As the question says I need to reverse a stripped elf binary with radare2. This binary is also statically linked. I already reversed it in IDA by identifying statically linked libraries using lscan and importing the .sig files provided by lscan into IDA in order to resolve function names.
I don't know how to import these files to radare2. Also I don't know if the same solution applies to radare2.
Seems like lscan is written to work with IDA. However, lscan is based on FLIRT signature files which can be also read by radare2 (See the Zignatures section of this answer). There are several things you can do with radare2 to achieve similar results:
You can easily import IDC and IDB files from IDA to radare2 using a simple scripts which exists in radare2ida repository.
This repository contains a collection of documents, scripts and utilities that will allow you to use IDA and R2, converting projects metadata from one tool to the other and providing tools to integrate them in a more useful way.
Export from IDA
To export IDA database to IDC file click on File >> Produce file >> Dump databse to IDC file...
To save the current databse as an IDB file click File >> Take database snapshot... or use the shortcut Ctrl+Shift+W
Import to Radare2
To import the IDC metadata to radare2 use idc2r.py which shipped with radare2ida:
idc2r.py file.idc > file.r2
The command reads an IDC file exported from an IDA Pro database and produces an r2 script containing the same comments, names of functions etc. You can import the resulting file.r2 by using the dot . command of radare:
[0x00000000]> . file.r2
The . command is used to interpret radare commands from external sources, including files and program output. For example, to omit generation of an intermediate file and import the script directly you can use this combination:
[0x00000000]> .!idc2r.py < file.idc
radare2 has its own format of the signatures called Zignatures, allowing to both load/apply and create signatures on the fly. They are available under the z command namespace:
[0x00000000]> z?
|Usage: z[*j-aof/cs] [args] # Manage zignatures
| z show zignatures
| z* show zignatures in radare format
| zj show zignatures in json format
| z-zignature delete zignature
| z-* delete all zignatures
| za[?] add zignature
| zo[?] manage zignature files
| zf[?] manage FLIRT signatures
| z/[?] search zignatures
| zc check zignatures at address
| zs[?] manage zignspaces
The zf subcommands can be handy whenever you deal with FLIRT signatures. Therefore you can import FLIRT signatures from a file:
[0x00000000]> zf?
|Usage: zf[dsz] filename # Manage FLIRT signatures
| zfd filename open FLIRT file and dump
| zfs filename open FLIRT file and scan
| zfz filename open FLIRT file and get sig commands (zfz flirt_file > zignatures.sig)
Regardless of FLIRT, you can also use zos [filename] from radare2 to dump signatures to a sdb file and zo [filename] to load it.
As similar to list command of dgb, radare allows you to print lines from a source code file. Here's an example:
$ gcc -m32 -g megabeets.c -o megabeets.bin
$ r2 megabeets.bin
[0x08048420]> aa
[x] Analyze all flags starting with sym. and entry0 (aa)
[0x08048420]> s main
[0x080486cd]> CL
file .//megabeets.c
line 36
022
023 int main(int argc, char *argv[])
> 024 {
025 char *input;
026 puts("Megabeets\n");
The
Ccommand is used to manage comments and data conversions. You can define a range of program's bytes to be interpreted as either code, binary data or string. It is also possible to execute external code at every specified flag location in order to fetch some metadata, such as a comment, from an external file or database.
To know more I recommend you to read: