Questions tagged [radare2]
Opensource reverse engineering framework to disassemble, debug, analyze, manipulate binary files and more.
261
questions
0
votes
0answers
23 views
exploiting a binary using ret2libc
I ran into this binary at a CTF :
https://github.com/auehc/AUCTF-2020/tree/master/Pwn/House%20of%20Madness
I first tried to exploit it and get a shell using ret2libc technique, however I didn't ...
1
vote
2answers
49 views
Function prototypes given by Ghidra is not consistent
This is a follow up question to the question I posted over here. According to the answer, I was able to get all the function prototypes from the binary. However, the problem I am having is most of the ...
0
votes
1answer
39 views
Way to get all the function prototype using Ghidra
I have been trying to extract the function prototypes from a binary file using Ghidra. Up for now what I have done was to use the Ghidra's included "Decompile" script and filtered out the function ...
0
votes
0answers
14 views
sym..text_mn --> Symbol Meaning?
I compiled some source code and extracted functions with Radare2 (afj).
Often I get a function with "sym..text_mn" function name/ symbol.
The other functions are named correctly. What does this ...
-1
votes
1answer
19 views
Building Radare i get: Makefile:319: libr/config.mk: No such file or directory [closed]
When I run make I get
Makefile:319: libr/config.mk: No such file or directory
make: *** No rule to make target `libr/config.mk'. Stop.
0
votes
0answers
29 views
Decompile in Radare for use in AVR studio, byte addressing vs word addressing
Hoping this has a simple answer...
I'm trying to use Radare2 to generate assembly code that later can be compiled in Avr studio 7. What I notice is that Radare (running pD) generates assembly code ...
0
votes
1answer
37 views
Reference address by name in Radare2/Cutter
I have some experience with IDA and now I'm trying to use Radare2/Cutter the same way. I disassemble a DOS MZ file. I have the following:
;-- section.seg_000:
12: entry0 ();
0000:0000 push ds ...
1
vote
1answer
33 views
Command “f?flagname” doesn't work as expected in radare2
PS C:\_> r2 -v
radare2 4.3.1 6 @ windows-x86-64 git.4.3.1
commit: 54ac837b5503f10f91e2069ac357791f7a3e635a build: Fri 03/06/2020__15:52:24.93
PS C:\_> r2 --
-- 99 bugs, take one down pass it ...
0
votes
1answer
23 views
Start radare2 with pre-set visual mode configuration
This is the way I like to RE with radare visual mode. But I have to configure it everytime I start r2. How can I make it so r2 starts with this visual everytime I enter visual mode?
2
votes
3answers
113 views
Way to get basic blocks of a binary using Ghidra
I am using ghidra to do some reverse engineering of an ARM binary. I am wondering whether there is a way to get the basic blocks related to all the listing. Is there a function through the IDE or a ...
0
votes
0answers
41 views
Learning Certificate Pinning Bypass iOS
I want to understand how to do a Cert pinning bypass.
So this is what I've attempted:
Attempt 1
Use frida-trace -U THEAPPNAME -i "*NSURL*"
The problem with this approach is that is not matching ...
2
votes
2answers
122 views
Radare2 Debugging: How do I pipe a program's output to another's input?
I wrote a C program that constructs a ROP payload and sends it to stdout. Using Radare2's debug mode, how would I pipe this output to a binary I am trying to exploit that accepts input on stdin?
For ...
4
votes
1answer
114 views
How do I permanently change the disassembly syntax in Radare2?
As the title says, I am trying to change the default disassembly syntax in Radare2 from Intel to AT&T. Looking up documentation, I found the following.
[0x00405e1c]> e asm.syntax=att
However, ...
0
votes
3answers
98 views
Reverse engineer .so file from android app with radare2
I have a .so file from an android app, and I know how to list all functions in IDA Pro.
How can I do this with radare2?
1
vote
0answers
40 views
Add indirect branch target reference manually (xref, crossreference) in Cutter (radare2)?
How can I create a reference for an indirect branch instruction
blx r0
so that the call to the address stored in r0 shows up in the graph?
I've tried flagging the target (function), but that does ...
0
votes
1answer
67 views
Getting radare2 to load z80 binaries properly
I'm trying to disassemble some Sega Master System roms.
In order to do so, I've checked for the extra 512 bytes from old roms and once I was sure they weren't there, I proceeded to run radare2 on one ...
2
votes
1answer
80 views
Seek to value stored in memory in radare2
Using radare2, I am reverse engineering a custom language interpreter. It stores compiled functions as a list of pointers to language primitives. I would like to seek to these locations, but typing ...
0
votes
1answer
68 views
Extracting functions of .obj file (compiled by myself with Visual Studio 19) --> extracts wrong data
How can I find only real functions not data garbage like section..debug_S_105 ? *
I need to collect function data (assembler code) of Open Source C++ Files which I compile with Visual Studio 19 (sln ...
0
votes
1answer
87 views
Renaming variables radare2
I have a variable called var_14h in disassemble code. I want to rename this variable. I try to rename the variable by using the following
afvn var_14h i
However, radare complains and returns an ...
1
vote
0answers
48 views
Some obstacles in reversing a JNI Native library
I deleted my last question (it was not still answered and none's effort was wasted) as I got back and thought to re-read JNI documentation, to find I misinterpreted some bits. Things are now clearer
...
3
votes
0answers
82 views
Understanding output of rabin2
I am wondering what the crypto, linenum, pcalign, relocs and va values mean in the output of rabin2.
I took a look in the source code of radare2 and it seems for ELF va is always true, I assume it ...
5
votes
1answer
259 views
Is there any way to display the standard input and output of a program to Cutter's console while debugging?
So it's easy to transfer the standard input and output in radare2 to a new terminal using rarun2, here's how:
Debugging with radare2 using two terminals
i was wondering if i can use rarun2 with ...
2
votes
2answers
110 views
Add disassembly comment at rip in radare2
When in visual mode (command v) in radare, in the disassembly panel, I can press ; to add a comment at the location I am current seeked to (which is the top instruction in the disassembly view). I ...
0
votes
1answer
81 views
Radare2 produces null bytes on write
I've created a simple program in C that prints the text "Hello, World". I'm learning to use Radare and attempting to change the "Hello, World" string in the binary executable (PE in this case).
But ...
1
vote
0answers
53 views
Radare2 8051 code bank switching
Some of 8051 chips use bank switching to extend accessible code memory.
Good example is Silabs C8051F12x. Another example is here.
Code area in range 0x0000..0x7ffff is common always accessible code ...
0
votes
0answers
75 views
Radare2 jump/switch table walk for 8051
For 8051 target exist famous no-return function with body of
d083d082f8e4937012740193700da3a393f8740193f5828883e4737402936860efa3a3a380df
which correspond to ?C?CCASE function:
/ 38: fcn.00000000 ...
0
votes
0answers
38 views
Opening the test file in the Radare2 recording mode
I'm studying the radare2 utility (I installed it on Windows) and I wanted to edit the file with it. But an error constantly occurs:
[0x080486f5]> oo+
r_core_file_reopen: Cannot reopen file: C:\...
0
votes
1answer
217 views
How to decrypt the password using radare2 or gdb?
.--------------------------------------------------.
| [0x804851b] |
...
0
votes
1answer
82 views
Radare2 not showing memory value correctly
I am debugging a bootloader running on QEMU i386.
The issue is the red value of 0x6069 shown as zero. In reality the value is the same as register al (non zero value) and the following je happens.
...
0
votes
1answer
59 views
radare2 memory changing in debug mode
I have tiny program:
0x08048080 66a1a0900408 mov ax, word loc.name
0x08048086 66bbafbe mov bx, 0xbeaf
0x0804808a 66891da09004. mov word loc.name,...
3
votes
2answers
97 views
Get certain instruction count for multi-architecture binaries
I need to get an ELF binary's total count of
Function call instruction
conditional jump (branch) instruction
The binary could be any CPU architecture, like x64, ARM, MIPS, Motorola 68K, etc.
It ...
2
votes
0answers
37 views
How i can do several input via rarun2?
How can i do several input via rarun2, if my program requares two input?
I try this:
2
votes
1answer
207 views
Radare2 - How to debug Android native code (dynamic analysis)?
I'm using Termux(root) on LineageOS 16 (Android 9) with radare2 (v3.6.0 linux-arm32). When i attach to a process with 'r2 -d pid' the app freezes properly but doesn't continue with 'dc'. I'm not sure ...
0
votes
1answer
62 views
Radare2 substituting second operand of lea instruction with a random register
I was trying to debug a crackme with radare2. I found an interesting function which radare2 flagged as sym.xxx. The following listing is trimmed version of disassembled output of the function sym.xxx.
...
0
votes
0answers
367 views
Differences between IDA Pro and Radare2
I am familiar with Hopper Disassembler and OllyDbg as favorite and simple tools, but I would like to try switching to IDA to work on Windows.
However, I know about radare2 and that it is open source,...
1
vote
1answer
52 views
How to set search scope in radare2
Iam wondering how to change search scope in radare2. I`ve made some research and set variables search.from and search.to, according to Radare2 Book, but it doesn't work at all!
Could you help me ...
0
votes
1answer
29 views
How can I iterate over syscalls (as returned with `axt`) and rewrite them?
Let's say I want to list all calls that issue kill,
axt @ sym.imp.kill
How can I now NOP out the syscall at all of the addresses given? I want to strip the program of calls to kill.
4
votes
1answer
264 views
Radare2 ptrace can not attach
First my setup:
Linux Mint 64bit 4.15.0-20-generic
radare2 the newest version from github
/etc/sysctl.d/10-ptrace.conf = 0
Executable:
ELF 64-bit LSB executable, x86-64
read write and ...
0
votes
0answers
41 views
radare2 (v3.6.0) on windows(x64) not change registers values in debug mode
Whats wrong:
d:\radare2\bin\radare2 -A -d d:\test.exe
Spawned new process with pid 7192, tid = 8572
...
[0x014eb83c]> pd 5
ā (fcn) entry0 2066
ā entry0 ();
ā bp: 0 (vars 0, args 0)
ā sp: 0 (...
4
votes
1answer
480 views
How to do debug a running java process in linux?
TLDR I want to do live debugging of a java program on a linux machine, and don't how/what debugger to attach to the JVM to get this done.
I expect that this is a well-solved problem, but I lack the ...
1
vote
1answer
311 views
Change instruction test eax, eax to text eax, 1
I'm trying to change an instruction in assembly. Try with test eax, eax to test eax, 1. I try modify the opcodes.
For example opcode of test eax, eax: 85c0
Try to understand why is 85c0 with this ...
1
vote
0answers
137 views
write radare2 output to a file
I am trying to write all the write logs of a binary program into a file for further analysis. I am using radare2 for it. I don't know what's the issue, I am not able to write the 'dte' output to a ...
2
votes
1answer
83 views
What is actually loaded here and different hexdump outputs on util-linux hexdump and on cutter and ghidra's hexdump
I was trying to understand what segment of file gets loaded by fourth LOAD header on phdr array.
First 6 headers are shown below from readelf
Program Headers:
Type Offset ...
0
votes
2answers
109 views
Radare2 show current RIP and current instruction while stepping
How can I get the same behavior as in gdb when using disassemble-next-line on?
When I step in radare2, I just see:
[0x7fea91263220]> ds
[0x7fea91263220]> ds
[0x7fea91263220]> ds
Why doesn'...
3
votes
1answer
230 views
Illegal instruction error in simple buffer overflow
I using following C code for testing stack based simple buffer overflow
#include<stdio.h>
#include<string.h>
void copier(char *arg){
char buffer[100];
strcpy(buffer,arg);
}
int ...
2
votes
0answers
62 views
radare2 wrong output
I saw rasm2 giving different output each time for x64
Take a look at this:
C:\WINDOWS\system32>rasm2 -a x86 -b 64 -d "41f6c7FF"
test r15b, 0xff
C:\WINDOWS\system32>rasm2 -a x86 -b 64 "test ...
2
votes
1answer
66 views
Invert stack view in radare2
Is it possible to invert the stack view when debugging in radare2 such that higher addresses are at the top?
0
votes
1answer
92 views
How to view registers values in string
Is it possible that radare2 will show registers values also in strings ?
For example, when I run ar I am getting the liste of registers and I have:
rax = 0x000000042
Is there a way to also show ...
1
vote
1answer
110 views
radare2 shows main function arguments argv as pointer to char on the stack, not as pointer to pointer to char
Well, I've been digging around process command line arguments as well as environment variables a bit these last days, especially looking up the way main function arguments were pushed onto the stack. ...
4
votes
1answer
257 views
function call trace with radare2 or break on all function call
I want to script with python using r2pipe. Is there a way that when debugging I can break on each call function, thus I can get the parameter? What's more, I won't jump into system library.
Or is ...
