# 3.5.6 Print memory

It is possible to print various packed data types in a single line using the 'pm' command (print memory). Here's the help and some examples:

    [0x4A13B8C0]> pm
    Usage: pm [times][format] [arg0 arg1]
    Example: pm 10xdz pointer length string
    Example: pm {array_size}b @ array_base
    Example: pm x[foo]b @ esp
     e - little endian
     E - big endian
     f - float value
     b - one byte
     B - show 10 first bytes of buffer
     d - %d integer value (4 bytes)
     D - double value (4 bytes)
     q - quadword (8 bytes)
     x - 0x%08x hexadecimal value
     X - 0x%08x hexadecimal value and flag (fd @ addr)
     z - \0 terminated string
     Z - \0 terminated wide string
     s - pointer to string
     t - unix timestamp string
     * - next char is pointer
     . - skip 1 byte
     : - skip 4 bytes
     {}- used to eval math expressions to repeat next fmt char
     []- used to nest format structures registered with 'am'
     %1,%2,%4,%8 - type size (default is asm.bits/8)
    NOTE: Use 'am' command to register inner structs

The simple use would be like this:

    [0xB7F08810]> pm xxs @ esp
    0xbf8614d4 = 0xb7f22ff4
    0xbf8614d8 = 0xb7f16818
    0xbf8614dc = 0xbf8614dc -> 0x00000000 /etc/ld.so.cache

This is sometimes useful for looking at the arguments passed to a function, by just giving the 'format memory string' as argument and temporally changing the current seek with the '@' token.

It is also possible to define arrays of structures with 'pm'. Just prefix the format string with a numeric value.

You can also define a name for each field of the structure by giving them as optional arguments after the format string splitted by spaces.

    [0x4A13B8C0]> pm 2xw pointer type @ esp
    0xbf87d160 [0] {
       pointer : 0xbf87d160 = 0x00000001
          type : 0xbf87d164 = 0xd9f3
    }
    0xbf87d164 [1] {
       pointer : 0xbf87d164 = 0xbf87d9f3
          type : 0xbf87d168 = 0x0000
    }

If you want to store this information as metadata for the binary file just use the same arguments, but instead of using `pm`, use `Cm`. To store all the metadata stored while analyzing use the 'Ps <filename>' command to save the project and then run `radare -p project-file` to restore the session. Read 'projects' section for more information.

A practical example for using pm on a binary GStreamer plugin:

    $ radare ~/.gstreamer-0.10/plugins/libgstflumms.so
    [0x000028A0]> seek sym.gst_plugin_desc
    [0x000185E0]> pm iissxsssss major minor name desc _init version \
     license source package origin
         major : 0x000185e0 = 0
         minor : 0x000185e4 = 10
          name : 0x000185e8 = 0x000185e8 flumms
          desc : 0x000185ec = 0x000185ec Fluendo MMS source
         _init : 0x000185f0 = 0x00002940
       version : 0x000185f4 = 0x000185f4 0.10.15.1
       license : 0x000185f8 = 0x000185f8 unknown
        source : 0x000185fc = 0x000185fc gst-fluendo-mms
       package : 0x00018600 = 0x00018600 Fluendo MMS source
        origin : 0x00018604 = 0x00018604 http://www.fluendo.com