forked from radareorg/radare2
-
Notifications
You must be signed in to change notification settings - Fork 0
/
rax2.1
154 lines (154 loc) · 3.97 KB
/
rax2.1
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
.Dd Mar 19, 2024
.Dt RAX2 1
.Sh NAME
.Nm rax2
.Nd radare base converter
.Sh SYNOPSIS
.Nm rax2
.Op Fl ebBsSvxkKh
.Op [expr] ...
.Sh DESCRIPTION
This command is part of the radare project.
.Pp
Rax2 is a powerful calculator within the Radare2 suite, primarily used for
numerical system conversions, encoding and decoding C strings, hexpairs, and
base64, essential for binary analysis and reverse engineering tasks.
.Pp
The most common numerical bases include binary (base 2) for direct machine code
interaction, hexadecimal (base 16) for memory addresses and compact data
representation, and decimal (base 10) for human-readable calculations and
interpretations.
.Sh OPTIONS
.Bl -tag -width Fl
.It Fl a
Show ASCII table
.It Fl b
Force output mode (numeric base)
.Pp
f floating point
2 binary
3 ternary
8 octal
10 decimal
16 hexadecimal
.It Fl c
Show hexadecimal C string from integer value
.It Fl C
Dump stdin to C array in stdout (xxd replacement)
.It Fl d
Print the result in decimal (base 10)
.It Fl D
Decode the input data using base64
.It Fl e
Swap endianness
.It Fl E
Encode the input data using base64
.It Fl f
Interpret the input number as a 32bit dword and display it using IEEE 754
standard for floating point arithmetic
.It Fl F
Read C strings from stdin and output in hexpairs. Useful to load shellcodes
.It Fl h
Show usage help message
.It Fl k
Keep the same base as the input data
.It Fl K
Show randomart key asciiart for values or hexpairs
.It Fl H
Convert a string into a hash
.It Fl i
Convert LONG to/from IP ADDRESS
.It Fl j
Show the output in json format, the same as the r2 `?j 0x804` command.
.It Fl n
Append newline to the decoded output for human friendlyness
.It Fl o
Convert from octal string to char (rax2 -o 162 62)
.It Fl q
Be quiet. Show less information or drop the superfluous details in the output. For example: rax2 -qC
.It Fl r
Show the same output as the r2's `? 0x804` command.
When combined with -S (-rS) it will print r2 commands to write the actual binary into radare2
.It Fl s
Convert from hex pairs string to character (rax2 \-s 43 4a 50)
.It Fl S
Convert from character to hex string (rax2 \-S C J P)
.It Fl t
Convert epoch timestamp to human readable date format
.It Fl u
Convert given value to human readable units format
.It Fl v
Show program version
.It Fl w
Display the result as 16bit signed integer value
.It Fl x
Show hexpairs from integer value
.It Fl X
Convert a bit stream (an arbitrary sequence of 0 and 1 of any length) to
hexadecimal. The result can be larger than 64bits
.It Fl z
Convert from character string to binary (rax2 \-z hello)
.It Fl Z
Convert from binary string to string (rax2 \-l 01000101)
.Sh USAGE
Available variable types are:
.Pp
int \-> hex rax2 10
hex \-> int rax2 0xa
\-int \-> hex rax2 \-77
\-hex \-> int rax2 0xffffffb3
int \-> bin rax2 b30
bin \-> int rax2 1010d
float \-> hex rax2 3.33f
hex \-> float rax2 Fx40551ed8
oct \-> hex rax2 35o
hex \-> oct rax2 Ox12 (O is a letter)
bin \-> hex rax2 1100011b
hex \-> bin rax2 Bx63
.Pp
.Sh EXAMPLES
With no arguments, rax2 reads values from stdin. You can pass one or more values
as arguments.
.Pp
$ rax2 33 0x41 0101b
0x21
65
0x5
.Pp
You can do 'unpack' hexpair encoded strings easily.
.Pp
$ rax2 \-s 41 42 43
ABC
.Pp
It supports some math operations:
.Pp
$ rax2 1+1 "0x5*101b+5"
2
30
.Pp
Encode and decode binary file using base64:
.Pp
$ rax2 -E < /bin/ls > ls.b64
$ rax2 -D < ls.b64 > ls
.Pp
$ cmp /bin/ls ls && echo $?
0
.Pp
Use -z/-Z to convert between binary and string:
.Pp
$ rax2 -z hello
001100000111100000110001001100010011001000110011
$ rax2 -Z 0110100001100101011011000110110001101111
hello
.Pp
It is a very useful tool for scripting, so you can read floating point values, or get the integer offset of a jump or a stack delta when analyzing programs.
.Pp
.Sh SEE ALSO
.Pp
.Xr radare2(1)
.Sh WWW
.Pp
https://www.radare.org
.Sh AUTHORS
.Pp
Written by pancake <[email protected]>.