I miss to explain the new "for-each-at" syntax for commands: With the current devel version you can use the '@@' suffix to execute a command on multiple places at a same time.
Here are some examples of use: ; write a jump trampoline on all the symbols: > fs symbols > wa jmp 0x80484040 @@ sym_* You can specify the list manually and perform math operations on the offsets: > wx 90 @@ 0x1234 sym_main+0x33 184577 I found this new syntax quite cool and useful for writing oneliners. Enjoy --pancake On Mon, 2008-06-30 at 11:41 +0200, pancake wrote: > Thanks to all the people that was in the IRC the sat night. There was so > many zombies (me too for a while...), but it was funny and some > interesting work has been done. Here's the list > > - Some warnings has been fixed (whats, ..) > - x86-64/linux support working again (elektranox) > - kradare merged (initial import of the kernel module . thx sha0) > - bypassed a weird freebsd bug > > Nibble was working in the ELF parser for rabin (i hope to have this code > integrated before 0.9.8) > > One of the things I implement on it was the 'flag spaces' concept. > > The flagging spaces are used to split the whole flag list into different > groups with name called flagspaces (accessed with the 'fs' command). > > So now, instead of having a whole large list of flags, there's a more > nicer way to work with them :) > > In the debugger, by default several flagspaces are created while > importing the flags (sections, maps, symbols, strings, regs, ..) You can > switch between flag spaces using the 'fs <name>' command. and then > you'll only list the flags of the selected flagspace while using the 'f' > command. > > For the rest, this attribute is not used, so it's just for usability > reasons, so you can remove all flag symbols with "fs symbols && f -*" > and things like that. atm doesnt support flag space renaming or moving > flags from one space to another, but i'll to. > > -- > > Another cool stuff i do was the integration of the SPCC inside the core > in a more user friendly way. For the new people...spcc is an engine i > wrote for parsing in-memory data structures using C. > > A new command has been added to do this: > > 'as' - analyze structure > > Giving a structure name as argument. $EDITOR is opened to edit the > source to parse this and after saving it, it will run your program at > current seek. Next calls will only visualize the structure. But you can > edit or remove them in dir.spcc which is ~/.radare/spcc by default. > > BTW I dont expect a decent GUI before 1.0, but things are getting > closer ;) > > Enjoy! > > > --pancake > _______________________________________________ > radare mailing list > [email protected] > http://lists.nopcode.org/listinfo.cgi/radare-nopcode.org > _______________________________________________ radare mailing list [email protected] http://lists.nopcode.org/listinfo.cgi/radare-nopcode.org
