I am struggling with a stripped binary, and I would like to visualize the main()
function with the VVV
command (ascii-art CFG representation).
Usually, the steps are the following:
#> r2 ./crackme
(run radare2 on the crackme).[0x00005430]> aaa
(start the analysis of the binary).s main
(seek to the address ofmain
).VVV
(switch to the CFG view of the binary).
Unfortunately, my crackme is stripped (including the main()
function). I can see the address of the main()
function thanks to the first argument of the __libc_start_main()
function. But, I always end-up with the following error message:
Not in a function. Type 'df' to define it here
--press any key--
How can I work around this problem. For example, I first tried to add my own symbols on the binary to mark the start of the main()
function, but I miserably failed... Any idea ?
EDIT
Here is my attempt to add a flag to the binary:
#> r2 ./ch23.bin
[0x000083b8]> aaa
[x] Analyze all flags starting with sym. and entry0 (aa)
[ ]
[aav: using from to 0x8000 0x8e64
Using vmin 0x8000 and vmax 0x10880
aav: using from to 0x8000 0x8e64
Using vmin 0x8000 and vmax 0x10880
[x] Analyze len bytes of instructions for references (aar)
[x] Analyze function calls (aac)
[ ] [*] Use -AA or aaaa to perform additional experimental analysis.
[x] Constructing a function name for fcn.* and sym.func.* functions (aan))
[0x000083b8]> pdf
;-- section_end..plt:
;-- section..text:
/ (fcn) entry0 44
| entry0 ();
| ; UNKNOWN XREF from 0x00008018 (unk)
| ; UNKNOWN XREF from 0x00008c18 (unk)
| 0x000083b8 00b0a0e3 mov fp, 0 ; [14] va=0x000083b8 pa=0x000003b8 sz=800 vsz=800 rwx=--r-x .text
| 0x000083bc 00e0a0e3 mov lr, 0
| 0x000083c0 04109de4 pop {r1}
| 0x000083c4 0d20a0e1 mov r2, sp
| 0x000083c8 04202de5 str r2, [sp, -4]!
| 0x000083cc 04002de5 str r0, [sp, -4]!
| 0x000083d0 10c09fe5 ldr ip, [0x000083e8] ; [0x83e8:4]=0x8664
| 0x000083d4 04c02de5 str ip, [sp, -4]!
| 0x000083d8 0c009fe5 ldr r0, [0x000083ec] ; [0x83ec:4]=0x8470
| 0x000083dc 0c309fe5 ldr r3, [0x000083f0] ; [0x83f0:4]=0x8668
\ 0x000083e0 e5ffffeb bl sym.imp.__libc_start_main; int __libc_start_main(func main, int argc, char **ubp_av, func init, func fini, func rtld_fini, void *stack_end);
[0x000083b8]> f main @ 0x8470
[0x000083b8]> s main
[0x00008470]> VVV
... miserable fail ...