22.5 forum: rsc monitor usage

Rsc is a wonderful entrypoint for user-defined external programs for radare.

There's a script called 'monitor' which allows to execute a intro-separated list of commands and visualize them on an external terminal or window.

Let's start with a simple example. Let's trace the contents of a buffer while we are stepping into a loop.

$ radare dbg://<path-to-our-program>

Lets open a new terminal and play with it..

To list all current monitors type 'rsc monitor -l'. Remember that all your radares will share the same monitorpath. Use the MONITORPATH environment variable to change this (eval dir.monitor inside radare if you don't want to restart your radare) smile

$ rsc monitor
Usage: rsc monitor [-lr] [name] [command]
  -l        list all running monitors
  -r [name] remove a specific monitor
  -R        removes all monitors
Use MONITORPATH defaults to ~/.radare/monitor/

To setup a new monitor type this:

$ rsc monitor xeip x@eip

This will create monitor called "xeip" that willl show N bytes (block size) in hexadecimal starting from eip.

Monitors are executed everytime the prompt is shown (also in visual mode), I plan to add a SIGHUP callback for this in future versions.

Now we can monitor the 'xeip' monitor with:

$ rsc monitor xeip

If you want to execute more than one command per monitor. Just edit the script by hand in ~/.radare/monitor/your-script (output of the script is your-script.txt) So. don't use .txt as script name smile

To remove all monitors use -R or -r with the script name to be removed.

$ rsc monitor -R

Monitors are integrated with the gui.

I plan to use inotify() on linux to update the contents of the file faster.

NOTES: Only radare commands can be executed. Shell ones will be executed but not shown (because of the console abstraction).