-1

When we have many binaries, there is a python base solution for disassemble and extract opcodes from binaries in IDA program. Is there any or similar solution to disassemble binaries for Radare2?

  • use r2pipe? but what output do you expect to get? – Paweł Łukasik Jan 30 '18 at 13:51
  • I want disassembled opcodes of binaries. How can I use r2pipe? – hamid darabian Jan 30 '18 at 14:07
  • 1
    'pd N' and you can specify as N whatever number you want and it will disassemble N instructions – Paweł Łukasik Jan 30 '18 at 15:47
  • 1
    I suggest you to read the radare2 book, it will teach you the basics. – Megabeets Jan 30 '18 at 17:09
  • 1
    Are you sure you want to disassemble "the whole file"? – usr2564301 Jan 30 '18 at 19:02
2

Radare2 uses capstone for disassembling, and capstone has a python API.

Example from their website:

from capstone import *

CODE = b"\x55\x48\x8b\x05\xb8\x13\x00\x00"

md = Cs(CS_ARCH_X86, CS_MODE_64)
for i in md.disasm(CODE, 0x1000):
    print("0x%x:\t%s\t%s" %(i.address, i.mnemonic, i.op_str))
| improve this answer | |
0

:>radare2 -c "aaa;fs functions;pdf @@ fcn.*;q" x32dbg.exe > foo.txt

:

\>grep -i (fcn) foo.txt
/ (fcn) fcn.004020f7 21
/ (fcn) fcn.00401ff1 266
/ (fcn) fcn.00402580 69
/ (fcn) fcn.004020ee 9
/ (fcn) fcn.004025c5 20
 xxxxxxxxxxxxxxxx

a sample disassembled function

:\>grep -A 18 -i "(fcn) fcn.004025c5" foo.txt
/ (fcn) fcn.004025c5 20
|   fcn.004025c5 ();
|           ; var int local_10h @ ebp-0x10
|              ; UNKNOWN XREF from 0x004020e5 (sub.KERNEL32.dll_DecodePointer_4e)
|              ; CALL XREF from 0x0040242c (entry0)
|              ; CALL XREF from 0x004020e5 (sub.KERNEL32.dll_DecodePointer_4e)
|              ; CALL XREF from 0x00402647 (fcn.004025fc)
|              ; CALL XREF from 0x004026c1 (fcn.0040266b)
|           0x004025c5      8b4df0         mov ecx, dword [local_10h]
|           0x004025c8      64890d000000.  mov dword fs:[0], ecx
|           0x004025cf      59             pop ecx
|           0x004025d0      5f             pop edi
|           0x004025d1      5f             pop edi
|           0x004025d2      5e             pop esi
|           0x004025d3      5b             pop ebx
|           0x004025d4      8be5           mov esp, ebp
|           0x004025d6      5d             pop ebp
|           0x004025d7      51             push ecx
\           0x004025d8      c3             ret

:\>
| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.