0

I am new to reversing and currently trying to follow this tutorial, in which the binary provided was compiled on a 32 bit machine hence the file is a "ELF 32-bit LSB executable". It runs correctly on my 64bit ubuntu machine however when I load it into radare2 I don't get the same disassembly result as the tutorial. An example is this portion of the "main" function:

On my machine the argc and envp are not displayed as main's arguments:

int main (char **argv);
           ; var uint32_t var_ch @ ebp-0xc
           ; var int32_t var_4h @ ebp-0x4
           ; arg char **argv @ esp+0x34
           0x08048424      8d4c2404       lea ecx, [argv]
           0x08048428      83e4f0         and esp, 0xfffffff0

While on the tutor's version not only are those parameters displayed, but the effective address loaded into ecx is that of the "argc" instead of "argv" as is the case on my code:

main (int argc, char **argv, char **envp);
           ; var unsigned int local_ch @ ebp-0xc
           ; var int local_4h @ ebp-0x4
           ; arg int arg_4h @ esp+0x4
           ; DATA XREF from entry0 (0x8048327)
           0x08048424      8d4c2404       lea ecx, [arg_4h]           ; 4

My question is, how can I fix this issue and get the correct disassembled code on radare2 and why won't radare2 find the main's parameters?

Improve this question
8
  • was those two analyzed in the same matter (the same function were run?) – Paweł Łukasik Mar 2 at 20:37
  • yes, I followed all the same instructions and used the same commands – Yuran Pereira Mar 3 at 6:39
  • 1
    @PawełŁukasik I just installed r2 yesterday by following the instructions on their website(by downloading it from their git repo) so I guess it should be the latest version – Yuran Pereira Mar 3 at 9:39
  • 1
    yes, it should. I'll check the binary later on my system to see if I can repro this – Paweł Łukasik Mar 3 at 9:55
  • 1
    the output is the same on my machine as well (it is may or may not be correct - these tools predict these variables and types which could be untrue). But I don't think this will hinder your progress in the tutorial. Also, the source code is given by the author. You can always recompile and play with it. – R4444 Mar 4 at 5:43

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.