80 Rz-bin — Show Properties of a Binary
Rz-bin is a powerful tool to handle binaries, to get information on imports, sections, headers and other data. It can present this information in several formats accepted by other tools, including Rizin itself. rz-bin understands many file formats: Java CLASS, ELF, PE, Mach-O or any format supported by plugins, and it is able to obtain symbol import/exports, library dependencies, strings of data sections, xrefs, entrypoint address, sections, architecture type.
$ rz-bin -h
Usage: rz-bin [-AcdeEghHiIjlLMqrRsSUvVxzZ] [-@ at] [-a arch] [-b bits] [-B addr]
[-C F:C:D] [-f str] [-m addr] [-n str] [-N m:M] [-P pdb]
[-o str] [-O str] [-k query] [-D lang symname] file
-@ addr Show section, symbol, or import at the given address
-A List sub-binaries and their arch-bits pairs
-a arch Set arch (x86, arm, .. or <arch>_<bits>)
-b bits Set bits (32, 64 ...)
-B addr Override base address (pie bins)
-c List classes
-cc List classes in header format
-C fmt:C:D Create [elf,mach0,pe] with Code and Data hexpairs (see -a)
-d Show debug/dwarf information
-dd Load debug/dwarf information from debuginfod server
-D lang name Demangle symbol name (-D all for bin.demangle=true)
-e Entrypoint
-ee Constructor/destructor entrypoints
-E Globally exportable symbols
-f mach Select sub-binary for the machine [mach].
-F binfmt Force to use that bin plugin (ignore header check)
-g Same as -SMZIHVResizcld -SS -SSS -ee (show all info)
-G addr Load address . offset to header
-h Show this help
-H Header fields
-i Import (symbols imported from libraries)
-I Binary info
-j Output in JSON
-k sdb-query Run sdb query. for example: '*'
-K algo Calculate checksums (md5, sha1, ..)
-l Linked libraries
-L [plugin] List supported bin plugins or plugin details
-m addr Show source line at addr
-M Main (show address of main symbol)
-n str Show section, symbol or import named str
-N min:max Force min:max number of chars per string (see -z and -zz)
-o str Output file/folder for write operations (out by default)
-O str Write/extract operations (-O help)
-p Show physical addresses
-P Show debug/pdb information
-PP Download pdb file for binary
-q Quiet mode, just show fewer data
-qq Show less info (no offset/size for -z for ex.)
-Q Show load address used by dlopen (non-aslr libs)
-r Show output in rizin format
-R Show relocations
-s Symbols
-S Sections
-SS Segments
-SSS Sections mapping to segments
-T Display file signature
-u Unfiltered (no rename duplicated symbols/sections)
-U Resources
-v Show version information
-V Show binary version information
-w Display try/catch blocks
-x Extract bins contained in file
-Y Calculate all the possibles base address candidates of a firmware bin
-z Show strings (from data section)
-zz Show strings (from raw strings from bin)
-zzz Dump raw strings to stdout (for huge files)
-Z Guess size of binary program
Environment:
RZ_BIN_CODESIGN_VERBOSE: # make code signatures verbose
RZ_BIN_DEBUGINFOD_URLS: e bin.dbginfo.debuginfod_urls # use alternative debuginfod server
RZ_BIN_DEMANGLE=0: e bin.demangle # do not demangle symbols
RZ_BIN_LANG: e bin.lang # assume lang for demangling
RZ_BIN_MAXSTRBUF: e search.str.max_length # specify maximum buffer size
RZ_BIN_PDBSERVER: e pdb.server # use alternative PDB server
RZ_BIN_PREFIX: e bin.prefix # prefix symbols/sections/relocs with a specific string
RZ_BIN_STRFILTER: e bin.str.filter # rizin -qc 'e bin.str.filter=??' -
RZ_BIN_STRPURGE: e bin.str.purge # try to purge false positives
RZ_BIN_SYMSTORE: e pdb.symstore # path to downstream PDB symbol store
RZ_CONFIG: # config file
RZ_NOPLUGINS: # do not load plugins