How to change a string in a arm 32bit lsb executable binary using radare2?

Question

I have a arm 32bit lsb executable which prints "hello world" to the screen. How do I change the string to "Good bye" using radare2.

I believe this will teach me the basics of RE and radare2.

Thank you !

Answer 1

Let's start from writing a simple Hello, World program and compile it.

beet:/tmp$ cat helloworld.c

#include <stdio.h>
int main()
{
   printf("Hello, World!\n");
   return 0;
}

beet:/tmp$ gcc helloworld.c -o helloworld
beet:/tmp$ ./helloworld
Hello, World!

Since we are going to modify the binary, it is recommended to work on a copy of the original file:

beet:/tmp$ cp helloworld modified_helloworld

Now open the modified binary with radare2 in writing mode (-w):

beet:/tmp$ r2 -w modified_helloworld
 -- Change the UID of the debugged process with child.uid (requires root)
[0x00400430]>

Now we need to locate the string "Hello, World!" in the program so we'll know the address we should modify. To do this we'll use the iz command which will print strings from the data sections:

[0x00400430]> iz
vaddr=0x004005c4 paddr=0x000005c4 ordinal=000 sz=14 len=13 section=.rodata type=ascii string=Hello, World!

We can see that "Hello, World!" is located at 0x004005c4 and its length is "13". That means that we need to replace this string with another string of length "13". We'll use "Good, Bye!!!!" which is 13 character length as well.

We'll use the w command to modify the string in this address:

[0x00400430]> w Good, Bye!!!! @ 0x004005c4

Now exit from radare2 and execute the program, The changes will affected immediately.

beet:/tmp$ ./modified_helloworld
Good, Bye!!!!

et voilà! We changed the output.

You can read more in the "Editing" chapter from radare2book.