0

I'm an absolute newbie to reverse engineering. I have a 32bit lsb arm binary which I would like to reverse engineer using radare2. How should I begin ?

Improve this question
4

It's not clear exactly what are you asking for, so I'll start from the basic.

Reverse Engineering 101

If you don't have previous experience with assembly or reverse engineering I'd suggest you to start from there since you need to know the techniques before you should get to know the tools.

You can start learning from any source you find suitable for you.

radare2 101

The recommended source to start learning about radare is the radare2 book

Introduction
This book aims to cover most usage aspects of radare2. A framework for reverse engineering and analyzing binaries

You can also check my Series of tutorials about radare2 which go through all the information you need to to to start reversing with radare2. You can check as well the radre2 wiki.

I highly encourage you to begin from these sources. You'll find them helpful, I'm sure!

Now, into a more specific answer. How to use it for reverse engineering? Here are the basic steps:

Installation

Radare2’s development is pretty quick – the project evolves every day, therefore it’s recommended to use the current git version over the stable one. Sometimes the stable version is less stable than the current git version!

$ git clone https://github.com/radare/radare2.git
$ cd radare2
$ ./sys/install.sh

Static Session

To open a basic static session (i.e without debugging) you should simply pass your program name to radare2:

$ r2 ./program_name
 — Thank you for using radare2. Have a nice night!
[0x08048370]>

Debugging session

To debug using radare2 pass -d:

$ r2 -d /program_name
Process with PID 6972 started...
= attach 6972 6972
bin.baddr 0x00400000
Using 0x400000
asm.bits 64
 -- Execute a command on the visual prompt with cmd.vprompt
[0x7fc6b4200c30]>

Making changes to the registers

Since you specifically mentioned this question, you can modify the registers using the dr command and subcommands. Just execute dr? to get help about the command and its subcommands. If you want, for example, to change RAX, simply execute:

[0x00400697]> dr rax
0x00400697
[0x00400697]> dr rax=0x41414141
0x00400697 ->0x41414141
[0x00400697]> dr rax
0x41414141
Improve this answer
1

A workflow I typically use:

$> radare2 -d /path/to/my/bin
[some addr]> aaa
[some addr]> afll
[some addr]> db sym.main
[some addr]> dc
[main addr]> v!

From here, you'll be dropped into visual mode and you can step through the binary via s and step over lines via S.

What this sequence of commands does is:

  1. Runs various analysis tasks (which will be displayed as they're completed)
  2. Lists functions in the binary (in verbose mode)
  3. Sets a breakpoint at the main function (assuming it exists)
  4. Continues until this breakpoint is reached (i.e. the start of main)
  5. Enters visual mode

Of course, this is just a particular workflow I happen to use. There are other commands that are useful for other things, for example:

  • s sym.main - seeks to the address of the main function
  • s 0xdeadbeef - we can pass any arbitrary address to seek
  • pdf - displays the disassembly of the function you're currently in
  • iM - displays the address of the program's entry point
  • iZ - displays ASCII strings found within the binary
  • aaaa - this runs an even more detailed analysis than aaa above (may take some time)
  • VV - displays the control flow graph (CFG) of the current function (invaluble tool)
  • dr rax - displays the contents of the rax register (obviously any register can be substituted here and you can even change the value via dr rax = 0x12)
  • x @ 0xdeadbeef - examines memory at address 0xdeadbeef
  • ? 0xdeadbeef - converts the number provided (0xdeadbeef) to various bases and formats

This is not a complete tutorial, but I certainly hope it helps you. Some resources I found extremely useful:

Full disclaimer: this following link is one of my own

Improve this answer
  • 1
    iM lists the address of the program's main function, ie is the entry point. – Xatenev Jun 14 '20 at 11:41

Not the answer you're looking for? Browse other questions tagged or ask your own question.