9

This is the stack view that I'm getting in radare2 after entering the visual panel mode:

enter image description here

This is the view from immunity debugger:

enter image description here

How can I get a view similar to immunity debugger in radare2?

Kennet Celeste
  • 245
  • 1
  • 3
  • 8

1 Answers1

13

You have several ways to print the stack. The specific way that you're searching for is called Stack Telescoping and you can print it like this:

pxr @ esp

Use sp, esp, and rsp according to your system.

pxr stands for Print heXadecimal References, you can see its description by using px?: 

[0x7f8a672ee4]> px?
<...truncated...>
pxr[j]            show words with references to flags and code

Here are some other options to print the stack using radare2:

  • pxa @ rsp - to show annotated hexdump
  • pxw @ rsp - to show hexadecimal words dump (32bit)
  • pxq @ rsp - to show hexadecimal quad-words dump (64bit)
  • ad@r:SP - to analyze the stack data
Megabeets
  • 8,989
  • 2
  • 24
  • 48
  • Does it mean that I have to use a command after each step over to get an update on stack? – Kennet Celeste Nov 26 '17 at 15:45
  • 1
    No, you can use Visual Panel Mode (v!) -- check out my answer here. If you want a view similar to PEDA's you can use e dbg.slow = true and then use Vpp. That's way you'll see a Visual Mode as well as Stack Telescoping. – Megabeets Nov 26 '17 at 15:50
  • Thanks! though I still can't scroll through the stack. When I use the arrow keys, it scrolls the code at the bottom of the page and the stack doesn't scroll. Do you know how to scroll through stack? – Kennet Celeste Nov 26 '17 at 17:31
  • In visual panel mode you can use Tab to move between the panels and h, J, k, and l to scroll inside the panel. – Megabeets Nov 26 '17 at 21:23
  • No I mean how to scroll in Vpp. in visual panel mode the stack is like the figure I posted. So scrolling isn't useful – Kennet Celeste Nov 26 '17 at 21:49
  • You can split the Visual screen, check out my answer here. – Megabeets Nov 26 '17 at 22:43
  • Thanks and sorry for multiple question. But still it doesn't work properly for me: the horizontal splitting does not show both right and left sides at the same time. It just shows the code and then when I press a button, it shows the stack (for which I used one of your commands above) just for a second and again it disappears. Have you had this issue? Have you actually tested the splitting with for instance ad@r:SP ? – Kennet Celeste Nov 26 '17 at 22:54
  • The way to do it was actually to enter the cursor mode with c and then tab to select stack, regs or disasm – Kennet Celeste Nov 27 '17 at 03:24
  • For a shorter version of the very long output, just mention write pxr 20r:SP – Solidak Aug 13 '18 at 07:20