1

I have some rare cases with radare2.

when I try to display all string using "iz" it does the job.

enter image description here

but when I do "pdf" or "pd" I can't see actual value of string:

enter image description here

I see int puts(const char *s) instead of "incorrect password" or "Access granted!"

1

This is not a bug in radare2. The comment that you see in red is merely the imported function prototype. In both cases seen in the picture, the parameter to puts is pushed through eax whereas it is loaded from a memory location based on ebx. radare2 does not emulate the code [unless told], so it cannot display the actual string being pointed.

2
  • Thanks for your answer. can you tell me how can I force radare2 to display actual string?
    – nickmaroo
    Sep 9 '20 at 12:33
  • You need to use ESIL emulation for that. Load the binary into radare2 and analyze with aa (or aaa if binary is not too complex). Then disassemble the function (e.g. main) while setting emu.str temporarily: pdf @e:emu.str=true @ main
    – Eli
    Sep 10 '20 at 13:26

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.