0

I'm studying binary exploitation from CTF challenges. When I download a binary I don't have any problem to disassemble a function using the pdf command in radare2.

However, If I compile a C program with gcc and try to disassemble it, the pdf command in r2 can't find the main function, for instance, consider the following C code

// test.c
#include <stdio.h>
#include <stdlib.h>

int main(int argc, char **argv) {
  puts("Hello world!");
  exit(0);
}

Then I compile it and disassemble the executable using r2

$ gcc test.c

$ r2 -d a.out                                                            
Process with PID 49875 started...
= attach 49875 49875
bin.baddr 0x55892a265000
Using 0x55892a265000
asm.bits 64
[0x7fdb425e5100]> aaa
[Cannot find function at 0x55892a266080. and entry0 (aa)
[x] Analyze all flags starting with sym. and entry0 (aa)
[x] Analyze function calls (aac)
[x] Analyze len bytes of instructions for references (aar)
[x] Check for objc references
[x] Check for vtables
[TOFIX: aaft can't run in debugger mode.ions (aaft)
[x] Type matching analysis for all functions (aaft)
[x] Propagate noreturn information
[x] Use -AA or aaaa to perform additional experimental analysis.
[0x7fdb425e5100]> s main
[0x55892a266169]> pdf
p: Cannot find function at 0x55892a266169

pdf doesn't work and I have to use pd command instead, which produce an output not as readable as pdf. I think this is probably because some flag is missing when I compile the program but I'm not completely sure, since I've already used the -g flag (debug) obtaining the same results. Does anyone know what the problem is?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.