1

As I am using the radare2 for reverse engineering, I find it very difficult to get all the register values instruction by instruction with the help of the Radare2 tool. Could someone please help me to identify the solution for the above said with the help of Radare2?

If it is not possible with radare2, could you please suggest some other tool that can do it (apart from OllyDbg. Since it is available in GUI mode, I need some tool that can be handled from the terminal (CLI))

Improve this question
1
  • got to visual mode i think VV you should see tegisters printed
    – blabb
    Oct 6, 2022 at 5:47

1 Answer 1

Reset to default
1

As i commented use visual mode to see all registers

radare2 file.exe
ood 
vv
f7 / s

enter image description here

EDIT

that is not a realistic expectation are you going to keep on single stepping for eternity ? what are you trying to do ?

use e log.level = debug 
e.logfile = somepath

and execute pd1@rip;ds 1; drd;

which will log all the changed registers between each command to a file of your choice but beware this is impractical

Improve this answer
4
  • Dear @blabb, thank you for your answer. Could you please tell me how we can save these register values instruction-wise for all instructions?
    – okokok hack
    Oct 6, 2022 at 17:39
  • that is kinda impractical you would be stepping in thousands if not millions of instructions to get past a single funnction refine your strategy if you insist set e log.level=debug and keep executing pd1@rip;ds1;drd; to disassemble 1 step step in 1 step and print the changed registers between 1 step
    – blabb
    Oct 7, 2022 at 3:51
  • Got it, but is there a way where we can stop debugging after some time ex: 2mins or so?
    – okokok hack
    Oct 7, 2022 at 4:39
  • putting a hammer on the head of nail may be (CTRL+C) ?? break your flow into manageable parts , set breakpoints trace between breakpoints , refine your breakpoints brute forcing step by step is never a good strategy
    – blabb
    Oct 8, 2022 at 4:40

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.