2

Could anyone tell me the basic steps and most used radare2 commands for debugging a hang x86 application to find the source of the hang?

I know this question may sound a bit broad but I don't know where to learn this better than here.

1

You just have to attach to the hanging process as follow:

$ pidof myhangingprocess
32220
$ r2 -d 32220

And, that should start a radare2 session on the program you are inspecting. But, for debugging, I would greatly prefer to use gdb (radare2 is a good tool for reverse-engineering but not really for debugging).

| improve this answer | |
  • Hi perror sorry the late response. May you explain why radare2 isn't good for debugging? Thanks. – underthevoid Oct 23 '17 at 17:15
  • Compared to a real debugger such as gdb, it lacks some useful features like the representation of the stack-frame or watchpoints or tracepoint, and so on. But, this is "normal" as the goal of radare2 is to be a reverse-engineering tool and not a debugger. – perror Oct 23 '17 at 23:02
  • Hum I see, thanks for the answer. BTW do you know why some people prefer radare2 instead of IDA for reversing? I'm trying to figure out this for a while but just can't find a good reason. IDA seems very complete to me, but there is still people that seem to hate ida. – underthevoid Oct 27 '17 at 10:43
  • I do not think they really "hate" IDA, I think that IDA and Radare2 have a different way of thinking. IDA is GUI-oriented and Radare2 is CLI-oriented. Both have advantages and drawbacks, but the fact you prefer one or the other is more a matter of taste. – perror Oct 27 '17 at 11:16
  • I see. May you tell some examples of such drawbacks? I mean, I see the taste point of view but I can't see where exactly IDA and r2 fail from each other. Thank you very much for the patience though, I know these kind of question may sound a bit cheesy for some, very appreciate your help! – underthevoid Oct 28 '17 at 21:10

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.