4.3 Visual xrefs

radare implements many user-friendly features for the visual interface to walk thru the assembly code. One of them is the 'x' key that popups a menu for selecting the xref (data or code) against the current seek and then jump there. In this example, we are displaying the import getenv and displaying the CODE xreferences to this external symbol.

[0x08048700]> pd @ imp_getenv
; CODE xref 0x08048e30 (sym.otf_patch+0x1d9)
; CODE xref 0x08048d53 (sym.otf_patch+0xfc)
; CODE xref 0x08048c90 (sym.otf_patch+0x39)
      |    0x08048700,   imp_getenv:
      |    0x08048700           jmp dword near [0x804c00c]
      |    0x08048706           push dword 0x18       ; oeax+0xd
      `==< 0x0804870B           jmp 0x80486c0         ; 1 = section._plt

Use the 'sx' and 'sX' command to seek to the xrefs for code and Xrefs for data indexed by numbers.

All the calls and jumps are numbered (1, 2, 3...) these numbers are the keybindings for seeking there from the visual mode.

[0x4A13B8C0]> pd 4
0x4A13B8C0,   eip:   mov eax, esp        
0x4A13B8C2           call 0x4a13c000       ; 1 = 0x4a13c000
0x4A13B8C7           mov edi, eax        
0x4A13B8C9           call 0x4a13b8b0       ; 2 = 0x4a13b8b0

All the seek history is stored, by pressing 'u' key you will go back in the seek history time :)