, for example, on Intel hosts, it is possible to directly manipulate DR0-DR7 hardware registers to set hardware breakpoints.

There are different commands to get values of registers. For the General Purpose ones use:

  1. [0x4A13B8C0]> dr
  2. r15 = 0x00000000
  3. r14 = 0x00000000
  4. r13 = 0x00000000
  5. r12 = 0x00000000
  6. rbp = 0x00000000
  7. rbx = 0x00000000
  8. r11 = 0x00000000
  9. r10 = 0x00000000
  10. r9 = 0x00000000
  11. r8 = 0x00000000
  12. rax = 0x00000000
  13. rcx = 0x00000000
  14. rdx = 0x00000000
  15. rsi = 0x00000000
  16. rdi = 0x00000000
  17. oeax = 0x0000003b
  18. rip = 0x7f20bf5df630
  19. rsp = 0x7fff515923c0
  21. [0x7f0f2dbae630]> dr rip ; get value of 'rip'
  22. 0x7f0f2dbae630
  24. [0x4A13B8C0]> dr rip = esp   ; set 'rip' as esp

Interaction between a plugin and the core is done by commands returning radare instructions. This is used, for example, to set flags in the core to set values of registers.

  1. [0x7f0f2dbae630]> dr*      ; Appending '*' will show radare commands
  2. f r15 1 0x0
  3. f r14 1 0x0
  4. f r13 1 0x0
  5. f r12 1 0x0
  6. f rbp 1 0x0
  7. f rbx 1 0x0
  8. f r11 1 0x0
  9. f r10 1 0x0
  10. f r9 1 0x0
  11. f r8 1 0x0
  12. f rax 1 0x0
  13. f rcx 1 0x0
  14. f rdx 1 0x0
  15. f rsi 1 0x0
  16. f rdi 1 0x0
  17. f oeax 1 0x3b
  18. f rip 1 0x7fff73557940
  19. f rflags 1 0x200
  20. f rsp 1 0x7fff73557940
  22. [0x4A13B8C0]> .dr*  ; include common register values in flags

An old copy of registers is stored all the time to keep track of the changes done during execution of a program being analyzed. This old copy can be accessed with oregs.

  1. [0x7f1fab84c630]> dro
  2. r15 = 0x00000000
  3. r14 = 0x00000000
  4. r13 = 0x00000000
  5. r12 = 0x00000000
  6. rbp = 0x00000000
  7. rbx = 0x00000000
  8. r11 = 0x00000000
  9. r10 = 0x00000000
  10. r9 = 0x00000000
  11. r8 = 0x00000000
  12. rax = 0x00000000
  13. rcx = 0x00000000
  14. rdx = 0x00000000
  15. rsi = 0x00000000
  16. rdi = 0x00000000
  17. oeax = 0x0000003b
  18. rip = 0x7f1fab84c630
  19. rflags = 0x00000200
  20. rsp = 0x7fff386b5080

Current state of registers

  1. [0x7f1fab84c630]> dr
  2. r15 = 0x00000000
  3. r14 = 0x00000000
  4. r13 = 0x00000000
  5. r12 = 0x00000000
  6. rbp = 0x00000000
  7. rbx = 0x00000000
  8. r11 = 0x00000000
  9. r10 = 0x00000000
  10. r9 = 0x00000000
  11. r8 = 0x00000000
  12. rax = 0x00000000
  13. rcx = 0x00000000
  14. rdx = 0x00000000
  15. rsi = 0x00000000
  16. rdi = 0x7fff386b5080
  17. oeax = 0xffffffffffffffff
  18. rip = 0x7f1fab84c633
  19. rflags = 0x00000202
  20. rsp = 0x7fff386b5080

Values stored in eax, oeax and eip have changed.

To store and restore register values you can just dump the output of ‘dr*‘ command to disk and then re-interpret it again:

  1. [0x4A13B8C0]> dr* > regs.saved ; save registers
  2. [0x4A13B8C0]> drp regs.saved ; restore

EFLAGS can be similarly altered. E.g., setting selected flags:

  1. [0x4A13B8C0]> dr eflags = pst
  2. [0x4A13B8C0]> dr eflags = azsti

You can get a string which represents latest changes of registers using drd command (diff registers):

  1. [0x4A13B8C0]> drd
  2. oeax = 0x0000003b was 0x00000000 delta 59
  3. rip = 0x7f00e71282d0 was 0x00000000 delta -418217264
  4. rflags = 0x00000200 was 0x00000000 delta 512
  5. rsp = 0x7fffe85a09c0 was 0x00000000 delta -396752448