When we have many binaries, there is a python base solution for disassemble and extract opcodes from binaries in IDA program. Is there any or similar solution to disassemble binaries for Radare2?
10
-
use r2pipe? but what output do you expect to get?– Paweł ŁukasikCommented Jan 30, 2018 at 13:51
-
I want disassembled opcodes of binaries. How can I use r2pipe?– hamid darabianCommented Jan 30, 2018 at 14:07
-
1'pd N' and you can specify as N whatever number you want and it will disassemble N instructions– Paweł ŁukasikCommented Jan 30, 2018 at 15:47
-
1I suggest you to read the radare2 book, it will teach you the basics.– MegabeetsCommented Jan 30, 2018 at 17:09
-
1Are you sure you want to disassemble "the whole file"?– JongwareCommented Jan 30, 2018 at 19:02
|
Show 5 more comments
2 Answers
Radare2 uses capstone for disassembling, and capstone has a python API.
Example from their website:
from capstone import *
CODE = b"\x55\x48\x8b\x05\xb8\x13\x00\x00"
md = Cs(CS_ARCH_X86, CS_MODE_64)
for i in md.disasm(CODE, 0x1000):
print("0x%x:\t%s\t%s" %(i.address, i.mnemonic, i.op_str))
:>radare2 -c "aaa;fs functions;pdf @@ fcn.*;q" x32dbg.exe > foo.txt
:
\>grep -i (fcn) foo.txt
/ (fcn) fcn.004020f7 21
/ (fcn) fcn.00401ff1 266
/ (fcn) fcn.00402580 69
/ (fcn) fcn.004020ee 9
/ (fcn) fcn.004025c5 20
xxxxxxxxxxxxxxxx
a sample disassembled function
:\>grep -A 18 -i "(fcn) fcn.004025c5" foo.txt
/ (fcn) fcn.004025c5 20
| fcn.004025c5 ();
| ; var int local_10h @ ebp-0x10
| ; UNKNOWN XREF from 0x004020e5 (sub.KERNEL32.dll_DecodePointer_4e)
| ; CALL XREF from 0x0040242c (entry0)
| ; CALL XREF from 0x004020e5 (sub.KERNEL32.dll_DecodePointer_4e)
| ; CALL XREF from 0x00402647 (fcn.004025fc)
| ; CALL XREF from 0x004026c1 (fcn.0040266b)
| 0x004025c5 8b4df0 mov ecx, dword [local_10h]
| 0x004025c8 64890d000000. mov dword fs:[0], ecx
| 0x004025cf 59 pop ecx
| 0x004025d0 5f pop edi
| 0x004025d1 5f pop edi
| 0x004025d2 5e pop esi
| 0x004025d3 5b pop ebx
| 0x004025d4 8be5 mov esp, ebp
| 0x004025d6 5d pop ebp
| 0x004025d7 51 push ecx
\ 0x004025d8 c3 ret
:\>
