6

What is radare2's equivalent to GDB's find &system,+9999999,"/bin/sh"?

8

First and foremost we should open the binary in debug mode with radare2

$ r2 -d file

The string /bin/sh resides in the system function of libc so the library should first be loaded to the memory in order for us to find the string there. Let's continue the execution of the program until its Entrypoint. In this point libc should already be loaded to the memory.

[0xf7f9bc60]> dcu entry0
Continue until 0x565914a0 using 1 bpsize
hit breakpoint at: 565914a0
[0x565914a0]> 

dcu stands for debug continue until

To find /bin/sh we should use radare’s search features. By default radare is searching in dbg.map which is the current memory map. In our case it's not guaranteed that /bin/sh will be in our current memory map. Therefore, we want it to search in all memory maps so we need to configure it:

[0x080483d0]> e search.in = dbg.maps

You can view more options if you’ll execute e search.in=?. To configure radare the visual way, use Ve.

Searching in radare is done with the / command, you can see the enormous amount of search options by executing /?.

Let's search for /bin/sh:

[0x565914a0]> / /bin/sh
Searching 7 bytes from 0x00000000 to 0xffffffffffffffff: 2f 62 69 6e 2f 73 68 
Searching 7 bytes in [0x56591000-0x56592000]
hits: 1

<..truncated..>

Searching 7 bytes in [0xf7d97000-0xf7f66000]
hits: 1

0xf7f1180a hit1_2 .b/strtod_l.c-c/bin/shexit 0canonica.

Et Voilà! radare found the string in 0xf7f1180a.

To speed things up we can tell radare to start searching from system which is inside libc. First we need the address of system in libc, we can do this with dmi and then configure search.from to start from system.

[0x565914a0]> dmi libc system
vaddr=0xf7dd3700 paddr=0x0003c700 ord=566 fwd=NONE sz=1126 bind=LOCAL type=FUNC name=do_system
vaddr=0xf7ebf470 paddr=0x00128470 ord=4988 fwd=NONE sz=102 bind=LOCAL type=FUNC name=svcerr_systemerr
vaddr=0xf7dd3c50 paddr=0x0003cc50 ord=6919 fwd=NONE sz=55 bind=WEAK type=FUNC name=system

[0x565914a0]> e search.from=0xf7dd3c50
[0x565914a0]> / /bin/sh
Searching 7 bytes from 0xf7dd3c50 to 0xffffffffffffffff: 2f 62 69 6e 2f 73 68 
Searching 7 bytes in [0xf7dd3c50-0xf7f66000]
hits: 1

<..truncated..>

0xf7f1180a hit2_0 .b/strtod_l.c-c/bin/shexit 0canonica.

There you go! Now you can print the string using ps @ 0xf7f1180a or use the address however you want.

2

Thanks to David Polverari from radare @ Telegram

While in debug mode:

e search.in=range
e search.from=<start_addr>
e search.to=<end_addr>

"/ /bin/sh"

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.