1

I have a arm 32bit lsb executable which prints "hello world" to the screen. How do I change the string to "Good bye" using radare2.

I believe this will teach me the basics of RE and radare2.

Thank you !

3

Let's start from writing a simple Hello, World program and compile it.

beet:/tmp$ cat helloworld.c

#include <stdio.h>
int main()
{
   printf("Hello, World!\n");
   return 0;
}

beet:/tmp$ gcc helloworld.c -o helloworld
beet:/tmp$ ./helloworld
Hello, World!

Since we are going to modify the binary, it is recommended to work on a copy of the original file:

beet:/tmp$ cp helloworld modified_helloworld

Now open the modified binary with radare2 in writing mode (-w):

beet:/tmp$ r2 -w modified_helloworld
 -- Change the UID of the debugged process with child.uid (requires root)
[0x00400430]>

Now we need to locate the string "Hello, World!" in the program so we'll know the address we should modify. To do this we'll use the iz command which will print strings from the data sections:

[0x00400430]> iz
vaddr=0x004005c4 paddr=0x000005c4 ordinal=000 sz=14 len=13 section=.rodata type=ascii string=Hello, World!

We can see that "Hello, World!" is located at 0x004005c4 and its length is "13". That means that we need to replace this string with another string of length "13". We'll use "Good, Bye!!!!" which is 13 character length as well.

We'll use the w command to modify the string in this address:

[0x00400430]> w Good, Bye!!!! @ 0x004005c4

Now exit from radare2 and execute the program, The changes will affected immediately.

beet:/tmp$ ./modified_helloworld
Good, Bye!!!!

et voilà! We changed the output.

You can read more in the "Editing" chapter from radare2book.

  • 1
    Brilliant senor !! – user7083361 Feb 8 '18 at 7:59
  • how would i achieve this if "Hello world" was stored in a variable named *name in C ? – user7083361 Feb 8 '18 at 8:36
  • Just the same. The string is stored in the data section and referenced by the code. – Megabeets Feb 8 '18 at 8:44
  • If you could show the code,it would be very helpful ! – user7083361 Feb 8 '18 at 9:08
  • Sure. Check out this paste. – Megabeets Feb 8 '18 at 9:17

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.