I'm an absolute newbie to reverse engineering. I have a 32bit lsb arm binary which I would like to reverse engineer using radare2. How should I begin ?
2 Answers
It's not clear exactly what are you asking for, so I'll start from the basic.
Reverse Engineering 101
If you don't have previous experience with assembly or reverse engineering I'd suggest you to start from there since you need to know the techniques before you should get to know the tools.
You can start learning from any source you find suitable for you.
radare2 101
The recommended source to start learning about radare is the radare2 book
Introduction
This book aims to cover most usage aspects of radare2. A framework for reverse engineering and analyzing binaries
You can also check my Series of tutorials about radare2 which go through all the information you need to to to start reversing with radare2. You can check as well the radre2 wiki.
I highly encourage you to begin from these sources. You'll find them helpful, I'm sure!
Now, into a more specific answer. How to use it for reverse engineering? Here are the basic steps:
Installation
Radare2’s development is pretty quick – the project evolves every day, therefore it’s recommended to use the current git version over the stable one. Sometimes the stable version is less stable than the current git version!
$ git clone https://github.com/radare/radare2.git
$ cd radare2
$ ./sys/install.sh
Static Session
To open a basic static session (i.e without debugging) you should simply pass your program name to radare2:
$ r2 ./program_name
— Thank you for using radare2. Have a nice night!
[0x08048370]>
Debugging session
To debug using radare2 pass -d
:
$ r2 -d /program_name
Process with PID 6972 started...
= attach 6972 6972
bin.baddr 0x00400000
Using 0x400000
asm.bits 64
-- Execute a command on the visual prompt with cmd.vprompt
[0x7fc6b4200c30]>
Making changes to the registers
Since you specifically mentioned this question, you can modify the registers using the dr
command and subcommands. Just execute dr?
to get help about the command and its subcommands. If you want, for example, to change RAX
, simply execute:
[0x00400697]> dr rax
0x00400697
[0x00400697]> dr rax=0x41414141
0x00400697 ->0x41414141
[0x00400697]> dr rax
0x41414141
A workflow I typically use:
$> radare2 -d /path/to/my/bin
[some addr]> aaa
[some addr]> afll
[some addr]> db sym.main
[some addr]> dc
[main addr]> v!
From here, you'll be dropped into visual mode and you can step through the binary via s
and step over lines via S
.
What this sequence of commands does is:
- Runs various analysis tasks (which will be displayed as they're completed)
- Lists functions in the binary (in verbose mode)
- Sets a breakpoint at the
main
function (assuming it exists) - Continues until this breakpoint is reached (i.e. the start of
main
) - Enters visual mode
Of course, this is just a particular workflow I happen to use. There are other commands that are useful for other things, for example:
s sym.main
- seeks to the address of themain
functions 0xdeadbeef
- we can pass any arbitrary address to seekpdf
- displays the disassembly of the function you're currently iniM
- displays the address of the program's entry pointiZ
- displays ASCII strings found within the binaryaaaa
- this runs an even more detailed analysis thanaaa
above (may take some time)VV
- displays the control flow graph (CFG) of the current function (invaluble tool)dr rax
- displays the contents of therax
register (obviously any register can be substituted here and you can even change the value viadr rax = 0x12
)x @ 0xdeadbeef
- examines memory at address0xdeadbeef
? 0xdeadbeef
- converts the number provided (0xdeadbeef
) to various bases and formats
This is not a complete tutorial, but I certainly hope it helps you. Some resources I found extremely useful:
- Introduction to Reverse Engineering with Radare2
- Reverse Engineering with Radare2, Part 1
- ifding/radare2-tutorial
Full disclaimer: this following link is one of my own
- Crackerjack - Introduction and Puzzle A Solution (walkthrough using radare2 of a collection of crackmes I am making)
-
1
iM
lists the address of the program's main function,ie
is the entry point.– XatenevJun 14, 2020 at 11:41