Questions tagged [radare2]

Opensource reverse engineering framework to disassemble, debug, analyze, manipulate binary files and more.

Filter by
Sorted by
Tagged with
0
votes
0answers
23 views

exploiting a binary using ret2libc

I ran into this binary at a CTF : https://github.com/auehc/AUCTF-2020/tree/master/Pwn/House%20of%20Madness I first tried to exploit it and get a shell using ret2libc technique, however I didn't ...
1
vote
2answers
49 views

Function prototypes given by Ghidra is not consistent

This is a follow up question to the question I posted over here. According to the answer, I was able to get all the function prototypes from the binary. However, the problem I am having is most of the ...
0
votes
1answer
39 views

Way to get all the function prototype using Ghidra

I have been trying to extract the function prototypes from a binary file using Ghidra. Up for now what I have done was to use the Ghidra's included "Decompile" script and filtered out the function ...
0
votes
0answers
14 views

sym..text_mn --> Symbol Meaning?

I compiled some source code and extracted functions with Radare2 (afj). Often I get a function with "sym..text_mn" function name/ symbol. The other functions are named correctly. What does this ...
-1
votes
1answer
19 views

Building Radare i get: Makefile:319: libr/config.mk: No such file or directory [closed]

When I run make I get Makefile:319: libr/config.mk: No such file or directory make: *** No rule to make target `libr/config.mk'. Stop.
0
votes
0answers
29 views

Decompile in Radare for use in AVR studio, byte addressing vs word addressing

Hoping this has a simple answer... I'm trying to use Radare2 to generate assembly code that later can be compiled in Avr studio 7. What I notice is that Radare (running pD) generates assembly code ...
0
votes
1answer
37 views

Reference address by name in Radare2/Cutter

I have some experience with IDA and now I'm trying to use Radare2/Cutter the same way. I disassemble a DOS MZ file. I have the following: ;-- section.seg_000: 12: entry0 (); 0000:0000 push ds ...
1
vote
1answer
33 views

Command “f?flagname” doesn't work as expected in radare2

PS C:\_> r2 -v radare2 4.3.1 6 @ windows-x86-64 git.4.3.1 commit: 54ac837b5503f10f91e2069ac357791f7a3e635a build: Fri 03/06/2020__15:52:24.93 PS C:\_> r2 -- -- 99 bugs, take one down pass it ...
0
votes
1answer
23 views

Start radare2 with pre-set visual mode configuration

This is the way I like to RE with radare visual mode. But I have to configure it everytime I start r2. How can I make it so r2 starts with this visual everytime I enter visual mode?
2
votes
3answers
113 views

Way to get basic blocks of a binary using Ghidra

I am using ghidra to do some reverse engineering of an ARM binary. I am wondering whether there is a way to get the basic blocks related to all the listing. Is there a function through the IDE or a ...
0
votes
0answers
41 views

Learning Certificate Pinning Bypass iOS

I want to understand how to do a Cert pinning bypass. So this is what I've attempted: Attempt 1 Use frida-trace -U THEAPPNAME -i "*NSURL*" The problem with this approach is that is not matching ...
2
votes
2answers
122 views

Radare2 Debugging: How do I pipe a program's output to another's input?

I wrote a C program that constructs a ROP payload and sends it to stdout. Using Radare2's debug mode, how would I pipe this output to a binary I am trying to exploit that accepts input on stdin? For ...
4
votes
1answer
114 views

How do I permanently change the disassembly syntax in Radare2?

As the title says, I am trying to change the default disassembly syntax in Radare2 from Intel to AT&T. Looking up documentation, I found the following. [0x00405e1c]> e asm.syntax=att However, ...
0
votes
3answers
98 views

Reverse engineer .so file from android app with radare2

I have a .so file from an android app, and I know how to list all functions in IDA Pro. How can I do this with radare2?
1
vote
0answers
40 views

Add indirect branch target reference manually (xref, crossreference) in Cutter (radare2)?

How can I create a reference for an indirect branch instruction blx r0 so that the call to the address stored in r0 shows up in the graph? I've tried flagging the target (function), but that does ...
0
votes
1answer
67 views

Getting radare2 to load z80 binaries properly

I'm trying to disassemble some Sega Master System roms. In order to do so, I've checked for the extra 512 bytes from old roms and once I was sure they weren't there, I proceeded to run radare2 on one ...
2
votes
1answer
80 views

Seek to value stored in memory in radare2

Using radare2, I am reverse engineering a custom language interpreter. It stores compiled functions as a list of pointers to language primitives. I would like to seek to these locations, but typing ...
0
votes
1answer
68 views

Extracting functions of .obj file (compiled by myself with Visual Studio 19) --> extracts wrong data

How can I find only real functions not data garbage like section..debug_S_105 ? * I need to collect function data (assembler code) of Open Source C++ Files which I compile with Visual Studio 19 (sln ...
0
votes
1answer
87 views

Renaming variables radare2

I have a variable called var_14h in disassemble code. I want to rename this variable. I try to rename the variable by using the following afvn var_14h i However, radare complains and returns an ...
1
vote
0answers
48 views

Some obstacles in reversing a JNI Native library

I deleted my last question (it was not still answered and none's effort was wasted) as I got back and thought to re-read JNI documentation, to find I misinterpreted some bits. Things are now clearer ...
3
votes
0answers
82 views

Understanding output of rabin2

I am wondering what the crypto, linenum, pcalign, relocs and va values mean in the output of rabin2. I took a look in the source code of radare2 and it seems for ELF va is always true, I assume it ...
5
votes
1answer
259 views

Is there any way to display the standard input and output of a program to Cutter's console while debugging?

So it's easy to transfer the standard input and output in radare2 to a new terminal using rarun2, here's how: Debugging with radare2 using two terminals i was wondering if i can use rarun2 with ...
2
votes
2answers
110 views

Add disassembly comment at rip in radare2

When in visual mode (command v) in radare, in the disassembly panel, I can press ; to add a comment at the location I am current seeked to (which is the top instruction in the disassembly view). I ...
0
votes
1answer
81 views

Radare2 produces null bytes on write

I've created a simple program in C that prints the text "Hello, World". I'm learning to use Radare and attempting to change the "Hello, World" string in the binary executable (PE in this case). But ...
1
vote
0answers
53 views

Radare2 8051 code bank switching

Some of 8051 chips use bank switching to extend accessible code memory. Good example is Silabs C8051F12x. Another example is here. Code area in range 0x0000..0x7ffff is common always accessible code ...
0
votes
0answers
75 views

Radare2 jump/switch table walk for 8051

For 8051 target exist famous no-return function with body of d083d082f8e4937012740193700da3a393f8740193f5828883e4737402936860efa3a3a380df which correspond to ?C?CCASE function: / 38: fcn.00000000 ...
0
votes
0answers
38 views

Opening the test file in the Radare2 recording mode

I'm studying the radare2 utility (I installed it on Windows) and I wanted to edit the file with it. But an error constantly occurs: [0x080486f5]> oo+ r_core_file_reopen: Cannot reopen file: C:\...
0
votes
1answer
217 views

How to decrypt the password using radare2 or gdb?

.--------------------------------------------------. | [0x804851b] | ...
0
votes
1answer
82 views

Radare2 not showing memory value correctly

I am debugging a bootloader running on QEMU i386. The issue is the red value of 0x6069 shown as zero. In reality the value is the same as register al (non zero value) and the following je happens. ...
0
votes
1answer
59 views

radare2 memory changing in debug mode

I have tiny program: 0x08048080 66a1a0900408 mov ax, word loc.name 0x08048086 66bbafbe mov bx, 0xbeaf 0x0804808a 66891da09004. mov word loc.name,...
3
votes
2answers
97 views

Get certain instruction count for multi-architecture binaries

I need to get an ELF binary's total count of Function call instruction conditional jump (branch) instruction The binary could be any CPU architecture, like x64, ARM, MIPS, Motorola 68K, etc. It ...
2
votes
0answers
37 views

How i can do several input via rarun2?

How can i do several input via rarun2, if my program requares two input? I try this:
2
votes
1answer
207 views

Radare2 - How to debug Android native code (dynamic analysis)?

I'm using Termux(root) on LineageOS 16 (Android 9) with radare2 (v3.6.0 linux-arm32). When i attach to a process with 'r2 -d pid' the app freezes properly but doesn't continue with 'dc'. I'm not sure ...
0
votes
1answer
62 views

Radare2 substituting second operand of lea instruction with a random register

I was trying to debug a crackme with radare2. I found an interesting function which radare2 flagged as sym.xxx. The following listing is trimmed version of disassembled output of the function sym.xxx. ...
0
votes
0answers
367 views

Differences between IDA Pro and Radare2

I am familiar with Hopper Disassembler and OllyDbg as favorite and simple tools, but I would like to try switching to IDA to work on Windows. However, I know about radare2 and that it is open source,...
1
vote
1answer
52 views

How to set search scope in radare2

Iam wondering how to change search scope in radare2. I`ve made some research and set variables search.from and search.to, according to Radare2 Book, but it doesn't work at all! Could you help me ...
0
votes
1answer
29 views

How can I iterate over syscalls (as returned with `axt`) and rewrite them?

Let's say I want to list all calls that issue kill, axt @ sym.imp.kill How can I now NOP out the syscall at all of the addresses given? I want to strip the program of calls to kill.
4
votes
1answer
264 views

Radare2 ptrace can not attach

First my setup: Linux Mint 64bit 4.15.0-20-generic radare2 the newest version from github /etc/sysctl.d/10-ptrace.conf = 0 Executable: ELF 64-bit LSB executable, x86-64 read write and ...
0
votes
0answers
41 views

radare2 (v3.6.0) on windows(x64) not change registers values in debug mode

Whats wrong: d:\radare2\bin\radare2 -A -d d:\test.exe Spawned new process with pid 7192, tid = 8572 ... [0x014eb83c]> pd 5 ┌ (fcn) entry0 2066 │ entry0 (); │ bp: 0 (vars 0, args 0) │ sp: 0 (...
4
votes
1answer
480 views

How to do debug a running java process in linux?

TLDR I want to do live debugging of a java program on a linux machine, and don't how/what debugger to attach to the JVM to get this done. I expect that this is a well-solved problem, but I lack the ...
1
vote
1answer
311 views

Change instruction test eax, eax to text eax, 1

I'm trying to change an instruction in assembly. Try with test eax, eax to test eax, 1. I try modify the opcodes. For example opcode of test eax, eax: 85c0 Try to understand why is 85c0 with this ...
1
vote
0answers
137 views

write radare2 output to a file

I am trying to write all the write logs of a binary program into a file for further analysis. I am using radare2 for it. I don't know what's the issue, I am not able to write the 'dte' output to a ...
2
votes
1answer
83 views

What is actually loaded here and different hexdump outputs on util-linux hexdump and on cutter and ghidra's hexdump

I was trying to understand what segment of file gets loaded by fourth LOAD header on phdr array. First 6 headers are shown below from readelf Program Headers: Type Offset ...
0
votes
2answers
109 views

Radare2 show current RIP and current instruction while stepping

How can I get the same behavior as in gdb when using disassemble-next-line on? When I step in radare2, I just see: [0x7fea91263220]> ds [0x7fea91263220]> ds [0x7fea91263220]> ds Why doesn'...
3
votes
1answer
230 views

Illegal instruction error in simple buffer overflow

I using following C code for testing stack based simple buffer overflow #include<stdio.h> #include<string.h> void copier(char *arg){ char buffer[100]; strcpy(buffer,arg); } int ...
2
votes
0answers
62 views

radare2 wrong output

I saw rasm2 giving different output each time for x64 Take a look at this: C:\WINDOWS\system32>rasm2 -a x86 -b 64 -d "41f6c7FF" test r15b, 0xff C:\WINDOWS\system32>rasm2 -a x86 -b 64 "test ...
2
votes
1answer
66 views

Invert stack view in radare2

Is it possible to invert the stack view when debugging in radare2 such that higher addresses are at the top?
0
votes
1answer
92 views

How to view registers values in string

Is it possible that radare2 will show registers values also in strings ? For example, when I run ar I am getting the liste of registers and I have: rax = 0x000000042 Is there a way to also show ...
1
vote
1answer
110 views

radare2 shows main function arguments argv as pointer to char on the stack, not as pointer to pointer to char

Well, I've been digging around process command line arguments as well as environment variables a bit these last days, especially looking up the way main function arguments were pushed onto the stack. ...
4
votes
1answer
257 views

function call trace with radare2 or break on all function call

I want to script with python using r2pipe. Is there a way that when debugging I can break on each call function, thus I can get the parameter? What's more, I won't jump into system library. Or is ...

1
2 3 4 5 6