forked from radare/ired
-
Notifications
You must be signed in to change notification settings - Fork 0
/
r0.1
123 lines (121 loc) · 2.39 KB
/
r0.1
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
.Dd Mar 7, 2021
.Dt R0 1
.Os
.Th R0 1
.Sh NAME
r0 \- interactive raw editor
.Sh SYNOPSIS
.Nm r0
.Op Fl hnv
.Op Fl i Ar script
.Ar file ...
.Sh DESCRIPTION
Simple and minimal hexadecimal editor based on radare concepts
.Pp
The program arguments are:
.Pp
.Bl -tag -width Fl
.It Fl h
Show help message
.It Fl v
Show version information
.It Fl n
Do not be verbose
.It Fl i Ar script
Interpret a script file as r0 commands.
.Pp
Same as "r0 file < script"
.El
.PP
.Sh COMMANDS
.Pp
.Bl -tag -width Fl
.It s[+-addr]
seek to relative or absolute address
.Pp
> s 0x400 # seek to offset 0x400
.Pp
> s+20 # seek 20 bytes forward
.It b[+-size]
change block size
.Pp
> b 5 # set block size to 5 bytes
.Pp
> b +128 # increase block size in 128 bytes
.It w[hex|"str"]
write hexpair or string
.Pp
> w 001122 # write 0x00 0x11 0x22
.Pp
> w"Hello World" # write "Hello World" string without quotes
.It /[hex|"str"]
search hexpair or string
.Pp
> /894722 # search bytes 0x89 0x47 0x22
.Pp
> /"lib" # search string 'lib'
.It x[size]
hexdump
.Pp
> x 256 # dump 256 bytes in hexadecimal
.It X[size]
hexpair dump
.Pp
> X 0x100 # dump 256 bytes in hexpairs
.It p[fmt]
print formatted current block ('p' for help)
.Pp
ob/wW/dD/qQ byte (oct,hex), word, dword, qword (lil, big endian)
.Pp
i/I/f/F int32 (lil, big), float (lil, big)
.Pp
s/S short int16 (lil, big)
.Pp
z/Z zero-terminatted string (ascii, wide-ascii)
.Pp
./:/* skip 1 or 4 chars, repeat last format instead of cycle
.It r[-[num]]
truncate or -remove N bytes
.Pp
> r 1024 # resize file to 1024 bytes
.Pp
> r-10 # remove 10 bytes from current seek and shrink file
.It .[file]
interpret file
.Pp
> .script # run file 'script'
.It <[file]
load file in current seek
.Pp
> <curblock.bin # load blocksize bytes from file
.It >[file]
dump current block to file
.Pp
> >curblock.bin # dump current block to a file
.It !cmd
run shell command
.Pp
The following environment variables are defined when found in the command string:
.Pp
FILE is the filename of the current working file
.Pp
BLOCK points to the temporal filename with the current block dump
.Pp
OFFSET and XOFFSET are decimal and hexadecimal values of the current seek
.Pp
> !cp $BLOCK $FILE-$XOFFSET.curblock # save current block
.It ?expr
calculate numeric expression
.Pp
> ?1024
.Pp
0x400 1024 02000
.It q
quit
.El
.Sh SEE ALSO
.Pp
.Xr r0v(1)
.Sh AUTHORS
.PP
pancake <@nopcode.org>