The 'av' command have single line, memory and file input commands to evaluate expressions.
Here's a simple example of an evaluation of a virtual machine expression
[0x4A13B8C0]> "ave eax=33 ; evalueate expression
; eax=33
[0x4A13B8C0]> avr eax ; show eax register value
eax = 0x00000021
The prefix '"' in the 'ave' command allows us to write special characters on the string without being interpreted by radare. These characters are '|', '>', ...
If you write a set of expressions splitted by commands and newlines in a file they can be evaluated with the 'avf' command:
[0x4A13B8C0]> avf script.ravm
But maybe, the more interesting source of code evaluation is to evaluate real code. You can achieve this with the 'avx' command. This command makes the disassembler output be parsed by some pas rules that convert the real code into evaluable expressions for the virtual machine. Here's an example:
[0x4A13B8C0]> avx 10
Emulating 10 opcodes
MMU: cached
Importing register values
0x4a13b8c0, eip:
0x4a13b8c0, eax = esp
; eax = esp
0x4a13b8c2 call 0x4a13c000
; esp=esp-4
; [esp]=eip+5
;==> [0xbfeb4fac] = 4a13b8cc ((esp]))
; write 4a13b8cc @ 0xbfeb4fac
; eip=0x4a13c000
0x4a13c000, push ebp
; esp=esp-4
; [esp]=ebp
;==> [0xbfeb4fa8] = 0 ((esp]))
; write 0 @ 0xbfeb4fa8
0x4a13c001 ebp = esp
; ebp = esp
0x4a13c003 push edi
; esp=esp-4
; [esp]=edi
;==> [0xbfeb4fa4] = 0 ((esp]))
; write 0 @ 0xbfeb4fa4
0x4a13c004, push esi
; esp=esp-4
; [esp]=esi
;==> [0xbfeb4fa0] = 0 ((esp]))
; write 0 @ 0xbfeb4fa0
0x4a13c005 push ebx
; esp=esp-4
; [esp]=ebx
;==> [0xbfeb4f9c] = 0 ((esp]))
; write 0 @ 0xbfeb4f9c
0x4a13c006 esp -= 0x40
; esp -= 0x40
0x4a13c009 call 0x4a1508cb
; esp=esp-4
; [esp]=eip+5
;==> [0xbfeb4f98] = 4a13c013 ((esp]))
; write 4a13c013 @ 0xbfeb4f98
; eip=0x4a1508cb
0x4a1508cb ebx = [esp]
; ebx = [esp]
and now review the registers again:
[0x4A13B8C0]> avr
.int32 eax = 0xbfeb4fb0
.int16 ax = 0x00004fb0
.int8 al = 0x000000b0
.int8 ah = 0x0000004f
.int32 ebx = 0x4a13c013
.int32 ecx = 0x00000000
.int32 edx = 0x00000000
.int32 esi = 0x00000000
.int32 edi = 0x00000000
.int32 eip = 0x4a1508ce
.int32 esp = 0xbfeb4f98
.int32 ebp = 0xbfeb4fa8
.bit zf = 0x00000000
.bit cf = 0x00000000