Reverse mips binary with radare2

Question

when I try to reverse my mips binary in radare2, I take some instruction invalid.

sudo r2 -a mips -b 32 -d 2700

start my binary:

sudo chroot . ./qemu-mips-static bin/resident

Sorry for this picture, but Internet in my pc is of:

Program don't work, his fault and exit. Please help.

Answer 1

The the base address of the binary given as 0x60000000 in the screenshot (bin.baddr = 0x60000000). This does not seem to be correct. The address of the first loadable segment in the binary is 0x00400000, and the entry point address (in other words, the address of _start) is 0x405090.

---

By "this file" do you mean the one called resident from https://drive.google.com/open?id=1socXlGx84o25QpfNjNJRAR1ldM4IQoK0 ?

$ md5sum resident
75e019a169403e19eb59c59961d5bddf  resident

It came up clean on VirusTotal .

There is nothing remarkable about this binary as far as I can tell. The header is not malformed, there is no evidence of packing and the code in the binary can be disassembled just fine.

Entropy plot:

Hex dump of ELF header:

$ hexdump -C -n 52 resident
00000000  7f 45 4c 46 01 02 01 00  00 00 00 00 00 00 00 00  |.ELF............|
00000010  00 02 00 08 00 00 00 01  00 40 50 90 00 00 00 34  |.........@P....4|
00000020  00 01 91 30 70 00 10 07  00 34 00 20 00 08 00 28  |...0p....4. ...(|
00000030  00 1a 00 19                                       |....|
00000034

readelf -h output (take note of the entry point address 0x405090):

$ readelf -h resident 
ELF Header:
  Magic:   7f 45 4c 46 01 02 01 00 00 00 00 00 00 00 00 00 
  Class:                             ELF32
  Data:                              2's complement, big endian
  Version:                           1 (current)
  OS/ABI:                            UNIX - System V
  ABI Version:                       0
  Type:                              EXEC (Executable file)
  Machine:                           MIPS R3000
  Version:                           0x1
  Entry point address:               0x405090               <--------
  Start of program headers:          52 (bytes into file)
  Start of section headers:          102704 (bytes into file)
  Flags:                             0x70001007, noreorder, pic, cpic, o32, mips32r2
  Size of this header:               52 (bytes)
  Size of program headers:           32 (bytes)
  Number of program headers:         8
  Size of section headers:           40 (bytes)
  Number of section headers:         26
  Section header string table index: 25

A visual display of the above information:

disassembly beginning at entry point 0x405090:

$ r2 -a mips resident
 -- There's no way you could crash radare2. No. Way.
[0x00405090]> pd
            ;-- entry0:
            ;-- __start:
            0x00405090      03e00021       move zero, ra
            0x00405094      04110001       bal 0x40509c
            0x00405098      00000000       nop
            0x0040509c      3c1c0043       lui gp, 0x43
            0x004050a0      279cf770       addiu gp, gp, -0x890
            0x004050a4      0000f821       move ra, zero
            0x004050a8      8f848018       lw a0, -0x7fe8(gp)
            0x004050ac      8fa50000       lw a1, (sp)
            0x004050b0      27a60004       addiu a2, sp, 4
            0x004050b4      2401fff8       addiu at, zero, -8
            0x004050b8      03a1e824       and sp, sp, at
            0x004050bc      27bdffe0       addiu sp, sp, -0x20
            0x004050c0      8f87801c       lw a3, -0x7fe4(gp)
            0x004050c4      8f888020       lw t0, -0x7fe0(gp)
            0x004050c8      afa80010       sw t0, 0x10(sp)
            0x004050cc      afa20014       sw v0, 0x14(sp)
            0x004050d0      afbd0018       sw sp, 0x18(sp)
            0x004050d4      8f9983d0       lw t9, -0x7c30(gp)
            0x004050d8      0320f809       jalr t9
            < output snipped >

Take note of the address of the first loadable segment of the binary:

$ readelf -l resident

Elf file type is EXEC (Executable file)
Entry point 0x405090
There are 8 program headers, starting at offset 52

Program Headers:
  Type           Offset   VirtAddr   PhysAddr   FileSiz MemSiz  Flg Align
  PHDR           0x000034 0x00400034 0x00400034 0x00100 0x00100 R E 0x4
  INTERP         0x000134 0x00400134 0x00400134 0x00014 0x00014 R   0x1
      [Requesting program interpreter: /lib/ld-uClibc.so.0]
  REGINFO        0x000148 0x00400148 0x00400148 0x00018 0x00018 R   0x4
  LOAD           0x000000 0x00400000 0x00400000 0x166d8 0x166d8 R E 0x10000  <----
  LOAD           0x017000 0x00427000 0x00427000 0x00db0 0x00f18 RW  0x10000
  DYNAMIC        0x000160 0x00400160 0x00400160 0x000f0 0x000f0 RWE 0x4
  GNU_STACK      0x000000 0x00000000 0x00000000 0x00000 0x00000 RWE 0x10
  NULL           0x000000 0x00000000 0x00000000 0x00000 0x00000     0x4