Visual Mode

The visual mode is a more user-friendly interface alternative to radare2’s command-line prompt. It allows easy navigation, has a cursor mode for selecting bytes, and offers numerous key bindings to simplify debugger use. To enter visual mode, use V command. To exit from it back to command line, press q.

Navigation

Navigation can be done using HJKL or arrow keys and PgUp/PgDown keys. It also understands usual Home/End keys. Like in Vim the movements can be repeated by preceding the navigation key with the number, for example 5j will move down for 5 lines, or 2l will move 2 characters right.

Visual Mode

print modes aka panels

The Visual mode uses “print modes” which are basically different panel that you can rotate. By default those are:

↻ Hexdump panel -> Disassembly panel → Debugger panel → Hexadecimal words dump panel → Hex-less hexdump panel → Op analysis color map panel → Annotated hexdump panel ↺.

Notice that the top of the panel contains the command which is used, for example for the disassembly panel:

  1. [0x00404890 16% 120 /bin/ls]> pd $r @ entry0

Getting Help

To see help on all key bindings defined for visual mode, press ?:

  1. Visual mode help:
  2.  ?        show this help
  3.  ??       show the user-friendly hud
  4.  %        in cursor mode finds matching pair, or toggle autoblocksz
  5.  @        redraw screen every 1s (multi-user view)
  6.  ^        seek to the begining of the function
  7.  !        enter into the visual panels mode
  8.  _        enter the flag/comment/functions/.. hud (same as VF_)
  9.  =        set cmd.vprompt (top row)
  10.  |        set cmd.cprompt (right column)
  11.  .        seek to program counter
  12.  \        toggle visual split mode
  13.  "        toggle the column mode (uses pC..)
  14.  /        in cursor mode search in current block
  15.  :cmd     run radare command
  16.  ;[-]cmt  add/remove comment
  17.  0        seek to beginning of current function
  18.  [1-9]    follow jmp/call identified by shortcut (like ;[1])
  19.  ,file    add a link to the text file
  20.  /*+-[]   change block size, [] = resize hex.cols
  21.  </>      seek aligned to block size (seek cursor in cursor mode)
  22.  a/A      (a)ssemble code, visual (A)ssembler
  23.  b        browse symbols, flags, configurations, classes, ...
  24.  B        toggle breakpoint
  25.  c/C      toggle (c)ursor and (C)olors
  26.  d[f?]    define function, data, code, ..
  27.  D        enter visual diff mode (set diff.from/to
  28.  e        edit eval configuration variables
  29.  f/F      set/unset or browse flags. f- to unset, F to browse, ..
  30.  gG       go seek to begin and end of file (0-$s)
  31.  hjkl     move around (or HJKL) (left-down-up-right)
  32.  i        insert hex or string (in hexdump) use tab to toggle
  33.  mK/'K    mark/go to Key (any key)
  34.  M        walk the mounted filesystems
  35.  n/N      seek next/prev function/flag/hit (scr.nkey)
  36.  g        go/seek to given offset
  37.  O        toggle asm.pseudo and asm.esil
  38.  p/P      rotate print modes (hex, disasm, debug, words, buf)
  39.  q        back to radare shell
  40.  r        refresh screen / in cursor mode browse comments
  41.  R        randomize color palette (ecr)
  42.  sS       step / step over
  43.  t        browse types
  44.  T        enter textlog chat console (TT)
  45.  uU       undo/redo seek
  46.  v        visual function/vars code analysis menu
  47.  V        (V)iew graph using cmd.graph (agv?)
  48.  wW       seek cursor to next/prev word
  49.  xX       show xrefs/refs of current function from/to data/code
  50.  yY       copy and paste selection
  51.  z        fold/unfold comments in disassembly
  52.  Z        toggle zoom mode
  53.  Enter    follow address of jump/call
  54. Function Keys: (See 'e key.'), defaults to:
  55.   F2      toggle breakpoint
  56.   F4      run to cursor
  57.   F7      single step
  58.   F8      step over
  59.   F9      continue