2

I was using radare2 (2.2.0) with r2pipe (0.9.5) for python3 to debug the code generated by:

#include <stdio.h>

int main(){
    char entrada[14];
    gets(entrada);
    puts(entrada);
    return 0;
}

Disassembling the main function with radare2 outputs:

0x00400546      55             pushq %rbp
0x00400547      4889e5         movq %rsp, %rbp
0x0040054a      4883ec10       subq $0x10, %rsp
0x0040054e      488d45f0       leaq local_10h, %rax
0x00400552      4889c7         movq %rax, %rdi
0x00400555      b800000000     movl $0, %eax
0x0040055a      e8e1feffff     callq sym.imp.gets          ; char*gets(char *s)
0x0040055f      488d45f0       leaq local_10h, %rax
0x00400563      4889c7         movq %rax, %rdi
0x00400566      e8c5feffff     callq sym.imp.puts          ; int puts(const char *s)
0x0040056b      b800000000     movl $0, %eax
0x00400570      c9             leave
0x00400571      c3             retq

However, when debugging this program with python using this script

import r2pipe as r2
prog = r2.open("./a.out")

prog.cmd("aaa")
prog.cmd("doo")

prog.cmd("db 0x0040055f") #Breakpoint after 'gets' call

prog.cmd("dc")
prog.cmd("dc")

the execution stucks in the "gets" call, no matter which input I use. The same sequence of commands works fine with the radare2's CLI. I also tried using dor stdin=input.txt before doo which, despite the fact it works, it isn't convenient to write files to the disk, and for some uses, is not possible to determine the needed input before the execution.

What is the best way to use stdin with r2pipe?

1 Answer 1

4

Just use i.e. pseudo-terminal as file in the command. I usually create rarun2 file

#!/usr/bin/rarun2
stdin=/dev/pts/20

And in the r2pipe script I run

r2.cmd('e dbg.profile=re2.rr2')

to configure usage of this script by r2 debug session.

Then, on one terminal you run your r2pipe and on the other (the one that is /dev/pts/20) you type

echo "<input>" > /dev/pts/20
4
  • Didn't work for me. After the gets call, the terminal used as stdin (mine was /dev/pts/3) becomes nearly unresponsive, and running echo "<input>" > /dev/pts/3 in both /dev/pts/3 or any other terminal does prints the <input> to that /dev/pts/3 terminal, but it isn't passed to process that is being debugged. I think i set the stdin correctly though, because prog.cmd("dd") returns 0 0x0 r-C /dev/pts/3 1 0x0 r-P pipe:[254433] 2 0x0 r-C /dev/pts/1.
    – danielbb
    Dec 20, 2017 at 14:03
  • I'll try again later with a pty unlinked to a terminal, and i'll verify if i'm passing the newline character correctly. Thanks for the response :)
    – danielbb
    Dec 20, 2017 at 14:09
  • 1
    I don't fully understand why, but using openpty worked for me. Thanks again
    – danielbb
    Dec 20, 2017 at 15:14
  • @danielbb If it works then please mark this as an answer Dec 20, 2017 at 15:18

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.