203 lines
4.4 KiB
Groff
203 lines
4.4 KiB
Groff
.Dd January 24, 2024
|
|
.Dt RZ_BIN 1
|
|
.Os
|
|
.Sh NAME
|
|
.Nm rz-bin
|
|
.Nd Binary program info extractor
|
|
.Sh SYNOPSIS
|
|
.Nm rz-bin
|
|
.Op Fl AcdeEghHiIjlLMqrRsSUvVxzZ
|
|
.Op Fl @ Ar at
|
|
.Op Fl a Ar arch
|
|
.Op Fl b Ar bits
|
|
.Op Fl B Ar addr
|
|
.Op Fl C Ar F:C:D
|
|
.Op Fl f Ar str
|
|
.Op Fl m Ar addr
|
|
.Op Fl n Ar str
|
|
.Op Fl N Ar m:M
|
|
.Op Fl P Ar pdb
|
|
.Op Fl o Ar str
|
|
.Op Fl O Ar str
|
|
.Op Fl k Ar query
|
|
.Op Fl D Ar lang symname
|
|
.Ar file
|
|
.Sh DESCRIPTION
|
|
This command is part of the Rizin project.
|
|
.Pp
|
|
rz-bin can analyze and extract useful information
|
|
from binary executable files like ELF, PE, Mach-O, etc.
|
|
It supports multiple architectures like x86, ARM, MIPS, PowerPC, etc.
|
|
.Sh OPTIONS
|
|
.Bl -tag -width Fl
|
|
.It Fl @ Ar addr
|
|
Show section, symbol, or import at the given address
|
|
.It Fl A
|
|
List sub-binaries and their arch-bits pairs
|
|
.It Fl a Ar arch
|
|
Set architecture (x86, arm, .. or <arch>_<bits>)
|
|
.It Fl b Ar bits
|
|
Set bits (32, 64 ...)
|
|
.It Fl B Ar addr
|
|
Override base address (PIE bins)
|
|
.It Fl c
|
|
List classes
|
|
.It Fl cc
|
|
List classes in header format
|
|
.It Fl C Ar fmt:C:D
|
|
Create [elf, mach0, pe] with Code and Data hexpairs (see -a)
|
|
.It Fl d
|
|
Show debug/dwarf information
|
|
.It Fl dd
|
|
Load debug/dwarf information from debuginfod server
|
|
.It Fl D Ar lang name
|
|
Demangle symbol name (-D all for bin.demangle=true)
|
|
.It Fl e
|
|
Entrypoint
|
|
.It Fl E
|
|
Globally exportable symbols
|
|
.It Fl f Ar str
|
|
Select sub-bin named str
|
|
.It Fl F Ar binfmt
|
|
Force to use that bin plugin (ignore header check)
|
|
.It Fl g
|
|
Same as -SMZIHVResizcld -SS -SSS -ee (show all information)
|
|
.It Fl G Ar addr
|
|
Load address . offset to header
|
|
.It Fl h
|
|
Show usage help message
|
|
.It Fl H
|
|
Header fields
|
|
.It Fl i
|
|
Import (symbols imported from libraries)
|
|
.It Fl I
|
|
Binary info
|
|
.It Fl j
|
|
Output in JSON
|
|
.It Fl k Ar sdb-query
|
|
Run sdb query. for example: '*'
|
|
.It Fl K Ar algo
|
|
Calculate checksums (md5, sha1, ..)
|
|
.It Fl l
|
|
Linked libraries
|
|
.It Fl L Ar plugin
|
|
List supported bin plugins or plugin details
|
|
.It Fl m Ar addr
|
|
Show source line at addr
|
|
.It Fl M
|
|
Main (show address of main symbol)
|
|
.It Fl n Ar str
|
|
Show section, symbol, or import named str
|
|
.It Fl N Ar min:max
|
|
Force min:max number of chars per string (see -z and -zz)
|
|
.It Fl o Ar str
|
|
Output file/folder for write operations (out by default)
|
|
.It Fl O Ar str
|
|
Write/extract operations (-O help)
|
|
.It Fl p
|
|
Show physical addresses
|
|
.It Fl P
|
|
Show debug/pdb information
|
|
.It Fl PP
|
|
Download pdb file for binary
|
|
.It Fl q
|
|
Be quiet, just show fewer data
|
|
.It Fl qq
|
|
Show less info (no offset/size for -z for ex.)
|
|
.It Fl Q
|
|
Show load address used by dlopen (non-aslr libs)
|
|
.It Fl r
|
|
Show output in rizin format
|
|
.It Fl R
|
|
Show relocations
|
|
.It Fl s
|
|
Symbols
|
|
.It Fl S
|
|
Sections
|
|
.It Fl SS
|
|
Segments
|
|
.It Fl SSS
|
|
Sections mapping to segments
|
|
.It Fl T
|
|
Display file signature
|
|
.It Fl u
|
|
Unfiltered (no rename duplicated symbols/sections)
|
|
.It Fl U
|
|
Resources
|
|
.It Fl v
|
|
Show version information
|
|
.It Fl V
|
|
Show binary version information
|
|
.It Fl w
|
|
Display try/catch blocks
|
|
.It Fl x
|
|
Extract bins contained in file
|
|
.It Fl Y
|
|
Calculate all the possibles base address candidates of a firmware bin
|
|
.It Fl z
|
|
Show strings (from data section)
|
|
.It Fl zz
|
|
Show strings (from raw strings from bin)
|
|
.It Fl zzz
|
|
Dump raw strings to stdout (for huge files)
|
|
.It Fl Z
|
|
Guess size of binary program
|
|
.El
|
|
.Sh ENVIRONMENT
|
|
.Bl -tag -width RZ_BIN_DEBUGINFOD_URLS
|
|
.It Ev RZ_BIN_CODESIGN_VERBOSE
|
|
make code signatures verbose
|
|
.It Ev RZ_BIN_DEBUGINFOD_URLS
|
|
bin.dbginfo.debuginfod_urls - use alternative debuginfod server
|
|
.It Ev RZ_BIN_DEMANGLE
|
|
bin.demangle - do not demangle symbols
|
|
.It Ev RZ_BIN_LANG
|
|
bin.lang - assume lang for demangling
|
|
.It Ev RZ_BIN_MAXSTRBUF
|
|
bin.maxstrbuf - specify maximum buffer size
|
|
.It Ev RZ_BIN_PDBSERVER
|
|
pdb.server - use alternative PDB server
|
|
.It Ev RZ_BIN_PREFIX
|
|
bin.prefix - prefix symbols/sections/relocs with a specific string
|
|
.It Ev RZ_BIN_STRFILTER
|
|
bin.str.filter - rizin -qc 'e bin.str.filter=?' -
|
|
.It Ev RZ_BIN_STRPURGE
|
|
bin.str.purge - try to purge false positives
|
|
.It Ev RZ_BIN_SYMSTORE
|
|
pdb.symstore - path to downstream symbol store
|
|
.It Ev RZ_CONFIG
|
|
sdb config file
|
|
.It Ev RZ_NOPLUGINS
|
|
do not load shared plugins (speedup loading)
|
|
.El
|
|
.Sh EXAMPLES
|
|
List symbols of a program:
|
|
.Pp
|
|
.Nm rz-bin Fl s Ar a.out
|
|
.Pp
|
|
Get offset of symbol:
|
|
.Pp
|
|
.Nm rz-bin Fl n Cm _main Ar a.out
|
|
.Pp
|
|
Get entrypoint:
|
|
.Pp
|
|
.Nm rz-bin Fl e Ar a.out
|
|
.Pp
|
|
Load symbols and imports from rizin:
|
|
.Pp
|
|
.Nm rizin Fl n Ar /bin/ls
|
|
.Pp
|
|
[0x00000000]> .!rz-bin -prsi $FILE
|
|
.Sh SEE ALSO
|
|
.Xr rizin 1 ,
|
|
.Xr rz-asm 1 ,
|
|
.Xr rz-ax 1 ,
|
|
.Xr rz-diff 1 ,
|
|
.Xr rz-find 1 ,
|
|
.Xr rz-gg 1 ,
|
|
.Xr rz-hash 1 ,
|
|
.Xr rz-run 1
|
|
.Sh AUTHORS
|
|
.An pancake <pancake@nopcode.org>
|
|
.Pp
|
|
byteninjaa0
|