0

I've created a simple program in C that prints the text "Hello, World". I'm learning to use Radare and attempting to change the "Hello, World" string in the binary executable (PE in this case).

But the problem I'm having is after I change the text running px shows all bytes are 0xFF. Here's an example:

D:\Projects\fasm\learning>radare2 -v
radare2 3.9.0 1 @ windows-x86-64 git.3.9.0
commit: 4d04a91c06413fe1b9fb0891fca8f42c927df1fd build: Tue 09/17/2019__18:51:56.27
D:\Projects\fasm\learning>radare2 empty-func.exe
 -- Switch between print modes using the 'p' and 'P' keys in visual mode
[0x004012e1]> / Hello
Searching 5 bytes in [0x41b000-0x41c000]
hits: 0
Searching 5 bytes in [0x419a00-0x41b000]
hits: 0
Searching 5 bytes in [0x419000-0x419a00]
hits: 1
Searching 5 bytes in [0x418600-0x419000]
hits: 0
Searching 5 bytes in [0x412000-0x418600]
hits: 0
Searching 5 bytes in [0x411a00-0x412000]
hits: 0
Searching 5 bytes in [0x401000-0x411a00]
hits: 0
0x00419000 hit0_0 .Hello, world.
[0x004012e1]> s 0x00419000
[0x00419000]> px
- offset -   0 1  2 3  4 5  6 7  8 9  A B  C D  E F  0123456789ABCDEF
0x00419000  4865 6c6c 6f2c 2077 6f72 6c64 0a00 0000  Hello, world....
0x00419010  ffff ffff 0100 0000 0000 0000 0000 0000  ................
0x00419020  0100 0000 b119 bf44 4ee6 40bb 0000 0000  .......DN.@.....
0x00419030  ffff ffff 0000 0000 0000 0000 0000 0000  ................
0x00419040  2005 9319 0000 0000 0000 0000 0000 0000   ...............
0x00419050  0000 0000 0000 0000 0000 0000 0120 0000  ............. ..
0x00419060  0000 0000 0000 0000 0000 0000 0000 0000  ................
0x00419070  0000 0000 0000 0000 0000 0000 0000 0000  ................
0x00419080  0000 0000 0000 0000 0000 0000 0000 0000  ................
0x00419090  0000 0000 0220 0000 0100 0000 0000 0000  ..... ..........
0x004190a0  0000 0000 0000 0000 0000 0000 0000 0000  ................
0x004190b0  0000 0000 0000 0000 0000 0000 0000 0000  ................
0x004190c0  0000 0000 0000 0000 0000 0000 0224 0000  .............$..
0x004190d0  0200 0000 0000 0000 0000 0000 0000 0000  ................
0x004190e0  0000 0000 0000 0000 0000 0000 0000 0000  ................
0x004190f0  0000 0000 0000 0000 0200 0000 0000 0000  ................
[0x00419000]> w Hola. mundo\x00
Failed to write
[0x00419000]> oo+
[0x00419000]> w Hola. mundo\x00
[0x00419000]> px
- offset -   0 1  2 3  4 5  6 7  8 9  A B  C D  E F  0123456789ABCDEF
0x00419000  ffff ffff ffff ffff ffff ffff ffff ffff  ................
0x00419010  ffff ffff ffff ffff ffff ffff ffff ffff  ................
0x00419020  ffff ffff ffff ffff ffff ffff ffff ffff  ................
0x00419030  ffff ffff ffff ffff ffff ffff ffff ffff  ................
0x00419040  ffff ffff ffff ffff ffff ffff ffff ffff  ................
0x00419050  ffff ffff ffff ffff ffff ffff ffff ffff  ................
0x00419060  ffff ffff ffff ffff ffff ffff ffff ffff  ................
0x00419070  ffff ffff ffff ffff ffff ffff ffff ffff  ................
0x00419080  ffff ffff ffff ffff ffff ffff ffff ffff  ................
0x00419090  ffff ffff ffff ffff ffff ffff ffff ffff  ................
0x004190a0  ffff ffff ffff ffff ffff ffff ffff ffff  ................
0x004190b0  ffff ffff ffff ffff ffff ffff ffff ffff  ................
0x004190c0  ffff ffff ffff ffff ffff ffff ffff ffff  ................
0x004190d0  ffff ffff ffff ffff ffff ffff ffff ffff  ................
0x004190e0  ffff ffff ffff ffff ffff ffff ffff ffff  ................
0x004190f0  ffff ffff ffff ffff ffff ffff ffff ffff  ................
[0x00419000]>

And ideas what I'm doing wrong here?

  • 1
    Can you try to open it in write mode at the start? "r2 -w filename" and then "w Hola. Mundo @ 0x419000" – Megabeets Nov 10 '19 at 11:58
  • That worked, thank you. Any idea why changing the write mode doesn't work? Put it as an answer and I'll select. – BugHunterUK Nov 10 '19 at 17:14
2

This was probably a bug which I can't reproduce this now. My guess is that the VA is moved and now this address doesn't contain anything. If this bug still happens, please open an issue describing it to the radare2 developers.

In the comments, I suggested that OP will open the file in write mode from the first-place and that seems to work.

$ r2 -w filename
w Hola. Mundo @ 0x419000

Update: As Pawel wrote in the comments, they reported the issue and it is now fixed :)

| improve this answer | |
  • 1
    I did reported this issue some time ago and it was fixed. – Paweł Łukasik Dec 26 '19 at 18:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.