RZ\_BIN(1) General Commands Manual RZ\_BIN(1)

# [NAME](#NAME)

`rz-bin` — Binary program info extractor

# [SYNOPSIS](#SYNOPSIS)

`rz-bin` \[`-AcdeEghHiIjlLMqrRsSUvVxzZ`] \[`-@` `at`] \[`-a` `arch`] \[`-b` `bits`] \[`-B` `addr`] \[`-C` `F:C:D`] \[`-f` `str`] \[`-m` `addr`] \[`-n` `str`] \[`-N` `m:M`] \[`-P` `pdb`] \[`-o` `str`] \[`-O` `str`] \[`-k` `query`] \[`-D` `lang symname`] `file`

# [DESCRIPTION](#DESCRIPTION)

This command is part of the Rizin project.

rz-bin can analyze and extract useful information from binary executable files like ELF, PE, Mach-O, etc. It supports multiple architectures like x86, ARM, MIPS, PowerPC, etc.

# [OPTIONS](#OPTIONS)

[`-@`](#@) `addr`

Show section, symbol, or import at the given address

[`-A`](#A)

List sub-binaries and their arch-bits pairs

[`-a`](#a) `arch`

Set architecture (x86, arm, .. or <arch>\_<bits>)

[`-b`](#b) `bits`

Set bits (32, 64 ...)

[`-B`](#B) `addr`

Override base address (PIE bins)

[`-c`](#c)

List classes

[`-cc`](#cc)

List classes in header format

[`-C`](#C) `fmt:C:D`

Create \[elf, mach0, pe] with Code and Data hexpairs (see -a)

[`-d`](#d)

Show debug/dwarf information

[`-dd`](#dd)

Load debug/dwarf information from debuginfod server

[`-D`](#D) `lang name`

Demangle symbol name (-D all for bin.demangle=true)

[`-e`](#e)

Entrypoint

[`-E`](#E)

Globally exportable symbols

[`-f`](#f) `str`

Select sub-bin named str

[`-F`](#F) `binfmt`

Force to use that bin plugin (ignore header check)

[`-g`](#g)

Same as -SMZIHVResizcld -SS -SSS -ee (show all information)

[`-G`](#G) `addr`

Load address . offset to header

[`-h`](#h)

Show usage help message

[`-H`](#H)

Header fields

[`-i`](#i)

Import (symbols imported from libraries)

[`-I`](#I)

Binary info

[`-j`](#j)

Output in JSON

[`-k`](#k) `sdb-query`

Run sdb query. for example: '\*'

[`-K`](#K) `algo`

Calculate checksums (md5, sha1, ..)

[`-l`](#l)

Linked libraries

[`-L`](#L) `plugin`

List supported bin plugins or plugin details

[`-m`](#m) `addr`

Show source line at addr

[`-M`](#M)

Main (show address of main symbol)

[`-n`](#n) `str`

Show section, symbol, or import named str

[`-N`](#N) `min:max`

Force min:max number of chars per string (see -z and -zz)

[`-o`](#o) `str`

Output file/folder for write operations (out by default)

[`-O`](#O) `str`

Write/extract operations (-O help)

[`-p`](#p)

Show physical addresses

[`-P`](#P)

Show debug/pdb information

[`-PP`](#PP)

Download pdb file for binary

[`-q`](#q)

Be quiet, just show fewer data

[`-qq`](#qq)

Show less info (no offset/size for -z for ex.)

[`-Q`](#Q)

Show load address used by dlopen (non-aslr libs)

[`-r`](#r)

Show output in rizin format

[`-R`](#R)

Show relocations

[`-s`](#s)

Symbols

[`-S`](#S)

Sections

[`-SS`](#SS)

Segments

[`-SSS`](#SSS)

Sections mapping to segments

[`-T`](#T)

Display file signature

[`-u`](#u)

Unfiltered (no rename duplicated symbols/sections)

[`-U`](#U)

Resources

[`-v`](#v)

Show version information

[`-V`](#V)

Show binary version information

[`-w`](#w)

Display try/catch blocks

[`-x`](#x)

Extract bins contained in file

[`-Y`](#Y)

Calculate all the possibles base address candidates of a firmware bin

[`-z`](#z)

Show strings (from data section)

[`-zz`](#zz)

Show strings (from raw strings from bin)

[`-zzz`](#zzz)

Dump raw strings to stdout (for huge files)

[`-Z`](#Z)

Guess size of binary program

# [ENVIRONMENT](#ENVIRONMENT)

[`RZ_BIN_CODESIGN_VERBOSE`](#RZ_BIN_CODESIGN_VERBOSE)

make code signatures verbose

[`RZ_BIN_DEBUGINFOD_URLS`](#RZ_BIN_DEBUGINFOD_URLS)

bin.dbginfo.debuginfod\_urls - use alternative debuginfod server

[`RZ_BIN_DEMANGLE`](#RZ_BIN_DEMANGLE)

bin.demangle - do not demangle symbols

[`RZ_BIN_LANG`](#RZ_BIN_LANG)

bin.lang - assume lang for demangling

[`RZ_BIN_MAXSTRBUF`](#RZ_BIN_MAXSTRBUF)

bin.maxstrbuf - specify maximum buffer size

[`RZ_BIN_PDBSERVER`](#RZ_BIN_PDBSERVER)

pdb.server - use alternative PDB server

[`RZ_BIN_PREFIX`](#RZ_BIN_PREFIX)

bin.prefix - prefix symbols/sections/relocs with a specific string

[`RZ_BIN_STRFILTER`](#RZ_BIN_STRFILTER)

bin.str.filter - rizin -qc 'e bin.str.filter=??' -

[`RZ_BIN_STRPURGE`](#RZ_BIN_STRPURGE)

bin.str.purge - try to purge false positives

[`RZ_BIN_SYMSTORE`](#RZ_BIN_SYMSTORE)

pdb.symstore - path to downstream symbol store

[`RZ_CONFIG`](#RZ_CONFIG)

sdb config file

[`RZ_NOPLUGINS`](#RZ_NOPLUGINS)

do not load shared plugins (speedup loading)

# [EXAMPLES](#EXAMPLES)

List symbols of a program:

`rz-bin` `-s` `a.out`

Get offset of symbol:

`rz-bin` `-n` `_main` `a.out`

Get entrypoint:

`rz-bin` `-e` `a.out`

Load symbols and imports from rizin:

`rizin` `-n` `/bin/ls`

\[0x00000000]> .!rz-bin -prsi $FILE

# [SEE ALSO](#SEE_ALSO)

[rizin(1)](/man/os/rizin/rizin.1), [rz-asm(1)](/man/os/rizin/rz-asm.1), [rz-ax(1)](/man/os/rizin/rz-ax.1), [rz-diff(1)](/man/os/rizin/rz-diff.1), [rz-find(1)](/man/os/rizin/rz-find.1), [rz-gg(1)](/man/os/rizin/rz-gg.1), [rz-hash(1)](/man/os/rizin/rz-hash.1), [rz-run(1)](/man/os/rizin/rz-run.1)

# [AUTHORS](#AUTHORS)

pancake <pancake@nopcode.org>

byteninjaa0

January 24, 2024 Linux 4.19.0-gvisor

---

Document: rz-bin(1) from rizin 0.9.1-r1 (Chainguard OS)
Source: https://github.com/rizinorg/rizin