11.4 Symbols (exports)

In rabin, symbols list works in a very similar way as exports do. With the flag -i it will list all the symbols present in the file in a format that can be parsed easily.

$ rabin -s /bin/ls
address=0x0805e3c0 offset=0x000163c0 size=00000004 bind=GLOBAL type=OBJECT name=stdout
address=0x08059b04 offset=0x00011b04 size=00000004 bind=GLOBAL type=OBJECT name=_IO_stdin_used
address=0x0805e3a4 offset=0x000163a4 size=00000004 bind=GLOBAL type=OBJECT name=stderr
address=0x0805e3a0 offset=0x000163a0 size=00000004 bind=GLOBAL type=OBJECT name=optind
address=0x0805e3c4 offset=0x000163c4 size=00000004 bind=GLOBAL type=OBJECT name=optarg

With -v, rabin will print a simpler output.

$ rabin -sv /bin/ls
Memory address  File offset     Name
0x0805e3c0      0x000163c0      stdout
0x08059b04      0x00011b04      _IO_stdin_used
0x0805e3a4      0x000163a4      stderr
0x0805e3a0      0x000163a0      optind
0x0805e3c4      0x000163c4      optarg

5 symbols

Using -vv, we will get their size, bind and type too.

$ rabin -svv /bin/ls
Memory address  File offset     Size            Bind    Type    Name
0x0805e3c0      0x000163c0      00000004        GLOBAL  OBJECT  stdout
0x08059b04      0x00011b04      00000004        GLOBAL  OBJECT  _IO_stdin_used
0x0805e3a4      0x000163a4      00000004        GLOBAL  OBJECT  stderr
0x0805e3a0      0x000163a0      00000004        GLOBAL  OBJECT  optind
0x0805e3c4      0x000163c4      00000004        GLOBAL  OBJECT  optarg

5 symbols

And, finally, with -r radare core can flag automatically all these symbols and define function and data blocks.

$ rabin -sr /bin/ls
fs symbols
b 4 && f sym.stdout @ 0x0805e3c0
b 4 && f sym._IO_stdin_used @ 0x08059b04
b 4 && f sym.stderr @ 0x0805e3a4
b 4 && f sym.optind @ 0x0805e3a0
b 4 && f sym.optarg @ 0x0805e3c4
b 512
5 symbols added