I am using radare2 to reverse engineer a standard crackme executable. I have obtained the password, but now I need use the program to read & print a restricted file to which the executable has access.

I can see from the executable's main function through radare2 that there is a "login" section that asks for a password and this then proceeds to execute a system command that prints the restricted file.

However, it seems the program flow skips past this section and terminates the program.

Given an address or a string reference, how can I use radare2 to execute the program from a certain point so that I can avoid skipping it?

From this:

entry point 0x00000
|  desired section 0x000c8 "enter password: "
termination 0x000f9 "no entry"

To this:

entry point
|_-> desired section 0x000c8 "enter password: " -> 0x000ca "cat /root/file.txt" -
termination 0x000f9 <-___________________________________________________________|

  • why not just set rip to the desired address? – Paweł Łukasik Oct 5 '20 at 6:12
  • How does rip differ from seek? – Gabriel Saul Oct 7 '20 at 1:55
  • seek is only where you are in the code. rip points to what's being executed – Paweł Łukasik Oct 7 '20 at 4:40
  • I tried setting rip to the desired address and continued execution with dc and it ended up terminating prematurely with a memory error. – Gabriel Saul Oct 8 '20 at 0:33
  • well, it might be not as easy as like this, there might be some initialization being done that you've skipped.Show the real code, add link to the "program" so ppl can have a look at this specific example. – Paweł Łukasik Oct 8 '20 at 6:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.