Debugger

Debuggers are implemented as IO plugins. Therefore, radare can handle different URI types for spawning, attaching and controlling processes. The complete list of IO plugins can be viewed with r2 -L. Those that have “d” in the first column (“rwd”) support debugging. For example:

  1. r_d  debug       Debug a program or pid. dbg:///bin/ls, dbg://1388 (LGPL3)
  2. rwd  gdb         Attach to gdbserver, 'qemu -s', gdb://localhost:1234 (LGPL3)

There are different backends for many target architectures and operating systems, e.g., GNU/Linux, Windows, MacOS X, (Net,Free,Open)BSD and Solaris.

Process memory is treated as a plain file. All mapped memory pages of a debugged program and its libraries can be read and interpreted as code or data structures.

Communication between radare and the debugger IO layer is wrapped into system() calls, which accept a string as an argument, and executes it as a command. An answer is then buffered in the output console, its contents can be additionally processed by a script. Access to the IO system is achieved with =!. Most IO plugins provide help with =!? or =!help. For example:

  1. $ r2 -d /bin/ls
  2. ...
  3. [0x7fc15afa3cc0]> =!help
  4. Usage: =!cmd args
  5.  =!ptrace   - use ptrace io
  6.  =!mem      - use /proc/pid/mem io if possible
  7.  =!pid      - show targeted pid
  8.  =!pid <#>  - select new pid

In general, debugger commands are portable between architectures and operating systems. Still, as radare tries to support the same functionality for all target architectures and operating systems, certain things have to be handled separately. They include injecting shellcodes and handling exceptions. For example, in MIPS targets there is no hardware-supported single-stepping feature. In this case, radare2 provides its own implementation for single-step by using a mix of code analysis and software breakpoints.

To get basic help for the debugger, type ‘d?’:

  1. Usage: d   # Debug commands
  2. | db[?]                    Breakpoints commands
  3. | dbt[?]                   Display backtrace based on dbg.btdepth and dbg.btalgo
  4. | dc[?]                    Continue execution
  5. | dd[?]                    File descriptors (!fd in r1)
  6. | de[-sc] [perm] [rm] [e]  Debug with ESIL (see de?)
  7. | dg <file>                Generate a core-file (WIP)
  8. | dH [handler]             Transplant process to a new handler
  9. | di[?]                    Show debugger backend information (See dh)
  10. | dk[?]                    List, send, get, set, signal handlers of child
  11. | dL[?]                    List or set debugger handler
  12. | dm[?]                    Show memory maps
  13. | do[?]                    Open process (reload, alias for 'oo')
  14. | doo[args]                Reopen in debug mode with args (alias for 'ood')
  15. | doof[file]               Reopen in debug mode from file (alias for 'oodf')
  16. | doc                      Close debug session
  17. | dp[?]                    List, attach to process or thread id
  18. | dr[?]                    Cpu registers
  19. | ds[?]                    Step, over, source line
  20. | dt[?]                    Display instruction traces
  21. | dw <pid>                 Block prompt until pid dies
  22. | dx[?]                    Inject and run code on target process (See gs)

To restart your debugging session, you can type oo or oo+, depending on desired behavior.

  1. oo                 reopen current file (kill+fork in debugger)
  2. oo+                reopen current file in read-write