The the base address of the binary given as 0x60000000
in the screenshot (bin.baddr = 0x60000000
). This does not seem to be correct. The address of the first loadable segment in the binary is 0x00400000
, and the entry point address (in other words, the address of _start
) is 0x405090
.
By "this file" do you mean the one called resident
from https://drive.google.com/open?id=1socXlGx84o25QpfNjNJRAR1ldM4IQoK0 ?
$ md5sum resident
75e019a169403e19eb59c59961d5bddf resident
It came up clean on VirusTotal .
There is nothing remarkable about this binary as far as I can tell. The header is not malformed, there is no evidence of packing and the code in the binary can be disassembled just fine.
Entropy plot:

Hex dump of ELF header:
$ hexdump -C -n 52 resident
00000000 7f 45 4c 46 01 02 01 00 00 00 00 00 00 00 00 00 |.ELF............|
00000010 00 02 00 08 00 00 00 01 00 40 50 90 00 00 00 34 |.........@P....4|
00000020 00 01 91 30 70 00 10 07 00 34 00 20 00 08 00 28 |...0p....4. ...(|
00000030 00 1a 00 19 |....|
00000034
readelf -h
output (take note of the entry point address 0x405090
):
$ readelf -h resident
ELF Header:
Magic: 7f 45 4c 46 01 02 01 00 00 00 00 00 00 00 00 00
Class: ELF32
Data: 2's complement, big endian
Version: 1 (current)
OS/ABI: UNIX - System V
ABI Version: 0
Type: EXEC (Executable file)
Machine: MIPS R3000
Version: 0x1
Entry point address: 0x405090 <--------
Start of program headers: 52 (bytes into file)
Start of section headers: 102704 (bytes into file)
Flags: 0x70001007, noreorder, pic, cpic, o32, mips32r2
Size of this header: 52 (bytes)
Size of program headers: 32 (bytes)
Number of program headers: 8
Size of section headers: 40 (bytes)
Number of section headers: 26
Section header string table index: 25
A visual display of the above information:

disassembly beginning at entry point 0x405090
:
$ r2 -a mips resident
-- There's no way you could crash radare2. No. Way.
[0x00405090]> pd
;-- entry0:
;-- __start:
0x00405090 03e00021 move zero, ra
0x00405094 04110001 bal 0x40509c
0x00405098 00000000 nop
0x0040509c 3c1c0043 lui gp, 0x43
0x004050a0 279cf770 addiu gp, gp, -0x890
0x004050a4 0000f821 move ra, zero
0x004050a8 8f848018 lw a0, -0x7fe8(gp)
0x004050ac 8fa50000 lw a1, (sp)
0x004050b0 27a60004 addiu a2, sp, 4
0x004050b4 2401fff8 addiu at, zero, -8
0x004050b8 03a1e824 and sp, sp, at
0x004050bc 27bdffe0 addiu sp, sp, -0x20
0x004050c0 8f87801c lw a3, -0x7fe4(gp)
0x004050c4 8f888020 lw t0, -0x7fe0(gp)
0x004050c8 afa80010 sw t0, 0x10(sp)
0x004050cc afa20014 sw v0, 0x14(sp)
0x004050d0 afbd0018 sw sp, 0x18(sp)
0x004050d4 8f9983d0 lw t9, -0x7c30(gp)
0x004050d8 0320f809 jalr t9
< output snipped >
Take note of the address of the first loadable segment of the binary:
$ readelf -l resident
Elf file type is EXEC (Executable file)
Entry point 0x405090
There are 8 program headers, starting at offset 52
Program Headers:
Type Offset VirtAddr PhysAddr FileSiz MemSiz Flg Align
PHDR 0x000034 0x00400034 0x00400034 0x00100 0x00100 R E 0x4
INTERP 0x000134 0x00400134 0x00400134 0x00014 0x00014 R 0x1
[Requesting program interpreter: /lib/ld-uClibc.so.0]
REGINFO 0x000148 0x00400148 0x00400148 0x00018 0x00018 R 0x4
LOAD 0x000000 0x00400000 0x00400000 0x166d8 0x166d8 R E 0x10000 <----
LOAD 0x017000 0x00427000 0x00427000 0x00db0 0x00f18 RW 0x10000
DYNAMIC 0x000160 0x00400160 0x00400160 0x000f0 0x000f0 RWE 0x4
GNU_STACK 0x000000 0x00000000 0x00000000 0x00000 0x00000 RWE 0x10
NULL 0x000000 0x00000000 0x00000000 0x00000 0x00000 0x4
r2 - v
)? Is 2700 the pid of the process? Please share more information. – Megabeets May 4 '18 at 16:37radare2 2.6.0-git 18087 @ linux-x86-64 git.2.5.0-176-gcbe9a12be commit: cbe9a12be2d1d8cc39b757b9034cb29ce097e768 build: 2018-05-04__22:24:54
– Vasiliy Kuramshin May 4 '18 at 19:28e asm.bits=32
and than pd 10? – Megabeets May 4 '18 at 19:44e
full config in main post. – Vasiliy Kuramshin May 4 '18 at 20:14