I'm an absolute newbie to reverse engineering. I have a 32bit lsb arm binary which I would like to reverse engineer using radare2. How should I begin ?
It's not clear exactly what are you asking for, so I'll start from the basic.
Reverse Engineering 101
If you don't have previous experience with assembly or reverse engineering I'd suggest you to start from there since you need to know the techniques before you should get to know the tools.
You can start learning from any source you find suitable for you.
The recommended source to start learning about radare is the radare2 book
This book aims to cover most usage aspects of radare2. A framework for reverse engineering and analyzing binaries
I highly encourage you to begin from these sources. You'll find them helpful, I'm sure!
Now, into a more specific answer. How to use it for reverse engineering? Here are the basic steps:
Radare2’s development is pretty quick – the project evolves every day, therefore it’s recommended to use the current git version over the stable one. Sometimes the stable version is less stable than the current git version!
$ git clone https://github.com/radare/radare2.git $ cd radare2 $ ./sys/install.sh
To open a basic static session (i.e without debugging) you should simply pass your program name to radare2:
$ r2 ./program_name — Thank you for using radare2. Have a nice night! [0x08048370]>
To debug using radare2 pass
$ r2 -d /program_name Process with PID 6972 started... = attach 6972 6972 bin.baddr 0x00400000 Using 0x400000 asm.bits 64 -- Execute a command on the visual prompt with cmd.vprompt [0x7fc6b4200c30]>
Making changes to the registers
Since you specifically mentioned this question, you can modify the registers using the
dr command and subcommands. Just execute
dr? to get help about the command and its subcommands. If you want, for example, to change
RAX, simply execute:
[0x00400697]> dr rax 0x00400697 [0x00400697]> dr rax=0x41414141 0x00400697 ->0x41414141 [0x00400697]> dr rax 0x41414141
A workflow I typically use:
$> radare2 -d /path/to/my/bin [some addr]> aaa [some addr]> afll [some addr]> db sym.main [some addr]> dc [main addr]> v!
From here, you'll be dropped into visual mode and you can step through the binary via
s and step over lines via
What this sequence of commands does is:
- Runs various analysis tasks (which will be displayed as they're completed)
- Lists functions in the binary (in verbose mode)
- Sets a breakpoint at the
mainfunction (assuming it exists)
- Continues until this breakpoint is reached (i.e. the start of
- Enters visual mode
Of course, this is just a particular workflow I happen to use. There are other commands that are useful for other things, for example:
s sym.main- seeks to the address of the
s 0xdeadbeef- we can pass any arbitrary address to seek
iM- displays the address of the program's entry point
iZ- displays ASCII strings found within the binary
aaaa- this runs an even more detailed analysis than
aaaabove (may take some time)
VV- displays the control flow graph (CFG) of the current function (invaluble tool)
dr rax- displays the contents of the
raxregister (obviously any register can be substituted here and you can even change the value via
dr rax = 0x12)
x @ 0xdeadbeef- examines memory at address
? 0xdeadbeef- converts the number provided (
0xdeadbeef) to various bases and formats
This is not a complete tutorial, but I certainly hope it helps you. Some resources I found extremely useful:
- Introduction to Reverse Engineering with Radare2
- Reverse Engineering with Radare2, Part 1
Full disclaimer: this following link is one of my own
- Crackerjack - Introduction and Puzzle A Solution (walkthrough using radare2 of a collection of crackmes I am making)