data

name	data
description	Query radare2 data and memory — bytes, defined data, byte patterns, assembling/demangling a mnemonic or symbol name, strings, imports, entry points, relocations, linked libraries, and binary metadata — via r2xsql.
allowed-tools	["Bash","Read"]

When to use

Pick this skill for non-code facts about the binary:

• printable strings the binary embeds (strings)
• mapped bytes and initialization state, or overwriting one byte directly (bytes)
• defined data symbols/strings (data_items)
• byte-pattern matches (byte_search)
• encoding an assembly mnemonic to bytes (assemble), or finding where an assembled instruction occurs in the binary (search_asm)
• demangling a C++/Rust/Swift/MSVC symbol name (demangle)
• reading a null-terminated string at an ARBITRARY address, not just an address strings' own detection heuristics flagged (read_cstr)
• staging, committing, or undoing a revertible raw hex byte patch, either from raw hex or an assembly mnemonic (patches)
• functions the binary imports from other libraries (imports)
• loader entry points and functions/symbols the binary exports (entries)
• the binary's relocation table (relocs)
• the binary's linked/imported library list (libs)
• top-level binary metadata: arch, bits, bintype, OS, … (binary)
• type definitions and members loaded by r2 (types, types_members — see the connect schema-catalog reference for the full column list)

For code structure (functions/blocks/instructions) use disassembly. For cross-references between code and data, use xrefs.

Tables

table	source	columns
bytes	omj + p8 + iSj	addr, value, is_initialized — writable (value only)
data_items	isj + izj	addr, name, data_type, size, value_repr, segment_name, is_string, is_initialized
byte_search	/xj + p8	addr, matched_hex, matched_bytes, size; hidden pattern/bounds
assemble	pa	hex, bytes, size, error; hidden asm (required), addr
search_asm	/a	addr, matched_hex; hidden asm (required), max_results
demangle	iD/iDj	demangled, error; hidden mangled (required), lang (optional)
read_cstr	pszj	content, length, section, type, truncated, error; hidden addr (required), max_len (optional, default 128)
patches

Common queries

-- find every string containing "password" (case-insensitive)
SELECT addr, content FROM strings WHERE content LIKE '%password%';

-- ...and where to patch it on disk: addr is the VIRTUAL address, paddr the
-- file offset. They differ by the image base, so do not use one for the other.
SELECT printf('0x%x', addr) AS vaddr, paddr, content
FROM strings WHERE content LIKE '%password%';

-- binary type / arch / bits at a glance
SELECT key, value FROM binary
WHERE key IN ('bintype','arch','bits','os','class','endian');

-- imports grouped by library
SELECT module, COUNT(*) AS n
FROM imports
GROUP BY module ORDER BY n DESC;

-- crypto API surface
SELECT name, module FROM imports
WHERE name LIKE 'Crypt%' OR name LIKE '%AES%'
    name     name  ;


 name,   imports
   (,,,);


 name, addr, type  entries   name;


 name  libs   name;


 printf(, addr)  , name, type  relocs  name  ;


 addr,   bytes
 addr    addr    is_initialized  ;


 bytes      addr  ;


 addr, matched_hex  byte_search
     max_results  ;






 addr, matched_hex, size  byte_search
     max_results  ;




 hex, size  assemble  asm  ;
 hex  assemble  asm    addr  ;


 printf(, addr)  , matched_hex  search_asm
 asm    max_results  ;



 demangled  demangle  mangled  ;
 demangled, error  demangle  mangled    lang  ;




 content, length  read_cstr  addr  ;
 content, truncated  read_cstr  addr    max_len  ;



 name, namespace  names  addr  ;  
 name  sections                                     
 start_addr    end_addr  ;
 content  strings  addr  ;         


 addr, length, type, content
 strings   length  LIMIT ;


 patches(addr, patched_bytes)  (, );
 patches  committed    addr  ;


 addr, patched_bytes  patches  committed  ;




 patches(addr, asm_text)  (, );
 patches  committed    addr  ;

Bootstrap recipe

SELECT key, value FROM binary ORDER BY key;

binary includes the raw iIj keys plus the func_count, string_count, import_count, section_count quick-counts r2xsql computes at session start, plus radare2_version (the LIVE running engine's own version from ?Vj — distinct from r2xsql_version/tool_version, which are r2xsql's own build-time identity). A db_info-style key/value metadata summary needs no dedicated table: binary plus bininfo already carry every field it would have, and every *_count is just SELECT COUNT(*) FROM <table>.

Performance

strings, imports, and entries all read straight from radare2's in-process binary state on the in-process build (r_bin_get_strings, RBinImport, RBinAddr/RBinSymbol respectively) instead of running izj/iij/iej+iEj and parsing the JSON — identical rows either way, including imports.name's demangling and entries.name staying the ORIGINAL (never demangled) name on both build flavors. None of these three needs an analysis pass: they read the loaded binary's own metadata.

relocs/libs are each already ONE full-scan command (irj/ilj) with no per-function/per-address loop to collapse, so both stay command-path-only on every build flavor — no C-API producer exists or is needed. Neither needs an analysis pass either: both read the loaded binary's own bin-info directly.

Caveats

• strings.type distinguishes ascii, utf16le, utf8, … — filter on it if you only want printable ASCII.
• imports.addr is the IAT slot, not the resolved external. Use the xrefs skill to find code that calls through that slot.
• entries combines loader entry points and exports; executables can therefore have rows even when they export no symbols.
• bytes.value is NULL for uninitialized or unreadable mapped bytes.
• UPDATE bytes SET value = X WHERE addr = Y is a direct, immediate, permanent one-byte overwrite (wx) — this is NOT the same mechanism as patches. It bypasses io.cache entirely (disabling it for the write, then restoring whatever it was before, even mid-flight around an unrelated patches row) so it can never be staged, undone, or interfere with a patches entry. There is no undo; use patches instead if you want a revertible change. value must be 0-255 (rejected otherwise before any command runs), and only a currently-initialized address can be written — a BSS/unbacked address is refused up front. No INSERT/DELETE; addr/ is_initialized stay read-only.
• relocs has no addend column: the underlying C struct carries one, but radare2's own irj never emits it as a JSON field, so there is nothing for this table to read it from.
• relocs.name/demname/sym_vaddr are each independently nullable — sym_vaddr is populated only when the relocation resolves through a genuine symbol rather than an import.
• libs is a single-column table (name) — ilj carries no ordinal, load-order index, or resolved path to surface.
• patches accepts EITHER raw hex (patched_bytes) OR an assembly mnemonic (asm_text, assembled via the same mechanism as the assemble table) on INSERT — exactly one of the two, never both, never neither. asm_text itself is write-only: it is never stored or read back, so SELECT asm_text FROM patches always reads empty, even for the row it just created.