Radare IO allows to virtually map contents of files in the same IO space at random offsets. This is useful to open multiple files in a single view or just to 'emulate' an static environment like if it was in the debugger with the program and all its libraries mapped there.
Using the 'S'ections command you'll be able to define different base address for each library loaded at different offsets.
Mapping files is done with the 'o' (open) command. Let's read the help:
[0x00000000]> o? Usage: o [file] [offset] > o /bin/ls ; open file > o /lib/libc.so 0xC848000 ; map file at offset > o- /lib/libc.so ; unmap
Let's prepare a simple layout:
$ rabin -l ./a.out libc.so.6 $ radare -u ./a.out [0x00000000]> o /lib/libc.so.6 0x10000000 [0x00000000]> o /lib/ld-2.7.so 0x465f2000
NOTE: radare has been started with the -u flag to ignore file size limits and being able to seek on far places like where we have mapped our libs.
Listing mapped files:
[0x00000000]> o 0x00000000 0x000018da ./a.out 0x465f2000 0x4660cf28 /lib/ld-2.7.so 0x10000000 0x101370ec /lib/libc.so.6
Let's print some strings from ld.so
[0x00000000]> pa @ 0x465F0000+ 2469 _rtld_global\x00_dl_make_stack_executable\x00__libc_stack_end\x00__libc_memalign\x00malloc\x00_dl_deallocate_tls \x00__libc_enable_secure\x00_dl_get_tls_static_info\x00calloc\x00_dl_debug_state\x00_dl_argv\x00_dl_allocate_tls _init\x00_rtld_global_ro\x00realloc\x00_dl_tls_setup\x00_dl_rtld_di_...
To unmap these files just use the 'o-' command giving the mapped file name as argument.