Have a functioning r2pipe script, but there's a need for hitting crtl-c to continue near the breakpoint(not a major issue,) however the script does not pause for input when the crackme asks for user input like it does in regular r2 command line. Whats the best way of sending input to the binary? This tree of inputs is required near the end of the executable. Can't manage it to prompt even for the first. No problems with script except for the input issue.

import r2pipe
r = r2pipe.open('crackme, flags=['-d'])
r.cmd('e dbg.profile=robot.rr2')
r.cmd('db 0x080486d8;') 
sep=' '

value1=int(r.cmd('? [ebp+0xc];').split(sep, 1)[0])
value2=int(r.cmd('? [ebp+0x10];').split(sep, 1)[0])
hex_operator=r.cmd('dr eax')
operator=r.cmd('? '+(hex_operator))

if '+' in operator:

elif '-' in operator:


Should prompt for input down here, but the execution just ends after the "what's the password" OR if I enter the r2 commands without r2pipe starting with: r2 -d crackme -c "e dbg.profile=robot.rr2" it does prompt me for input but rr2 still does not input whats in input.txt

in my .rr2:


have tried




input.txt is just a string

is it possible rarun's input or stdin directives are not compatible or something?

  • is it possible you provide the link to this crackme? May 10, 2018 at 6:17
  • here it is @PawełŁukasik
    – bumchux
    May 10, 2018 at 15:27
  • have some time yesterday, but don't have a solution yet. Looks like the issue is with this additional bin/sh being spawned there... May 11, 2018 at 6:33
  • That sounds strange. Did not even know that that was happening.
    – bumchux
    May 11, 2018 at 12:36

1 Answer 1


I think you're using some of the old version of r2, so my answer will not address that and show you how to do it with the latest one.

The problem is with your first line, or wrong assumption that starting the debug session and applying rarun2 file will automatically get applied. It's not.

So instead of connecting to r2 engine like this r = r2pipe.open('crackme', flags=['-d']) do this instead

r = r2pipe.open('crackme') #no debugging flag
r.cmd('e dbg.profile=robot.rr2')
r.cmd('ood') #reopen the file in debug mode - this will apply the dbg.profile settings

With this approach, it will correctly map the settings in rr2 to the debugging session and in case you put input.txt it will inform that the file doesn't exist (it treats this as a file).

But even with that approach, this crackme does some strange modifications to streams that are hard to follow. But at least with this change, you would be able to continue the investigation.

  • Thanks for the helpful input. Though my version was up to date, this solution did allow me to get the program to accept some input. However, strangely enough, execution stops immediately thereafter and should continue to more questions upon validation of this input. Perhaps this is due to the binary as you are suggesting.
    – bumchux
    May 11, 2018 at 21:02
  • UPDATE: Was able to get the input validated and a second question was outputted in succession finally, turns out running the dc command an extra time before the script quits fixes this stream issue. :O
    – bumchux
    May 11, 2018 at 21:38
  • my comment about old version of r2 was due to the fact that on my latest version this command: value1=int(r.cmd('? [ebp+0xc];').split(sep, 1)[0]) doesn't work as the output from ? is in a forma that can't be parsed by int. May 12, 2018 at 5:36
  • Huh, works for me however 2.5.0. But ran into a separate issue after further debugging. Ended up putting those beefy equations in a function to open input.txt and update it, so that the binary's first question is indeed answered correctly, then by the next question the next answer is accounted for. Also correct, however, it seems rarun is not passing the updated value of input.txt for the second question. IE. the first one is answered successfully but the second one comes up as incorrect even though input.txt is updated to the 2nd answer. Thinking rarun2 might not reload input fornext question
    – bumchux
    May 12, 2018 at 14:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.