Questions tagged [radare2]

Opensource reverse engineering framework to disassemble, debug, analyze, manipulate binary files and more.

Filter by
Sorted by
Tagged with
1 vote
0 answers
38 views

STM32 - Disable Voltage Check

I'm planning to edit the binary Firmware for an STM32F030K6T6 ARM microcontroller used in the IKEA Fyrtur blinds. In particular I'm trying to disable the Voltage check (allow alternative power source)...
user avatar
  • 111
3 votes
0 answers
20 views

Radare2 - Saving information/metadata from a debugging session

I'd like to know how I can save/restore comments or possibly other metadata during a debugging session. I know how to save this data when running radare without the -d flag but I often need to debug ...
user avatar
1 vote
1 answer
168 views

Examining memory without attaching to the process by using /proc/$PID/mem?

I have a gap in my understanding and tooling. Now I would prefer to use Radare2, but will consider any answer. Let's use this program as an example. #include <stdio.h> #include <unistd.h> ...
user avatar
  • 1,654
0 votes
0 answers
45 views

Get function list with radare2

I need to get a list of function start and end addresses using r2. I'm pumping this information into a tool I'm building. First, I'm aware of aaa and afl but those don't seem to provide exactly what ...
user avatar
0 votes
1 answer
75 views

How can I use cutter like ida, trying to search by address

I'm new to reverse engineering and I'm trying to get into using a disassembler - I've been using reclass for a while now. I was looking at IDA Pro and that was 7k euros so that was not an option. I've ...
user avatar
0 votes
1 answer
40 views

Radare2's equivalent of GDB's Radare2's equivalent of GDB's set $reg 0x2020

I would really like to change the registers during radare2's debugging sessiong. In GDB, set $reg 0x2020 was very useful.
user avatar
0 votes
1 answer
105 views

Changing the jne to je instruction causes program to generate error

I'm trying to change the instruction from jne to je I've change an instruction 75 0c jne [some_location] 75 0c is a 2 jump instruction. So, I've a chaged it to from 75 0c to 74 0c which is ...
user avatar
0 votes
0 answers
25 views

Radare2 only printing out the last byte at RSP when using pxq @ rsp

According to documentation, px[?][owq] [len]    hexdump of N bytes (o=octal, w=32bit, q=64bit) and pr[?][glx] [len]    print N raw bytes (in lines or hexblocks, 'g'unzip) These two ...
user avatar
1 vote
0 answers
20 views

How to make the default stack width/offset 8 bytes when debgging in radare2

If you start radare2 in debugging mode like: r2 -d /usr/bin you'll be prompted with something similar to: If you press V for the prompt, you get debugging view with panels. Then, if you select the ...
user avatar
1 vote
1 answer
72 views

How do you change the stack width/offset in radare2?

Currently, my stack view is 0x10 (16) bytes long. How do I change it so that the stack view is 8 bytes long? Edit: I have tried tabbing into the stack window, pressing e, and then typing pxr 256@r:SP ...
user avatar
1 vote
0 answers
39 views

Cutter console does not show printf result

I'm using last version (2.0.5) of Cutter. I am not able to find a way to display std in/out in Cutter Console. In the picture I cleared the console before starting debugging and you can see it after ...
user avatar
  • 11
0 votes
0 answers
22 views

Specifying multiple input files in radare2

If I want to pass several inputs, I know that I can write this with rarun2: #!/usr/bin/rarun2 stdin="first\nsecond\n" But what if I want to pass the input from a file file1 at the first ...
user avatar
  • 1
0 votes
0 answers
17 views

radare2 convenience variables

gdb allows setting arbitrary convenience variables: set $a = "test" set $b = 3 p $a # => "test" p $b # => 3 Is there a way to do something similar in radare2? I'd like to be ...
user avatar
0 votes
1 answer
117 views

How to insert asm code in file without overwriting in Radare2

I am learning reverse engineering tools. I notice that when you need to patch some file (at least in visual mode) you need to overwrite instructions, i.e. when using Shift+A in visual mode or I in ...
user avatar
  • 113
1 vote
0 answers
28 views

File not want to patch. Radare2

I am learning by doing some cracking in files that i made in C. One of this files is this: file.c: #include <stdio.h> #include <stdlib.h> int main() { char s[15] = "...
user avatar
  • 113
1 vote
0 answers
40 views

radare2 Loop over literal strings for search

In radare2, I can search and grep e.g. / needle ~:0 2>/dev/null. How I can I do that in a loop for multiple needles? E.g. something like for n in needle1 needle2 needle3; do / $n ~:0 2>/dev/...
user avatar
1 vote
0 answers
53 views

Radare2 Load file from stdin fails

Radare2 supports loading a file from stdin via =. However, my attempts to use it don't work: $ r2 /bin/ls Warning: run r2 with -e bin.cache=true to fix relocations in disassembly [0x00006810]> q $ ...
user avatar
1 vote
2 answers
94 views

How can I tell radare2 to show me a constant's value in disassembly

In radare2, I can disassemble like: 0x004006f0]> pd 3 ... 0x004006f0 ff2532092000 jmp qword [reloc.callme_three] ; [0x601028:8]=0x4006f6 0x004006f6 6802000000 push 2 ...
user avatar
1 vote
1 answer
168 views

How can I use radare2 to list all xrefs to a string?

radare2 can list all strings with iz , and list all functions with afl. How can I use radar2e to list the XREFs for each string? That is, for each string, which funcs reference it? I'd like to be ...
user avatar
2 votes
1 answer
196 views

Free alternative to Lighthouse Code Coverage Explorer?

I was trying to find if there is any free tool that allows an output similar to Lighthouse. I want to highlight the code paths taken so that I only reverse engineer the parts that are being executed. ...
user avatar
0 votes
0 answers
52 views

How can I retrieve dropped PE files from a dropper without the program necessary to execute the dropper?

I have a file (dll) that is a Cobalt Strike dropper based on the strings found inside. The file has an "entry0", and other general windows specific functions. The file appears to be ...
user avatar
  • 1
0 votes
0 answers
39 views

How to record all the "call instructions" for a brief interval?

I want to find the GUI push buttons callback function address (Qt app). I am thinking of recording all the call instructions during the short duration it takes to click the button and inspect all of ...
user avatar
0 votes
0 answers
66 views

Is it possible to detect that a function has been called from a loop? - Radare-2

is it possible to detect a function is calling from inside a loop in Radare-2. for (i = 0; i<n; i++) foo() foo() ==> 0x00402f90 // starting address Thanks
user avatar
1 vote
0 answers
317 views

Radare2 cannot open bin for writing

Im on Kali and im using Radare2 but it says r2 -d bin Killing child process 16151 due to an error Killing child process 16152 due to an error [w] Cannot open 'dbg://./bin' for writing. I tried chmod +...
user avatar
0 votes
0 answers
46 views

Radare2 give same assembly code with two different file.apk

I want to use the reverse engineering of radare2 (run on Kali Linux 2020) in order to get the assembly code of file.apk. But I do not know why two different file.apk give the same code. I checked many ...
user avatar
1 vote
1 answer
72 views

print format in radare2 cannot output all my string

I was doing a CTF challenge and I need to see the value of RAX register in radare2. I first dumped all of printable ascii characters as input, one of the function encoded the input and spit out the ...
user avatar
0 votes
0 answers
158 views

radare2: Print strings in function for 32-bit binaries

I want to see the strings that are printed by the puts() function in the output of radare2's pdf, but it doesn't work. I have a similar problem as mentioned here, but I think it's somehow related to ...
user avatar
1 vote
0 answers
55 views

Function Arguments/Name on Radare and IDA

I am starting with reverse engineering and Radare and I'm facing the following problem, on IDA Free I see the following code: mov ecx, 11h lea edi, [esp+1208h+StartupInfo] rep stosd lea ...
user avatar
  • 11
1 vote
1 answer
177 views

what is the difference between pd $s and pdf @@f in Radare2

I've tried searching around on how to disassemble a whole binary. I found that pd $s and pdf @@f are the 2 commands suggested most widely. I could understand the working of the latter, but I don't see ...
user avatar
  • 113
2 votes
1 answer
640 views

How can I find an external function code correctly in Ghidra and Radare2?

This is a code to call an external function(get_random_name) in the main function push {fp, lr} add fp, sp, 4 sub sp, sp, 0x1d8 str r0, [fp, -0x1d8] str r1, [fp, -0x1dc] sub r3, fp, 0x44 ...
user avatar
1 vote
1 answer
446 views

radare2 unable to run a binary file

I've been trying to debug a binary file in radare2 but it throws me this error. $ r2 -d bin Killing child process 1688 due to an error Killing child process 1689 due to an error [...
user avatar
  • 121
1 vote
0 answers
40 views

Change return value of a boolean function in arm library

I have an android library (arm cpu) that have a function named GetEisLinkWithDfr() that have a single line that returns boolean value of "true", and I want it to return a value of "...
user avatar
  • 11
2 votes
1 answer
118 views

`af` does not seem to find all functions in Radare2

The disassembly at the entry point looks like this: : ;-- entry0: : ;-- _mainCRTStartup: : ;-- eip: : 0x004014e0 83ec0c sub esp, 0xc : ...
user avatar
2 votes
1 answer
116 views

Radare2 does not reload payload correctly

I'm new to Radare2 so i'm trying to learn it by doing some basic buffer overflows. My problem is that, when i try to load some payloads, the stack seems to fake them in some differents ways... For ...
user avatar
3 votes
1 answer
114 views

`af` vs `afr` in Radare2

I am trying to understand the difference between analyze functions and analyze functions recursively in Radare2. Given a code snippet like this: #include <stdio.h> void b() { printf("b ...
user avatar
1 vote
1 answer
112 views

Radare2 - "/c pointer; offset" command not giving expected response to search instances of the same pair of similar instructions

I am trying to find an offset IOSURFACEROOTUSERCLIENT_VTAB from an iOS kext(IOSurface) using radare2 and there is a need to use the command "/c pointer; offset" as per the instructions in ...
user avatar
  • 63
0 votes
1 answer
82 views

What does anal.hasnext actually do?

I am trying to understand anal.hasnext control flow configuration option of Radare. The documentation says "Continue analysis after each function. Forces to find a function, after the end of a ...
user avatar
0 votes
1 answer
137 views

How to reverse engineer structs in radare2?

Is there any way to indentify structs in radare2? when i tried to look them, they look like normal variables, i seen people using td and tl command but I don't know how to use them. If you know please ...
user avatar
  • 25
0 votes
0 answers
64 views

Radare2 is showing weird disassembly as compared to disassembly of gcc

Today i was playing around with c code in r2. I compiled a file which had the following code. #include <stdio.h> int main(){ int a=9; float b=1.1; int sum; sum = ...
user avatar
  • 25
0 votes
1 answer
77 views

Interpret radare2 help

So I run radare2 from the command line with r2 - and attempt to display the help with the ? command. I read this line which says: ?[??][expr] Help or evaluate math expression I am not ...
user avatar
0 votes
0 answers
108 views

Why won't Radare2 display main's paramethers of a 32bit ELF on a 64 bit machine?

I am new to reversing and currently trying to follow this tutorial, in which the binary provided was compiled on a 32 bit machine hence the file is a "ELF 32-bit LSB executable". It runs ...
user avatar
1 vote
1 answer
532 views

Golang program reversing with Radare2

I'm trying to understand how to reverse golang programs with radare2. In order to practice, i create a minimal program in Go: package main import "fmt" func main() { fmt.Println("...
user avatar
2 votes
1 answer
261 views

Can't modify string in radare2 (.rodata section)

I was following the response to this question to change the string of an elf executable. No matter how many times I try, I just can't modify the string. I notice that probably the issue lies in the ...
user avatar
  • 153
0 votes
1 answer
417 views

main function not found in GCC compiled code

I'm trying to learn reverse engineering using Radare2. For this I compiled a hello world program with GCC on Ubuntu (version: gcc (Ubuntu 9.3.0-17ubuntu1~20.04) 9.3.0). #include <stdio.h> int ...
user avatar
0 votes
0 answers
45 views

"rabin2 -E" and "afll" no output for an exe file

$ rabin2 -I test.exe arch x86 baddr 0x400000 binsz 3229424 bintype pe bits 32 canary false retguard false class PE32 cmp.csum 0x0031d950 ...
user avatar
  • 101
4 votes
1 answer
902 views

Ghidra + IDA cant detect a string but Radare2 can

Im new to reverse engineering, and ive trying Ghidra, IDA (Freeware) and Radare2 with a simple CrackMe, the problem is, both Ghidra and IDA couldnt detect a string while Radare2 (Using Cutter GUI) ...
user avatar
  • 143
2 votes
1 answer
119 views

Getting memory address of particular bytes in radare2

in pwnlib there is a possibility to search for particular bytes, e.g. as follows for 0x66 byte: print(next(p.elf.search(b'f'))) which in turn results in the following output: 4195268 Having this ...
user avatar
1 vote
0 answers
99 views

What do you think is the optimum environment for reverse engineering dynamically-linked aarch64 Golang binaries developed in Alpine Linux?

Direct quote from Golang's website: "GDB does not understand Go programs well. The stack management, threading, and runtime contain aspects that differ enough from the execution model GDB expects ...
user avatar
  • 257
1 vote
1 answer
225 views

Crackme assistance - change input of a function

Just as a preface, this is a crackme from https://hack.ainfosec.com/. I know you can submit these as part of a job app, I have no intentions of doing that. Very happy to have a job in a related, but ...
user avatar
  • 11
0 votes
0 answers
40 views

how do I use Remote Binary Protocol in cutter

how do I use Remote Binary Protocol I tried to connect to gdbserver through the normal method but it would just hang and not connect. I let it go like that for 1 hour
user avatar
  • 1

1
2 3 4 5
7