radareorg / radare2

UNIX-like reverse engineering framework and command-line toolset
https://www.radare.org/
GNU Lesser General Public License v3.0
20.4k stars 2.98k forks source link

pf output is confusing #12726

Open radare opened 5 years ago

radare commented 5 years ago

i think offset should go first, like it does in px or pd

[0x00000000]> pf xxd foo bar cow
 foo : 0x00000000 = 0xfeedfacf
 bar : 0x00000004 = 0x01000007
 cow : 0x00000008 = 2147483651

should be

[0x00000000]> pf xxd foo bar cow
0x00000000  foo 0xfeedfacf
0x00000004  bar 0x01000007
0x00000008  cow 2147483651
radare commented 5 years ago

also, the value should be aligned in column

XVilka commented 5 years ago

Sounds good to me, just keep the equal sign:

0x00000000:  foo = 0xfeedfacf
0x00000004:  bar = 0x01000007
0x00000008:  cow = 2147483651
kazarmy commented 5 years ago

👍 though no need for double spacing and the colon I suppose

0x00000000 foo = 0xfeedfacf
0x00000004 bar = 0x01000007
0x00000008 cow = 2147483651
XVilka commented 5 years ago

@radare so, what was decided on this one? I think you got your feedback already.

radare commented 5 years ago

will be good to add pft to show the output of pf in table format. this way we can query the output

if we add proper csv support (or json) we will get more features in many places. it will be mainly useful when displaying arrays of structs

kazarmy commented 5 years ago

sgtm

0x00000000: foo = 0xfeedfacf
0x00000004: bar = 0x01000007
0x00000008: cow = 2147483651
0x0000000c: 0xcc7811a78

i want to add a colon for formats with no labels

kazarmy commented 5 years ago

bad news, this is more work than previously thought ... in particular, (nearly?) every r_print_format_<type>() function has code that prints <offset> = <value>

radare commented 4 years ago

Yep. The pf code hurts a bit. It requires a lot of love and it always needed it. But its improving over time, so dont be afraid

On 23 Sep 2019, at 17:30, Khairul Azhar Kasmiran notifications@github.com wrote:  bad news, this is more work than previously thought ... (nearly?) every r_printformat() function has code that prints =

— You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub, or mute the thread.