Is there any way to indentify structs in radare2?
when i tried to look them, they look like normal variables, i seen people using td and tl command but I don't know how to use them. If you know please explain...
2
- 1it is possible that structure recovery might not be implemented yet. Did you check using debug info?R4444– R44442021-03-19 04:13:59 +00:00Commented Mar 19, 2021 at 4:13
- how to do that?Mr. rc– Mr. rc2021-03-21 08:10:31 +00:00Commented Mar 21, 2021 at 8:10
Add a comment |
1 Answer
According to the official radare2 book, you have to reverse the struct manually by understanding the features of the program. Then you can overwrite the variable by struct names such as for instance:
If you have this code:
mov rax, qword [rsi + 8] You can do:
"td struct ms1 { uint64_t a; int member1; };" aht ms1.member1 Then the code will be documented:
[0x000052f0]> pd 1 0x000052f0 488b4608 mov rax, qword [rsi + ms1.member1] There is nothing automatic in this process.
