Could anyone tell me the basic steps and most used radare2 commands for debugging a hang x86 application to find the source of the hang?
I know this question may sound a bit broad but I don't know where to learn this better than here.
Add a comment
|
1 Answer
You just have to attach to the hanging process as follow:
$ pidof myhangingprocess
32220
$ r2 -d 32220
And, that should start a radare2 session on the program you are inspecting. But, for debugging, I would greatly prefer to use gdb (radare2 is a good tool for reverse-engineering but not really for debugging).
-
Hi perror sorry the late response. May you explain why radare2 isn't good for debugging? Thanks. Commented Oct 23, 2017 at 17:15
-
Compared to a real debugger such as
gdb, it lacks some useful features like the representation of the stack-frame or watchpoints or tracepoint, and so on. But, this is "normal" as the goal of radare2 is to be a reverse-engineering tool and not a debugger.– perrorCommented Oct 23, 2017 at 23:02 -
Hum I see, thanks for the answer. BTW do you know why some people prefer radare2 instead of IDA for reversing? I'm trying to figure out this for a while but just can't find a good reason. IDA seems very complete to me, but there is still people that seem to hate ida. Commented Oct 27, 2017 at 10:43
-
I do not think they really "hate" IDA, I think that IDA and Radare2 have a different way of thinking. IDA is GUI-oriented and Radare2 is CLI-oriented. Both have advantages and drawbacks, but the fact you prefer one or the other is more a matter of taste.– perrorCommented Oct 27, 2017 at 11:16
-
I see. May you tell some examples of such drawbacks? I mean, I see the taste point of view but I can't see where exactly IDA and r2 fail from each other. Thank you very much for the patience though, I know these kind of question may sound a bit cheesy for some, very appreciate your help! Commented Oct 28, 2017 at 21:10