Can radare2 print local variables by name?

Question

When radare2 parses a function, it gives local variable names such as local_4h for ebp - 0x4. It also makes it possible to give these variables more meaningful names when their purpose becomes clear. However, after renaming the variables, typing them becomes more difficult. When I see an instruction like mov eax, dword [ebp - i] , I have to

• Look at the top of the disassembly to find the line var int i @ ebp-0xc
• Type pxw @ ebp-0xc
• Read the value i from the first of 16 (!) Lines of output
• Find my place again in disassembly after it was moved from the last team

It's not a lot of work, but when I go through a lot of assemblies with many variables, it gets tedious pretty quickly.

As a follow-up question, is it possible to print a variable / location every time execution stops at a breakpoint, for example using the GDB "display" command?

Answer 1

Instead of pxw @ local_4h there is afvd ( a nalyze f unction v ariables d isplay), which lists all or individual variables:

 [0x00400526]> afvd var local_14h = 0x7fff2eab16ac 0x2eab17a000000001 ........ var local_20h = 0x7fff2eab16a0 0x00007fff2eab17a8 ........ @rsp rsi stack RW 0x7fff2eab21ec --> stack RW 0x74756f2e612f2e (./a.out) --> ascii var local_8h = 0x7fff2eab16b8 0x0000000000000041 A....... ascii var local_4h = 0x7fff2eab16bc 0x0040057000000000 ....p.@. [0x00400526]> .afvd local_14h # note the dot var local_14h = 0x7fff2eab16ac 0x2eab17a000000001 ........ 

afvd name returns the r2 command to display the variable 'name'. The point at the beginning executes the command.
Remember that you can always use the command ? For help:

 [0x00400526]> afv? |Usage: afv[rbs] | afvr[?] manipulate register based arguments | afvb[?] manipulate bp based arguments/locals | afvs[?] manipulate sp based arguments/locals | afvR [varname] list addresses where vars are accessed | afvW [varname] list addresses where vars are accessed | afva analyze function arguments/locals | afvd name output r2 command for displaying the value of args/locals in the debugger | afvn [old_name] [new_name] rename argument/local | afvt [name] [new_type] change type for given argument/local | afv-([name]) remove all or given var 

In fact, there is also the option to use (almost) the same syntax as in your question. However, variable names must be added as flags in advance, and this must be done every time you enter a function.

 [0x00400526]> .afv* [0x00400526]> pxw @ fcnvar.local_14h 0x7fff2eab16ac 0x00000001 0x2eab17a0 [omitted]