1

I am trying to find an offset IOSURFACEROOTUSERCLIENT_VTAB from an iOS kext(IOSurface) using radare2 and there is a need to use the command "/c pointer; offset" as per the instructions in this gist. On performing the command the expected out put is a list of locations where the specific instruction occurs.

But when i try to run, the previous commands do work as expected. Except for the above command which gives the following output:

[0xfffffff00688b0d4]> "/c 0xfffffff007622000; 0x898"
Usage: /c   Search for crypto materials
| /ca                 Search for AES keys expanded in memory
| /cc[algo] [digest]  Find collisions (bruteforce block length values until given checksum is found)
| /cd                 Search for ASN1/DER certificates
| /cr                 Search for ASN1/DER private keys (RSA and ECC)

I'm getting the same response when the double quotes are dropped.

Please help me understand what is wrong here, or if the format for radare2 has changed over the course of time or if I missed something.

I did read the radare2 docs and but could not find any format in this form: "/c pointer; offset"

Thanks!

6
  • try dropping the "" ? – Paweł Łukasik Mar 28 at 21:03
  • @PawełŁukasik Tried already, but didnt work. Getting the same response as above. – iSeeker Mar 29 at 5:15
  • @PawełŁukasik Is there something else that i am missing here? I am a new to reversing. Please help me learn. – iSeeker Mar 31 at 5:20
  • what version are you running? – Paweł Łukasik Mar 31 at 19:49
  • @PawełŁukasik On running brew info radare2, it seems the version is radare2: stable 5.1.1 (bottled), HEAD – iSeeker Apr 5 at 4:47
1

The gist contains some old (create 3 yrs ago) r2 instructions and according to, also outdated, r2 book, it looks like /c command was responsible for "search for asm code matching the given string". Currently (radare2 5.2.0-git 26093 @ linux-x86-64 git.5.1.1) the similar instruction could be one from /a group

Usage: /a[?] [arg]  Search for assembly instructions matching given properties
| /a push rbp           Assemble given instruction and search the bytes
| /a1 [number]          Find valid assembly generated by changing only the nth byte
| /aI                   Search for infinite loop instructions (jmp $$)
| /aa mov eax           Linearly find aproximated assembly (case insensitive strstr)
| /ac mov eax           Same as /aa, but case-sensitive
| /ad[/*j] push;mov     Match ins1 followed by ins2 in linear disasm
| /ad/ ins1;ins2        Search for regex instruction 'ins1' followed by regex 'ins2'
| /ad/a instr           Search for every byte instruction that matches regexp 'instr'
| /ae esil              Search for esil expressions matching substring
| /af[l] family         Search for instruction of specific family (afl=list
| /ai[j] 0x300 [0x500]  Find all the instructions using that immediate (in range)
| /al                   Same as aoml, list all opcodes
| /am opcode            Search for specific instructions of specific mnemonic
| /ao instr             Search for instruction 'instr' (in all offsets)
| /as[l] ([type])       Search for syscalls (See /at swi and /af priv)
| /at[l] ([type])       Search for instructions of given type  

It looks like especially /ad/ should work as it can find sections of code where two instructions are following each other matching some regexp.

Based on this I think the following should work for you:

[0x00000000]>"/ad/ 0xfffffff007622000;0x898"
3
  • I tried /ad/ with quotes, but resulted in error Error: /ci : Invalid range. So I dropped the quotes and it gave a bunch of locations. But not as expected in the gist, and is a longer list. I created a pastebin for it: pastebin.com/zwfJMSnM. I am not clear how to proceed with this. – iSeeker Apr 5 at 12:47
  • without the quotes will find only the first bytes in the command. it should works with the quotes. Try w/o space between first and second value. I'm running this locally on some values that I know are consecutive and it works as expected ibb.co/KjzD9nY – Paweł Łukasik Apr 5 at 12:57
  • Sorry for the delayed response, I was positive for the virus and was away. This worked as you said, with quotes but without the space. Thank you very much for your help! and I will accept this as the answer. I humbly suggest that you perform the edit on your answer so that it is clear to others who may look for this. – iSeeker Apr 28 at 1:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.