Tweak the disassembly output with `e asm.`
You can add commands into your ~/.rizinrc to customize your experience with Rizin
In visual mode press 'c' to toggle the cursor mode. Use tab to navigate
You can mark an offset in visual mode with the cursor and the ',' key. Later press '.' to go back
You can debug a program from the graph view ('ag') using standard rizin commands
Use the '[' and ']' keys in visual mode to adjust the screen width
Select your architecture with: 'e asm.arch=<arch>' or rizin -a from the shell
Move between your search hits in visual mode using the 'f' and 'F' keys
Save your projects with 'Ps <project-filename>' and restore then with 'Po <project-filename>'
Enable asm.trace to see the tracing information inside the disassembly
Change the registers of the child process in this way: 'dr eax=0x333'
Check your IO plugins with 'rizin -L'
Change the size of the file with the 'r' (resize) command
Calculate checksums for the current block with the commands starting with 'ph' ('ph md5', 'ph crc32', ..)
Use +,-,*,/ to change the size of the block
Change the block size with 'b <block-size>'. In visual mode you can also enter rizin command pressing the ':' key (like vi does)
If you want to open the file in read-write mode, invoke rizin with '-w'
Print the contents of the current block with the 'p' command
Command layout is: '<repeat><command> <bytes> @ <offset>'.  For example: '3x 20 @ 0x33' will show 3 hexdumps of 20 bytes at 0x33
Press 'c' in visual mode to toggle the cursor mode
Press 'C' in visual mode to toggle colors
You can 'copy/paste' bytes using the cursor in visual mode 'c' and using the 'y' and 'Y' keys
Move around the bytes with h,j,k,l! Arrow keys are neither portable nor efficient
Seek at relative offsets with 's +<offset>' or 's -<offset>'
Invert the block bytes using the 'I' key in visual mode
Switch between print modes using the 'p' and 'P' keys in visual mode
Add comments using the ';' key in visual mode or the 'CC' command from the rizin shell
Assemble opcodes with the 'a' and 'A' keys in visual mode, which are bindings to the 'wa' and 'wA' commands
Find expanded AES keys in memory with '/ca'
Find wide-char strings with the '/w <string>' command
Control the signal handlers of the child process with the 'dk' command
Get a free shell with 'rz-gg -i exec -x'
Interpret rizin scripts with '. <path-to-script>'. Similar to the bash source alias command.
Most of commands accept '?' as a suffix. Use it to understand how they work :)
Find hexpairs with '/x a0 cc 33'
Step through your seek history with the commands 'u' (undo) and 'U' (redo)
Use zoom.byte=entropy and press 'z' in visual mode to zoom out to see the entropy of the whole file
Use 'zoom.byte=printable' in zoom mode ('z' in Visual mode) to find strings
Add colors to your screen with 'e scr.color=X' where 1 is 16 colors, 2 is 256 colors and 3 is 16M colors
Move the comments to the right changing their margin with asm.cmt.margin
Execute a command on the visual prompt with cmd.vprompt
Reduce the delta where flag resolving by address is used with cfg.delta
Disable these messages with 'e cfg.fortunes=false' in your ~/.rizinrc
Change your fortune types with 'e cfg.fortunes.file=fun,tips' in your ~/.rizinrc
Execute a command every time a breakpoint is hit with 'e cmd.bp=!my-program'
Disassemble in intel syntax with 'e asm.syntax=intel'.
Change the UID of the debugged process with child.uid (requires root)
Enhance your graphs by increasing the size of the block and graph.depth eval variable.
Control the height of the terminal on serial consoles with e scr.height
Use `rizin -B 0x123456 /bin/ls` option to set the base address of a PIE file.
Bindiff two files with '$ rz-diff -H /bin/true /bin/false'
Execute commands on a temporary offset by appending '@ offset' to your command.
Temporally drop the verbosity prefixing the commands with ':'
Change the graph block definition with graph.callblocks, graph.jmpblocks, graph.flagblocks
Use scr.accel to browse the file faster!
Use the 'id' command to see the source line related to the current seek
Analyze socket connections with the socket plugin: 'rizin socket://www.foo.com:80'. Use 'w' to send data
Setup dbg.fpregs to true to visualize the fpu registers in the debugger view.
To debug a program, you can call rizin with 'dbg://<path-to-program>' or '-d <path..>'
Use 'e' and 't' in Visual mode to edit configuration and track flags.
Use 'rz-bin -ris' to get the import/export symbols of any binary.
Remember to maintain your `$(rizin -H RZ_CACHEHOME)/history` file!
Enable the PAGER with 'e scr.pager=less -R'
Use 'e asm.offset=true' to show offsets in 16bit segment addressing mode.
The '%' command can be used to evaluate math expressions. Like this: '% (0x34+22)*4'
Set 'e bin.dbginfo=true' to load debug information at startup.
Rename a function using the 'afr <newname> @ <offset>' command.
You can redefine descriptive commands in the hud file and using the 'V_' command.
Pass '-j' to rz-bin to get the information of the binary in JSON format.
Use rz-run to launch your programs with a predefined environment.
You are probably using an old version of rizin, go checkout the git!
Use '-e bin.strings=false' to disable automatic string search when loading the binary.
The unix-like reverse engineering framework.
This code was intentionally left blank, try 'e asm.arch=ws'
Thanks for using rizin!
give | and > a try piping and redirection
Run .dmm* to load the flags of the symbols of all modules loaded in the debugger
Use V! to enter into the visual panels mode (dwm style)
Toggle between disasm and graph with the space key
The more 'a' you add after 'aa' the more analysis steps are executed.
Review all the subcommands of aa to see better ways to analyze your targets.
Use /m to carve for known magic headers. speedup with search.
You can use registers in math expressions. For example: 'wx 1234 @ esp - 2'
For HTTP authentication 'e http.auth=1', 'e http.authfile=<path>'
Save your project in compressed format with 'e prj.compress=true'
Use 'avg?' to know how you can use global variables in rizin
