---
# System prepended metadata

title: 'radare2: Special Variables'

---

# Redefining RNum vars

| @{from to}  --> @[] and @() ?

$b $B -> basic block, block size, base address
$f $F -> function, flag
$o $O -> seek, offset
$s $S -> file size and section address
$m $M -> memory ref, map
$i $I -> nth instruction fwd/bkw
$r $R -> console rows / registers

RFC: Use {} and : syntaxes if supported? for example:

* `$e:scr.cols` == `$e{scr.cols}`

## Proposal

Basic

- [ ] `$?` -> last comparison result
- [x] `$b` -> block size .. like its used in `@!` <- maybe @b: instead
- [x] `$$` -> current offset
- [x] `$$$` -> non-temporal current seek
- [ ] `$e{hex.cols}` -> config variable
- [x] `$$c` `$$$c` -> cursor address
- [x] `$k{key}` get from sdb

TODO: Deprecate/Rethink

* `$o` (RFC: same as $$?)
* .. get current filedescriptor for push/pop?
* `$p` (RFC: getpid)
* `$P` (RFC: children pid)
* `$s` (RFC: file size)
* `$w` (RFC: get word size, 4 if asm.bits=32, 8 if 64, ...)
* `$r` -> rows
* `$c` -> columns

Instruction

* `$j` -> `$ij` jump destination
* `$f` -> `$if` fail destination
* `$i` -> `$in` next instruction (WIP)
* `$l` -> `$is` opcode length (RFC) why not use `s` instead?
* `$m` -> `$ir` memory opcode reference address
* `$v` -> `$iv` opcode immediate (RFC)

Flags

* `$f` -> address of closest flag
  * `$fs` -> flag size
  * `$fd` -> distance to closest flag (delta offset)
  * `$fe` -> end of flag
* `$f{sym.main}` -> address of sym.main flag. same as `sym.main`
  * `$fs{sym.main}` -> size of sym.main
  * `$fd{sym.puts}` -> sym.puts-$$
  * `$fe{sym.main}` -> address where sym.main flag ends

Section

* `$S` -> section address
  * `$SS` -> section size in bytes
  * `$SE` -> ending address of section
  * `$SD` -> distance to begining of section
* `$S{name}` / `$S:name`
  * `$SS{name}` section size of given section by name


Functions

* `$F` -> function
  * `$FB` -> function begin (minbound?)
  * `$FE` -> function end (maxbound?)
  * `$Fe` -> function entrypoint (same as $F?)
  * `$Fd` -> function delta like $fd
  * `$FS` -> linear function size
  * `$Fs` -> bbsum function size
  * `$FX` -> function xrefs (RFC)
  * `$FR` -> function reference (RFC)

Basic Block

* `$B` -> address of basic block
  * `$BE` -> end of basic block
  * `$BS` -> basic block size
  * `$Bj` -> jump to
  * `$Bf` -> fail to
  * `$Bi` -> instructions count in current bb


Debugger (WIP)

* `$DP` -> debugger pid
* `$r{rax}` -> register value1
```
| $D            current debug map base address ?v $D @ rsp
| $DB           same as dbg.baddr, progam base address
| $DD           current debug map size
| $Dn           get nth data reference in function
```

Maps (WIP)

* `$M`  map address (lowest map address)
* `$MS` map size (lowest map address)
* `$MB` map begin
* `$ME` map end
* `$MM` map base address


## Old help

```
Usage: ?v [$.]
| flag          offset of flag
| ${ev}         get value of eval config variable
| $$            here (current virtual seek)
| $$$           current non-temporary virtual seek
| $?            last comparison value
| $alias=value  alias commands (simple macros)
| $B            base address (aligned lowest map address)
| $b            block size
| $c            get terminal width in character columns
| $Cn           get nth call of function
| $D            current debug map base address ?v $D @ rsp
| $DB           same as dbg.baddr, progam base address
| $DD           current debug map size
| $Dn           get nth data reference in function
| $e            1 if end of block, else 0
| $e{flag}      end of flag (flag->offset + flag->size)
| $f            jump fail address (e.g. jz 0x10 => next instruction)
| $F            same as $FB
| $Fb           begin of basic block
| $FB           begin of function
| $Fe           end of basic block
| $FE           end of function
| $Ff           function false destination
| $Fi           basic block instructions
| $FI           function instructions
| $Fj           function jump destination
| $fl           flag length (size) at current address (fla; pD $l @ entry0)
| $FS           function size (linear length)
| $Fs           size of the current basic block
| $FSS          function size (sum bb sizes)
| $i{n}         address of nth instruction forward
| $I{n}         address of nth instruction backward (s $I1@$Fe) #last instr in bb
| $j            jump address (e.g. jmp 0x10, jz 0x10 => 0x10)
| $Ja           get nth jump of function
| $k{kv}        get value of an sdb query value
| $l            opcode length
| $M            map address (lowest map address)
| $MM           map size (lowest map address)
| $m            opcode memory reference (e.g. mov eax,[0x10] => 0x10)

| $O            cursor here (current offset pointed by the cursor)
| $o            here (current disk io offset)
| $p            getpid()
| $P            pid of children (only in debug)
| $r            get console height (in rows, see $c for columns)
| $r{reg}       get value of named register ($r{PC} and $r:PC syntax is supported)
| $s            file size
| $S            section offset
| $SS           section size
| $s{flag}      get size of flag
| $v            opcode immediate value (e.g. lui a0,0x8010 => 0x8010)
| $w            get word size, 4 if asm.bits=32, 8 if 64, ...
| $Xn           get nth xref of function
| RNum          $variables usable in math expressions
```