The most useful feature in r2 for working with data structures is pf
commands, which prints formatted data.
You can use this command to print data in certain address according to a defined format, and moreover - define specific formats, for repeating structure.
The command is used as pf [types] [member1] [member2] [...]
. To see all the type code, pf??
, and pf???
for some usage examples. To define a type, use pf.[type] [..]
.
Example:
[0x08048e26]> pf.node ii*? value index (node)next
[0x08048e26]> pf.node @@ obj.node*
value : 0x0804b230 = 432
index : 0x0804b234 = 6
next : (*0x0) NULL