1

I am trying to find an offset IOSURFACEROOTUSERCLIENT_VTAB from an iOS kext(IOSurface) using radare2 and there is a need to use the command "/c pointer; offset" as per the instructions in this gist. On performing the command the expected out put is a list of locations where the specific instruction occurs.

But when i try to run, the previous commands do work as expected. Except for the above command which gives the following output:

[0xfffffff00688b0d4]> "/c 0xfffffff007622000; 0x898"
Usage: /c   Search for crypto materials
| /ca                 Search for AES keys expanded in memory
| /cc[algo] [digest]  Find collisions (bruteforce block length values until given checksum is found)
| /cd                 Search for ASN1/DER certificates
| /cr                 Search for ASN1/DER private keys (RSA and ECC)

I'm getting the same response when the double quotes are dropped.

Please help me understand what is wrong here, or if the format for radare2 has changed over the course of time or if I missed something.

I did read the radare2 docs and but could not find any format in this form: "/c pointer; offset"

Thanks!

6
  • try dropping the "" ? Mar 28, 2021 at 21:03
  • @PawełŁukasik Tried already, but didnt work. Getting the same response as above.
    – iSeeker
    Mar 29, 2021 at 5:15
  • @PawełŁukasik Is there something else that i am missing here? I am a new to reversing. Please help me learn.
    – iSeeker
    Mar 31, 2021 at 5:20
  • what version are you running? Mar 31, 2021 at 19:49
  • @PawełŁukasik On running brew info radare2, it seems the version is radare2: stable 5.1.1 (bottled), HEAD
    – iSeeker
    Apr 5, 2021 at 4:47

1 Answer 1

1

The gist contains some old (create 3 yrs ago) r2 instructions and according to, also outdated, r2 book, it looks like /c command was responsible for "search for asm code matching the given string". Currently (radare2 5.2.0-git 26093 @ linux-x86-64 git.5.1.1) the similar instruction could be one from /a group

Usage: /a[?] [arg]  Search for assembly instructions matching given properties
| /a push rbp           Assemble given instruction and search the bytes
| /a1 [number]          Find valid assembly generated by changing only the nth byte
| /aI                   Search for infinite loop instructions (jmp $$)
| /aa mov eax           Linearly find aproximated assembly (case insensitive strstr)
| /ac mov eax           Same as /aa, but case-sensitive
| /ad[/*j] push;mov     Match ins1 followed by ins2 in linear disasm
| /ad/ ins1;ins2        Search for regex instruction 'ins1' followed by regex 'ins2'
| /ad/a instr           Search for every byte instruction that matches regexp 'instr'
| /ae esil              Search for esil expressions matching substring
| /af[l] family         Search for instruction of specific family (afl=list
| /ai[j] 0x300 [0x500]  Find all the instructions using that immediate (in range)
| /al                   Same as aoml, list all opcodes
| /am opcode            Search for specific instructions of specific mnemonic
| /ao instr             Search for instruction 'instr' (in all offsets)
| /as[l] ([type])       Search for syscalls (See /at swi and /af priv)
| /at[l] ([type])       Search for instructions of given type  

It looks like especially /ad/ should work as it can find sections of code where two instructions are following each other matching some regexp.

Based on this I think the following should work for you:

[0x00000000]>"/ad/ 0xfffffff007622000;0x898"
3
  • I tried /ad/ with quotes, but resulted in error Error: /ci : Invalid range. So I dropped the quotes and it gave a bunch of locations. But not as expected in the gist, and is a longer list. I created a pastebin for it: pastebin.com/zwfJMSnM. I am not clear how to proceed with this.
    – iSeeker
    Apr 5, 2021 at 12:47
  • without the quotes will find only the first bytes in the command. it should works with the quotes. Try w/o space between first and second value. I'm running this locally on some values that I know are consecutive and it works as expected ibb.co/KjzD9nY Apr 5, 2021 at 12:57
  • Sorry for the delayed response, I was positive for the virus and was away. This worked as you said, with quotes but without the space. Thank you very much for your help! and I will accept this as the answer. I humbly suggest that you perform the edit on your answer so that it is clear to others who may look for this.
    – iSeeker
    Apr 28, 2021 at 1:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.