Questions tagged [radare2]
Opensource reverse engineering framework to disassemble, debug, analyze, manipulate binary files and more.
277
questions
1
vote
1answer
30 views
How to find DOS Header and PE Header with an entry point in Radare2?
I am currently doing byte extraction from PE files using Radare2. I know how to find the byte sequence for Dos Header and PE Header when there is no entry point and the start is defaulted to 0x0. But ...
-1
votes
0answers
30 views
Understanding hex opcode an r2 dissasembly output
Can anyone explain what the middle column (55, 4889e5, etc.) denotes in this r2 output? Are they assembly hex opcodes or do they relate to the registry? (To my limited knowledge I understand that the ...
1
vote
1answer
39 views
Results of radare2 are not correct
I am using radare2 to analyze libpng_amd64.so.1.6.34, commands are as follows:
r2 = r2pipe.open(binary_file)
r2.cmd('aaa')
funcs = r2.cmdj('aflj')
len(funcs) is 461, but the number of functions got ...
0
votes
0answers
14 views
Why does `omb` sometimes not work in Radare2
I'm a little confused about the behaviour of the omb command in Radare2. Sometimes when I give it what I believe is a valid segment number and offset, it doesn't change it. (This is usually after I ...
0
votes
1answer
29 views
How do I use vi keybindings at the command line in Radare2?
The Radare2 command line (I believe it's called "interactive mode"?) allows bringing back history and editing it with the arrow keys. However, I prefer to use vi/vim keybindings for this. How do I ...
1
vote
2answers
37 views
How can I change the default input radix to hexadecimal in Radare2?
Frequently when I use Radare2 I work mostly in hexadecimal. This means I'm constantly having to remember to type 0x in front of addresses, which is different from the machine-language monitors I'm ...
2
votes
1answer
60 views
Modify value to pass jump and print a message with Radare2
I have a problem with understanding, why after modifying variable var_4h and passing positively through jne at 0x000006c3 I still cannot see the message. I use radare2
In debug mode, just before cmp ...
0
votes
2answers
87 views
asm snippet to pseudo-code
I'm looking into a way to generate pseudo-code from snippet of assembly,
let's assume I have this ASM
push rbp
mov rbp, rsp
mov DWORD PTR [rbp-4], edi
mov DWORD PTR [...
0
votes
1answer
63 views
Why there are only 8 hexa memory digits while my RAM is 16G
I'm totally new to reverse engineering, when I start debugging my c program with radare2, and start showing assembly, I found that addresses are only 8 hexa digits, which means 16^8 = 4294967296 ...
1
vote
0answers
32 views
radare2 stop on lazy loaded library (gdb's stop-on-solib-events)
I am running an application and would like to set a breakpoint, as soon as a relevant shared library is loaded. On gdb I can achieve it via
set stop-on-solib-events 1
I've been unable to find ...
1
vote
1answer
82 views
Is `movq rax, xmm0` buggy in Radare2?
Why doesn't rax get loaded from xmm0 here? radare2 bug?
GitHub issue `movq rax, xmm0` doesn't work in native debugger filed.
[0x0003b0e0]> drr
role reg value ref
―――――――――――――――――――...
0
votes
1answer
43 views
How to detect which shared libraries a binary is actually using?
I have a stripped-down Linux-based embedded system where a closed-source program(32-bit ELF binary for MIPS) depends on several shared libraries. Two of those libraries are actually the same libcurl ...
0
votes
0answers
40 views
How can I define an int array in Radare2?
I'm disassembling a C written binary using radare2:
The block of code im looking into corresponds to this one
int num[5];
int sum;
num[0] = 200;
num[1] = 150;...
0
votes
0answers
29 views
radare2 set data type at address
I've been using Ghidra a lot recently and have developed a nice workflow, but I'm trying to get back into r2.
I'm wondering if there's a way to set the data type at a given address. For example, when ...
0
votes
1answer
57 views
Replace string in hexa with a longer one in .bin without destroying the structure (in .data)
I would like to replace some hard-coded strings in a compiled exe (in .data) which is in chinese (with no possibility to put it in other languages).
I managed to replace strings in hexadecimal with ...
-1
votes
1answer
57 views
What does std::string::oprator__unsigned_long do?
I am new to reverse c++ program.
I met this code from r2 decompilation.
pcVar6 = (char *)sym.imp.std::string::operator___unsigned_long
(&...
0
votes
0answers
74 views
Anti-re tactics or radare problem while debugging
Here's the target application: https://www.sa-mp.com/download.php
While live debugging, the Windows application is starting a few threads, and Cutter auto breaks after entrypoint for a reason I'm not ...
0
votes
0answers
41 views
exploiting a binary using ret2libc
I ran into this binary at a CTF :
https://github.com/auehc/AUCTF-2020/tree/master/Pwn/House%20of%20Madness
I first tried to exploit it and get a shell using ret2libc technique, however I didn't ...
3
votes
2answers
143 views
Function prototypes given by Ghidra is not consistent
This is a follow up question to the question I posted over here. According to the answer, I was able to get all the function prototypes from the binary. However, the problem I am having is most of the ...
1
vote
1answer
143 views
Way to get all the function prototype using Ghidra
I have been trying to extract the function prototypes from a binary file using Ghidra. Up till now what I have done was to use Ghidra's included "Decompile" script and filtered out the function ...
1
vote
1answer
42 views
text_mn in Radare2 --> Meaning?
I compiled some source code and extracted functions with Radare2 (afj).
Often I get a function with "sym..text_mn" function name/ symbol.
The other functions are named correctly. What does this ...
0
votes
0answers
33 views
Decompile in Radare for use in AVR studio, byte addressing vs word addressing
Hoping this has a simple answer...
I'm trying to use Radare2 to generate assembly code that later can be compiled in Avr studio 7. What I notice is that Radare (running pD) generates assembly code ...
0
votes
1answer
55 views
Reference address by name in Radare2/Cutter
I have some experience with IDA and now I'm trying to use Radare2/Cutter the same way. I disassemble a DOS MZ file. I have the following:
;-- section.seg_000:
12: entry0 ();
0000:0000 push ds ...
1
vote
1answer
35 views
Command “f?flagname” doesn't work as expected in radare2
PS C:\_> r2 -v
radare2 4.3.1 6 @ windows-x86-64 git.4.3.1
commit: 54ac837b5503f10f91e2069ac357791f7a3e635a build: Fri 03/06/2020__15:52:24.93
PS C:\_> r2 --
-- 99 bugs, take one down pass it ...
0
votes
1answer
36 views
Start radare2 with pre-set visual mode configuration
This is the way I like to RE with radare visual mode. But I have to configure it everytime I start r2. How can I make it so r2 starts with this visual everytime I enter visual mode?
3
votes
3answers
286 views
Way to get basic blocks of a binary using Ghidra
I am using ghidra to do some reverse engineering of an ARM binary. I am wondering whether there is a way to get the basic blocks related to all the listing. Is there a function through the IDE or a ...
0
votes
0answers
83 views
Learning Certificate Pinning Bypass iOS
I want to understand how to do a Cert pinning bypass.
So this is what I've attempted:
Attempt 1
Use frida-trace -U THEAPPNAME -i "*NSURL*"
The problem with this approach is that is not matching ...
3
votes
2answers
310 views
Radare2 Debugging: How do I pipe a program's output to another's input?
I wrote a C program that constructs a ROP payload and sends it to stdout. Using Radare2's debug mode, how would I pipe this output to a binary I am trying to exploit that accepts input on stdin?
For ...
4
votes
1answer
163 views
How do I permanently change the disassembly syntax in Radare2?
As the title says, I am trying to change the default disassembly syntax in Radare2 from Intel to AT&T. Looking up documentation, I found the following.
[0x00405e1c]> e asm.syntax=att
However, ...
0
votes
3answers
173 views
Reverse engineer .so file from android app with radare2
I have a .so file from an android app, and I know how to list all functions in IDA Pro.
How can I do this with radare2?
1
vote
0answers
41 views
Add indirect branch target reference manually (xref, crossreference) in Cutter (radare2)?
How can I create a reference for an indirect branch instruction
blx r0
so that the call to the address stored in r0 shows up in the graph?
I've tried flagging the target (function), but that does ...
0
votes
1answer
88 views
Getting radare2 to load z80 binaries properly
I'm trying to disassemble some Sega Master System roms.
In order to do so, I've checked for the extra 512 bytes from old roms and once I was sure they weren't there, I proceeded to run radare2 on one ...
2
votes
1answer
134 views
Seek to value stored in memory in radare2
Using radare2, I am reverse engineering a custom language interpreter. It stores compiled functions as a list of pointers to language primitives. I would like to seek to these locations, but typing ...
0
votes
1answer
101 views
Extracting functions of .obj file (compiled by myself with Visual Studio 19) --> extracts wrong data
How can I find only real functions not data garbage like section..debug_S_105 ? *
I need to collect function data (assembler code) of Open Source C++ Files which I compile with Visual Studio 19 (sln ...
1
vote
1answer
281 views
Renaming variables radare2
I have a variable called var_14h in disassemble code. I want to rename this variable. I try to rename the variable by using the following
afvn var_14h i
However, radare complains and returns an ...
1
vote
0answers
71 views
Some obstacles in reversing a JNI Native library
I deleted my last question (it was not still answered and none's effort was wasted) as I got back and thought to re-read JNI documentation, to find I misinterpreted some bits. Things are now clearer
...
3
votes
0answers
139 views
Understanding output of rabin2
I am wondering what the crypto, linenum, pcalign, relocs and va values mean in the output of rabin2.
I took a look in the source code of radare2 and it seems for ELF va is always true, I assume it ...
6
votes
1answer
431 views
Is there any way to display the standard input and output of a program to Cutter's console while debugging?
So it's easy to transfer the standard input and output in radare2 to a new terminal using rarun2, here's how:
Debugging with radare2 using two terminals
i was wondering if i can use rarun2 with ...
2
votes
2answers
162 views
Add disassembly comment at rip in radare2
When in visual mode (command v) in radare, in the disassembly panel, I can press ; to add a comment at the location I am current seeked to (which is the top instruction in the disassembly view). I ...
0
votes
1answer
91 views
Radare2 produces null bytes on write
I've created a simple program in C that prints the text "Hello, World". I'm learning to use Radare and attempting to change the "Hello, World" string in the binary executable (PE in this case).
But ...
5
votes
0answers
121 views
Radare2 8051 code bank switching
Some of 8051 chips use bank switching to extend accessible code memory.
Good example is Silabs C8051F12x. Another example is here.
Code area in range 0x0000..0x7ffff is common always accessible code ...
0
votes
0answers
86 views
Radare2 jump/switch table walk for 8051
For 8051 target exist famous no-return function with body of
d083d082f8e4937012740193700da3a393f8740193f5828883e4737402936860efa3a3a380df
which correspond to ?C?CCASE function:
/ 38: fcn.00000000 ...
0
votes
0answers
40 views
Opening the test file in the Radare2 recording mode
I'm studying the radare2 utility (I installed it on Windows) and I wanted to edit the file with it. But an error constantly occurs:
[0x080486f5]> oo+
r_core_file_reopen: Cannot reopen file: C:\...
0
votes
1answer
260 views
How to decrypt the password using radare2 or gdb?
.--------------------------------------------------.
| [0x804851b] |
...
0
votes
1answer
92 views
Radare2 not showing memory value correctly
I am debugging a bootloader running on QEMU i386.
The issue is the red value of 0x6069 shown as zero. In reality the value is the same as register al (non zero value) and the following je happens.
...
0
votes
1answer
76 views
radare2 memory changing in debug mode
I have tiny program:
0x08048080 66a1a0900408 mov ax, word loc.name
0x08048086 66bbafbe mov bx, 0xbeaf
0x0804808a 66891da09004. mov word loc.name,...
3
votes
2answers
103 views
Get certain instruction count for multi-architecture binaries
I need to get an ELF binary's total count of
Function call instruction
conditional jump (branch) instruction
The binary could be any CPU architecture, like x64, ARM, MIPS, Motorola 68K, etc.
It ...
2
votes
0answers
39 views
How i can do several input via rarun2?
How can i do several input via rarun2, if my program requares two input?
I try this:
3
votes
1answer
287 views
Radare2 - How to debug Android native code (dynamic analysis)?
I'm using Termux(root) on LineageOS 16 (Android 9) with radare2 (v3.6.0 linux-arm32). When i attach to a process with 'r2 -d pid' the app freezes properly but doesn't continue with 'dc'. I'm not sure ...
0
votes
1answer
73 views
Radare2 substituting second operand of lea instruction with a random register
I was trying to debug a crackme with radare2. I found an interesting function which radare2 flagged as sym.xxx. The following listing is trimmed version of disassembled output of the function sym.xxx.
...
