R_FS(3)

💖 R_FS(3) — the radare2 filesystem library, bestie edition 💖

okay so. hi. you're here because you opened the Library Functions Manual page for r_fs, and honestly? slay. this is the radare2 filesystem library and it's lowkey the backbone of everything filesystem-y in r2. let's get into it, no cap. 🦋

---

✨ NAME ✨

r_fs — the radare2 filesystem library 💅

---

🌸 SYNOPSIS 🌸

#include <r_fs.h>

that's it. that's the whole vibe. include the header and you're in. 🫶

---

🎀 DESCRIPTION 🎀

So the r_fs library gives radare2 filesystem support — like, actual filesystem support — so you can analyse and manipulate a whole bunch of different filesystem types while they're sitting inside binary images. It does mounting, reading, writing, and navigating filesystems that are embedded in disk images or memory dumps. All of it. Obsessed. ✨

The typical usage in the radare2 core is: you allocate a filesystem context, an RFS * fs, using r_fs_new(void). Then you mount a filesystem with r_fs_mount(RFS *fs, const char *fstype, const char *path, ut64 delta). And then — main character energy — commands in the core can list directories, open files, and read their contents through one unified API. Iconic.

The core keeps a reference to the returned RFS context (peep libr/core/core.c), and calls r_fs_free(RFS *fs) when it's tearing everything down. Cleanup era. 🧹

The core structure here is RFS, and it manages plugins, mounted roots, and binds I/O and console operations. Go look at libr/include/r_fs.h for the fields and types, iykyk. 👑

---

⭐ INITIALIZATION ⭐

RFS * r_fs_new(void)

Creates a brand new filesystem context, with the built-in plugins already loaded. Fresh out the box. 🎁

void r_fs_free(RFS *fs)

Frees all the resources associated with that filesystem context. Say bye bestie. 👋

---

🌈 MOUNTING 🌈

RFSRoot * r_fs_mount(RFS *fs, const char *fstype, const char *path, ut64 delta)

Attaches a filesystem implementation (aka a plugin) to a virtual mount point. The delta argument is the one you use constantly — it's commonly used when the filesystem is found at an offset inside a disk image or memory buffer. In the radare2 core this is typically invoked like:

RFS *fs = r_fs_new();
RFSRoot *root = r_fs_mount (fs, "auto", "/root", core->addr /* offset */);

bool r_fs_umount(RFS *fs, const char *path)

Unmounts the filesystem sitting at the specified path. (yes it's spelled umount, that's a Unix thing, we don't make the rules 💀)

---

🦋 FILE OPERATIONS 🦋

RFSFile * r_fs_open(RFS *fs, const char *path, bool create)

Opens a file relative to the mounted roots. Heads up: when multiple roots match the path, the first matching root is used. Callers in the core often do:

RFSFile *f = r_fs_open (core->fs, "/some/path", false);
if (f) {
    r_fs_read (core->fs, f, 0, f->size);
    r_fs_close (core->fs, f);
}

void r_fs_close(RFS *fs, RFSFile *file)

Closes an open file handle. 🫡

int r_fs_read(RFS *fs, RFSFile *file, ut64 addr, int len)

Reads data from a file at the specified offset.

int r_fs_write(RFS *fs, RFSFile *file, ut64 addr, const ut8 *data, int len)

Writes data to a file at the specified offset. (yes, you can write. we're not just looking. 💅)

---

🍓 DIRECTORY OPERATIONS 🍓

RList * r_fs_dir(RFS *fs, const char *path)

Returns an RList of RFSFile objects for the given virtual directory. The core uses this to implement the md command and directory listings. For example:

RList *files = r_fs_dir (core->fs, "/");
// iterate and inspect file->name, file->size, file->type

bool r_fs_dir_dump(RFS *fs, const char *path, const char *name)

Dumps the contents of a directory to disk. 📦

---

🧚 FILE SLURPING 🧚

RFSFile * r_fs_slurp(RFS *fs, const char *path)

A lil convenience helper that opens a file and reads it fully into memory, returning an RFSFile whose data and size fields are populated. Super useful when some consumer (analysis, dumping, whatever) just wants one single buffer. One call, whole file, slay. 🥤

---

🔥 SEARCHING 🔥

RList * r_fs_find_name(RFS *fs, const char *name, const char *glob)

Finds files by name using glob patterns. *.so girlies rise. 🌟

RList * r_fs_find_off(RFS *fs, const char *name, ut64 off)

Finds files containing data at a specific offset.

---

👑 PARTITIONS 👑

RList * r_fs_partitions(RFS *fs, const char *ptype, ut64 delta)

Enumerates partitions, either using the built-in partition detectors or a specific partition type. The returned list holds RFSPartition entries describing start and length. Callers often use this to discover filesystems inside disk images before mounting them. Detective work fr fr. 🔍

---

💜 PLUGINS 💜

bool r_fs_plugin_add(RFS *fs, RFSPlugin *p)

Adds a filesystem plugin to the context.

bool r_fs_plugin_remove(RFS *fs, RFSPlugin *p)

Removes a filesystem plugin from the context.

---

🌸 SHELL 🌸

bool r_fs_shell(RFSShell *shell, RFS *fs, const char *root)

Starts an interactive filesystem shell. Get in there and poke around. 🐚

---

🌟 FILE TYPES 🌟

const RFSType * r_fs_type_index(int i)

Retrieves filesystem type information by index.

---

🎀 EXAMPLES 🎀

Common patterns used by the radare2 core and plugins:

// create and mount a filesystem at a given offset
RFS *fs = r_fs_new();
RFSRoot *root = r_fs_mount (fs, "fat", "/mnt/fat", 0x1000);

// open, read full contents and close
RFSFile *file = r_fs_open (fs, "/README.txt", false);
if (file) {
    r_fs_read (fs, file, 0, file->size);
    r_fs_close (fs, file);
}

// list a directory
RList *files = r_fs_dir (fs, "/");

// slurp a file into memory (single call)
RFSFile *s = r_fs_slurp (fs, "/config.bin");
if (s) {
    // use s->data and s->size
    r_fs_file_free (s);
}

// find files by name or containing an offset
RList *matches = r_fs_find_name (fs, "/", "*.so");
RList *byoff = r_fs_find_off (fs, "/", 0x2000);

---

💫 SEE ALSO 💫

r_io(3), r_core(3)

go read those too bestie, they're the whole ecosystem 🫶

---

ngl that's the whole page. mount responsibly. 🎀

and that's a wrap! this one came from the Debian crew, dated September 20, 2025 — R_FS(3), Library Functions Manual, Debian edition. mwah. 💋