12.1 IO Sockets

The IO plugin called 'socket' generates a virtual file using a malloc-ed buffer which grows when receiving data from the socket and writing data to it in.

$ radare socket://av.com:80/
[0x00000000]> x
   offset   0 1  2 3  4 5  6 7  8 9  A B  C D  E F  0 1  0123456789ABCDEF01
0x00000000, ffff ffff ffff ffff ffff ffff ffff ffff ffff ..................
0x00000012, ffff ffff ffff ffff ffff ffff ffff ffff ffff ..................
...

When writing the socket:// plugin redirects it to the socket.

[0x00000000]> w GET / HTTP/1.1\r\nHost: av.com\r\n\r\n
[0x00000000]> x
   offset   0 1  2 3  4 5  6 7  8 9  A B  C D  E F  0 1  0123456789ABCDEF01
0x00000000, 4854 5450 2f31 2e31 2033 3031 204d 6f76 6564 HTTP/1.1 301 Moved
0x00000012  2050 6572 6d61 6e65 6e74 6c79 0d0a 4461 7465  Permanently..Date
0x00000024, 3a20 4d6f 6e2c 2032 3920 5365 7020 3230 3038 : Mon, 29 Sep 2008
0x00000036  2031 313a 3035 3a34 3320 474d 540d 0a4c 6f63  11:05:43 GMT..Loc
0x00000048, 6174 696f 6e3a 2068 7474 703a 2f2f 7777 772e ation: http://www.
0x0000005A  616c 7461 7669 7374 612e 636f 6d2f 0d0a 436f altavista.com/..Co
0x0000006C, 6e6e 6563 7469 6f6e 3a20 636c 6f73 650d 0a54 nnection: close..T
0x0000007E  7261 6e73 6665 722d 456e 636f 6469 6e67 3a20 ransfer-Encoding: 
0x00000090, 6368 756e 6b65 640d 0a43 6f6e 7465 6e74 2d54 chunked..Content-T
0x000000A2  7970 653a 2074 6578 742f 6874 6d6c 3b20 6368 ype: text/html; ch
0x000000B4, 6172 7365 743d 7574 662d 380d 0a0d 0a39 3720 arset=utf-8....97 
0x000000C6  2020 2020 0d0a 5468 6520 646f 6375 6d65 6e74     ..The document
0x000000D8, 2068 6173 206d 6f76 6564 203c 4120 4852 4546  has moved <A HREF
0x000000EA  3d22 6874 7470 3a2f 2f77 7777 2e61 6c74 6176 ="http://www.altav
0x000000FC, 6973 7461 2e63 6f6d 2f22 3e68 6572 653c 2f41 ista.com/">here</A
0x0000010E  3e2e 3c50 3e0a 3c21 2d2d 2070 332e 7263 2e72 >.<P>.<!-- p3.rc.r
0x00000120, 6534 2e79 6168 6f6f 2e63 6f6d 2075 6e63 6f6d e4.yahoo.com uncom
0x00000132  7072 6573 7365 642f 6368 756e 6b65 6420 4d6f pressed/chunked Mo
0x00000144, 6e20 5365 7020 3239 2030 343a 3035 3a34 3320 n Sep 29 04:05:43 
0x00000156  5044 5420 3230 3038 202d 2d3e 0a0d 0a30 0d0a PDT 2008 -->...0..
0x00000168, 0d0a ffff ffff ffff ffff ffff ffff ffff ffff ..................

The contents of the file are updated automatically while the socket is feeded by bytes. You can understand this plugin as a raw hexadecimal netcat with a nice interface ;)

All reads from the socket are stored as flags pointing to the last read packet:

[0x00000000]> f
0x00000000       512     _sockread_0
0x00000000       512     _sockread_last