2012-10-22 08:28:42 +08:00
.Dd Mar 11 , 2012
2010-03-13 01:46:11 +08:00
.Dt RABIN2 1
2009-04-15 19:09:36 +08:00
.Os
.Sh NAME
2010-03-13 01:46:11 +08:00
.Nm rabin2
2009-04-15 19:09:36 +08:00
.Nd Binary program info extractor
.Sh SYNOPSIS
2010-03-13 01:46:11 +08:00
.Nm rabin2
2012-10-24 00:44:32 +08:00
.Op Fl ACeisSMzIHlRrLxvVh
2011-12-02 10:43:08 +08:00
.Op Fl a Ar arch
.Op Fl b Ar bits
.Op Fl B Ar addr
2011-10-12 09:24:19 +08:00
.Op Fl c Ar fmt:C:[D]
.Op Fl f Ar subbin
2011-12-02 10:43:08 +08:00
.Op Fl O Ar str
.Op Fl o Ar str
.Op Fl m Ar addr
.Op Fl @ Ar addr
.Op Fl n Ar str
.Ar file
2009-04-15 19:09:36 +08:00
.Sh DESCRIPTION
This program allows you to get information about ELF/PE/MZ and CLASS files in a simple way.
.Bl -tag -width Fl
2011-12-02 10:43:08 +08:00
.It Fl A
List archs
.It Fl a Ar arch
Set arch (x86, arm, .. accepts underscore for bits x86_32)
.It Fl b Ar bits
Set bits (32, 64, ...)
.It Fl B Ar addr
Override baddr
.It Fl c Ar [fmt:C[:D]]
Create [elf,mach0,pe] for arm and x86-32/64 tiny binaries where 'C' is an hexpair list of the code bytes and ':D' is an optional concatenation to describe the bytes for the data section.
.It Fl C
List classes
2009-04-15 19:09:36 +08:00
.It Fl e
Show entrypoints for disk and on-memory
2011-12-02 10:43:08 +08:00
.It Fl f Ar subbin
Select sub-binary architecture. Useful for fat-mach0 binaries
2009-04-15 19:09:36 +08:00
.It Fl i
2011-12-02 10:43:08 +08:00
Show imports (symbols imported from libraries)
2009-04-15 19:09:36 +08:00
.It Fl s
Show exported symbols
.It Fl S
Show sections
2011-12-02 10:43:08 +08:00
.It Fl M
Show address of 'main' symbol
.It Fl z
Show strings inside .data section (like gnu strings does)
.It Fl I
Show binary info
2012-10-24 00:44:32 +08:00
.It Fl H
2011-12-02 10:43:08 +08:00
Show header fields
2009-04-15 19:09:36 +08:00
.It Fl l
List linked libraries to the binary
2012-10-24 00:44:32 +08:00
.It Fl R
2011-12-02 10:43:08 +08:00
Show realocations
.It Fl O Ar str
2011-12-05 09:42:06 +08:00
Write/extract operations (\- O help)
2011-12-02 10:43:08 +08:00
.It Fl o Ar str
Output file/folder for write operations (out by default)
2009-04-15 19:09:36 +08:00
.It Fl r
Show output in radare format
.It Fl v
2011-07-19 06:12:36 +08:00
Display virtual addressing offsets
2011-12-02 10:43:08 +08:00
.It Fl m Ar addr
Show source line reference from a given address
.It Fl L
List supported bin plugins
.It Fl @ Ar addr
Show information (symbol, section, import) of the given address
.It Fl n Ar str
Show information (symbol, section, import) at string offset
.It Fl x
Extract all sub binaries from a fat binary (f.ex: fatmach0)
.It Fl V
Show version information
2009-04-15 19:09:36 +08:00
.It Fl h
Show usage help message.
.El
2012-10-22 08:28:42 +08:00
.Sh EXAMPLES
.Pp
List symbols of a program
.Pp
$ rabin2 -s a.out
.Pp
Get offset of symbol
.Pp
$ rabin2 -n _main a.out
.Pp
Get entrypoint
.Pp
$ rabin2 -e a.out
.Pp
Load symbols and imports from radare
.Pp
2012-10-24 00:44:32 +08:00
.!rabin2 -vrsi a.out
2009-04-15 19:09:36 +08:00
.Sh SEE ALSO
.Pp
2010-03-13 01:46:11 +08:00
.Xr rahash2(1) ,
2011-07-19 16:45:47 +08:00
.Xr rafind2(1) ,
2010-03-13 01:46:11 +08:00
.Xr radare2(1) ,
.Xr radiff2(1) ,
.Xr rasm2(1) ,
.Xr rax2(1) ,
2011-07-19 16:45:47 +08:00
.Xr rsc2(1) ,
2011-10-12 09:24:19 +08:00
.Xr ragg2(1) ,
.Xr rarun2(1) ,
2009-04-15 19:09:36 +08:00
.Sh AUTHORS
.Pp
2010-10-29 19:58:19 +08:00
pancake <pancake@nopcode.org>,
nibble <nibble@develsec.org>