1

Have a functioning r2pipe script, but there's a need for hitting crtl-c to continue near the breakpoint(not a major issue,) however the script does not pause for input when the crackme asks for user input like it does in regular r2 command line. Whats the best way of sending input to the binary? This tree of inputs is required near the end of the executable. Can't manage it to prompt even for the first. No problems with script except for the input issue.

import r2pipe
r = r2pipe.open('crackme, flags=['-d'])
r.cmd('e dbg.profile=robot.rr2')
r.cmd('db 0x080486d8;') 
print(r.cmd('dc'))
print(r.cmd('dc'))
sep=' '

value1=int(r.cmd('? [ebp+0xc];').split(sep, 1)[0])
value2=int(r.cmd('? [ebp+0x10];').split(sep, 1)[0])
hex_operator=r.cmd('dr eax')
operator=r.cmd('? '+(hex_operator))

if '+' in operator:
    answer=value1+value2

elif '-' in operator:
    answer=value1-value2

print(r.cmd('dc'))

Should prompt for input down here, but the execution just ends after the "what's the password" OR if I enter the r2 commands without r2pipe starting with: r2 -d crackme -c "e dbg.profile=robot.rr2" it does prompt me for input but rr2 still does not input whats in input.txt

in my .rr2:

#!/usr/bin/rarun2

have tried

input=input.txt

and

stdin=input.txt

input.txt is just a string

is it possible rarun's input or stdin directives are not compatible or something?

| improve this question | |
0

I think you're using some of the old version of r2, so my answer will not address that and show you how to do it with the latest one.

The problem is with your first line, or wrong assumption that starting the debug session and applying rarun2 file will automatically get applied. It's not.

So instead of connecting to r2 engine like this r = r2pipe.open('crackme', flags=['-d']) do this instead

r = r2pipe.open('crackme') #no debugging flag
r.cmd('e dbg.profile=robot.rr2')
r.cmd('ood') #reopen the file in debug mode - this will apply the dbg.profile settings
...

With this approach, it will correctly map the settings in rr2 to the debugging session and in case you put input.txt it will inform that the file doesn't exist (it treats this as a file).

But even with that approach, this crackme does some strange modifications to streams that are hard to follow. But at least with this change, you would be able to continue the investigation.

| improve this answer | |
  • Thanks for the helpful input. Though my version was up to date, this solution did allow me to get the program to accept some input. However, strangely enough, execution stops immediately thereafter and should continue to more questions upon validation of this input. Perhaps this is due to the binary as you are suggesting. – bumchux May 11 '18 at 21:02
  • UPDATE: Was able to get the input validated and a second question was outputted in succession finally, turns out running the dc command an extra time before the script quits fixes this stream issue. :O – bumchux May 11 '18 at 21:38
  • my comment about old version of r2 was due to the fact that on my latest version this command: value1=int(r.cmd('? [ebp+0xc];').split(sep, 1)[0]) doesn't work as the output from ? is in a forma that can't be parsed by int. – Paweł Łukasik May 12 '18 at 5:36
  • Huh, works for me however 2.5.0. But ran into a separate issue after further debugging. Ended up putting those beefy equations in a function to open input.txt and update it, so that the binary's first question is indeed answered correctly, then by the next question the next answer is accounted for. Also correct, however, it seems rarun is not passing the updated value of input.txt for the second question. IE. the first one is answered successfully but the second one comes up as incorrect even though input.txt is updated to the 2nd answer. Thinking rarun2 might not reload input fornext question – bumchux May 12 '18 at 14:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.