Debugging with radare2 using two terminals

Question

I have been trying to figure this out for quite some time now, and would really need some help. Firstly, some intro:

I am running the newest version of radare2 from Github on a 64bit Ubuntu 16.04 and have the following sample program r2_test.cpp:

#include <cstdio>

int main(int argc, char* argv[])
{
    int num;

    while (1)
    {
        printf("Enter a number: ");
        scanf("%d", &num);
        printf("You entered: %d\n", num);
    }

    return 0;
}

What I am trying to achieve is to debug this program using radare2 and two terminals in a way that I run radare2 in terminal window T1 and have the programs input/output in terminal window T2. After some research I figured that this should probably be done with the help of rarun2 tool.

So, for my first try I read the man page for rarun2, specifically the part with redirecting IO to another terminal and after identifying the T2 terminal as /dev/pts/17 I created the following test.rr2 file:

#!/usr/bin/rarun2
stdio=/dev/pts/17

In T2 terminal I've then run sleep 999999 and in terminal T1 I run r2 -R test.rr2 -d a.out and when executing the command dc inside radare2, the programs input/output is in terminal T1 which is not what I wanted. I've also tried variations like making test.rr2 equal

#!/usr/bin/rarun2
stdin=/dev/pts/17
stdout=/dev/pts/17

or

#!/usr/bin/rarun2
stdio=/dev/pts/17
stdin=/dev/pts/17
stdout=/dev/pts/17

but the result was always the same.

For my second try, after some research and reading, I tried running the radare2 in the following way: r2 -d rarun2 program=a.out stdio=/dev/pts/17. With this I've achieved redirecting the IO to terminal T2, but the process which gets debugged inside radare2 is the rarun2 tool and since my knowledge of Linux and reverse engineering on it is not that good, I don't really know how to proceed to debugging the a.out process.

So, to summarize, I would really appreciate if someone could share here if this kind of debugging can be done with radare2 and, if it can, how to achieve it? I've also tried it with using nc, but I haven't made any progress to this topic with it.

Answer 1

It is actually very simple and works for me just fine as you can see in the following gif:

---

First you need to figure out the tty of the terminal you want to redirect the STDIO to (a.k.a Terminal 2, T2). You can do this by simply execute:

$ tty
/dev/pts/2

This tty will soon be used on the rarun2 profile file. Meantime, let's put T2 to sleep by using sleep 999999.

Moving to Terminal 1, let's create a simple rarun2 profile with the following content:

#!/usr/bin/rarun2
stdio=/dev/pts/2

We configured stdio to transfer the standard input and output to T2. Now let's execute our program with the profile we've just created:

$ r2 -e dbg.profile=profile.rr2 -d a.out  
Process with PID 14074 started...
= attach 14074 14074
bin.baddr 0x00400000
Using 0x400000
Assuming filepath /tmp/re/a.out
asm.bits 64
 -- Mind that the 'g' in radare is silent
[0x7f9654e0fd80]>

(The same can be done using: r2 -r profile.rr2 -d a.out)
The program successfully loaded in debug mode. Now just for the example, let's put a breakpoint on the second call to printf and start the program using dc. In the gif I was not creating a breakpoint.

[0x7f9654e0fd80]> db 0x00400580
[0x7f9654e0fd80]> dc
Selecting and continuing: 14074

Now T2 gives us the output and asks for our input:

Enter a number:

After we send it a digit our breakpoint on T1 hit:

hit breakpoint at: 400580
[0x00400580]>

We can now continue the execution using dc, the loop would continue forever and the Standard Input and Output will be in T2.