Questions tagged [radare2]
Opensource reverse engineering framework to disassemble, debug, analyze, manipulate binary files and more.
340
questions
0
votes
0
answers
17
views
Searching for signal calls in a Mach-O multiarch binary
I'm searching for signals call in a Mach-O mutliarch using radare2. This is what I start with:
file sample
/tmp/sample (for architecture x86_64): Mach-O 64-bit executable x86_64
/tmp/sample (for ...
- 101
1
vote
1
answer
203
views
What are the substantive differences between radare2 and rizin?
Rizin was forked from Radare2 several years ago, mainly due to human factors. At the time, there weren't any important differences in features between the two.
I understand that Rizin has rewritten ...
- 187
0
votes
0
answers
28
views
Is there any way to create alias/variable for memory-related value in Radare 2?
I wonder if it is possible in r2 to make alias for the value that repeats itself many times.
For instance:
I want to have an alias for rbp + rax - 0x1020 to be named as cwd[i].
Can it be done?
I ...
- 101
1
vote
0
answers
58
views
How to quickly exit radare2 from debug mode?
Normally in CLI apps you can use Ctrl + c / Ctrl + d to terminate/exit, but they don't seem to do anything in r2 - at least not in debugger's v (visual) mode, which is how I use it. To exit, I press q,...
- 111
1
vote
0
answers
134
views
Cyber Talent Basic Malware Reverse Engineering
I'm an absolutely beginner in the reverse engineering field. I have an exe program and I am to find:
I have tried with Ghidra but i keep getting wrong submissions for the challenge.
Here is the exe ...
- 11
1
vote
0
answers
40
views
Radare2: How to Create a Custom Scripted Panel?
TLDR: How do I get a panel in radare2 to correctly show the output of a radare2 command piped to an external script?
e.g. afvd | python var_displayer.py
This is my current view. Multiple panels, ...
- 11
3
votes
1
answer
39
views
Can radare2 skip syscall when `db main;dts+;dc`
more detailed see this
In short, I want to skip syscall when recording program, but it seems that the program would always stop after ths syscall.
Hope someone can help me. Thanks.
below is running ...
- 33
4
votes
1
answer
167
views
Mickey Mouse toy bin file analysis
I am trying to reverse engineer a Mickey Mouse toy just for fun but I am stuck.
The toy has several buttons that play various phrases and songs.
My aim was to see if I can read those songs from the ...
1
vote
0
answers
16
views
Why rarun2 is not behave like it is described?
colleagues.
Simplest question. As many articles in the Net (example https://r2wiki.readthedocs.io/en/latest/tools/rarun2/) and here on forum are describing, i have a rarun2 profile named "...
- 11
3
votes
0
answers
49
views
plugin/script for radare2 similar to mona for immunity debugger
I would like to use radare2 for windows exploit-development, however I could not find a way to emulate the functionality of using Immunity-Debugger + mona.py when checking for badchars. Is there a ...
- 31
3
votes
0
answers
67
views
Using output of a command as argument in radare2
I'm trying to use the output of a command as argument for my program that i'm trying to debug.
I created the following profile, similar to using a command output for stdin
$ cat profile.rr2
#!/usr/bin/...
- 131
1
vote
1
answer
47
views
How to know each register value instruction by instruction in a binary using radare2?
As I am using the radare2 for reverse engineering, I find it very difficult to get all the register values instruction by instruction with the help of the Radare2 tool. Could someone please help me to ...
- 39
2
votes
1
answer
49
views
Get radare2 to only display assembly code without other info
I'm using radare2 in a loop that looks similar to this:
for item in `r2 -c "aaaa" -c "afl" -qq 67b79382375cc5169d869dccca033be3786aa06a71b9bc1245cd4b935a603dc2.bin | grep -Eo "...
- 21
1
vote
0
answers
38
views
View v0, d0 registers in Cutter (ARM64)
When reversing an ARM64 binary in Cutter 2.1, I wanted to emulate certain instructions and view the values that were computed. Cutter's emulation showed the x0-x31 registers but how do I view the v0....
- 193
1
vote
0
answers
165
views
radare2: How to load a DLL along with the application?
I am reverse engineering a Windows application for which there is no PDB file available.
When loading it in r2, I get the following imports (They are correct):
nth vaddr bind type lib ...
- 11
0
votes
2
answers
163
views
Radare2 - changing stdin during binary debugging
I'd like to know how to change stdin multiple times for the given binary for debugging purposes.
I know I can launch the application with
r2 -r profile.r2 -d binary
Where, inside the profile.r2 file ...
- 33
3
votes
1
answer
663
views
STM32 - Disable Voltage Check
I'm planning to edit the binary Firmware for an STM32F030K6T6 ARM microcontroller used in the IKEA Fyrtur blinds. In particular I'm trying to
disable the Voltage check (allow alternative power source)...
- 131
3
votes
1
answer
197
views
Radare2 - Saving information/metadata from a debugging session
I'd like to know how I can save/restore comments or possibly other metadata during a debugging session.
I know how to save this data when running radare without the -d flag but I often need to debug ...
- 33
2
votes
2
answers
306
views
Examining memory without attaching to the process by using /proc/$PID/mem?
I have a gap in my understanding and tooling. Now I would prefer to use Radare2, but will consider any answer. Let's use this program as an example.
#include <stdio.h>
#include <unistd.h>
...
- 1,769
0
votes
1
answer
453
views
How can I use cutter like ida, trying to search by address
I'm new to reverse engineering and I'm trying to get into using a disassembler - I've been using reclass for a while now. I was looking at IDA Pro and that was 7k euros so that was not an option. I've ...
0
votes
1
answer
207
views
Radare2's equivalent of GDB's Radare2's equivalent of GDB's set $reg 0x2020
I would really like to change the registers during radare2's debugging sessiong. In GDB,
set $reg 0x2020
was very useful.
1
vote
2
answers
421
views
Changing the jne to je instruction causes program to generate error
I'm trying to change the instruction from jne to je
I've change an instruction
75 0c jne [some_location]
75 0c is a 2 jump instruction.
So, I've a chaged it to from 75 0c to 74 0c which is ...
- 63
2
votes
1
answer
74
views
Radare2 only printing out the last byte at RSP when using pxq @ rsp
According to documentation,
px[?][owq] [len] hexdump of N bytes (o=octal, w=32bit, q=64bit)
and
pr[?][glx] [len] print N raw bytes (in lines or hexblocks,
'g'unzip)
These two ...
- 63
2
votes
1
answer
70
views
How to make the default stack width/offset 8 bytes when debgging in radare2
If you start radare2 in debugging mode like:
r2 -d /usr/bin
you'll be prompted with something similar to:
If you press V for the prompt, you get debugging view with panels. Then, if you select the ...
- 63
1
vote
1
answer
211
views
How do you change the stack width/offset in radare2?
Currently, my stack view is 0x10 (16) bytes long.
How do I change it so that the stack view is 8 bytes long?
Edit:
I have tried tabbing into the stack window, pressing e, and then typing pxr 256@r:SP ...
- 63
3
votes
0
answers
67
views
Cutter console does not show printf result
I'm using last version (2.0.5) of Cutter. I am not able to find a way to display std in/out in Cutter Console. In the picture I cleared the console before starting debugging and you can see it after ...
- 31
2
votes
0
answers
80
views
Specifying multiple input files in radare2
If I want to pass several inputs, I know that I can write this with rarun2:
#!/usr/bin/rarun2
stdin="first\nsecond\n"
But what if I want to pass the input from a file file1 at the first ...
- 21
0
votes
1
answer
38
views
radare2 convenience variables
gdb allows setting arbitrary convenience variables:
set $a = "test"
set $b = 3
p $a # => "test"
p $b # => 3
Is there a way to do something similar in radare2? I'd like to be ...
- 187
0
votes
1
answer
302
views
How to insert asm code in file without overwriting in Radare2
I am learning reverse engineering tools.
I notice that when you need to patch some file (at least in visual mode) you need to overwrite instructions, i.e. when using Shift+A in visual mode or I in ...
- 113
1
vote
1
answer
84
views
File not want to patch. Radare2
I am learning by doing some cracking in files that i made in C. One of this files is this:
file.c:
#include <stdio.h>
#include <stdlib.h>
int main() {
char s[15] = "...
- 113
1
vote
0
answers
94
views
radare2 Loop over literal strings for search
In radare2, I can search and grep e.g. / needle ~:0 2>/dev/null. How I can I do that in a loop for multiple needles? E.g. something like for n in needle1 needle2 needle3; do / $n ~:0 2>/dev/...
- 187
1
vote
0
answers
116
views
Radare2 Load file from stdin fails
Radare2 supports loading a file from stdin via =. However, my attempts to use it don't work:
$ r2 /bin/ls
Warning: run r2 with -e bin.cache=true to fix relocations in disassembly
[0x00006810]> q
$ ...
- 187
1
vote
2
answers
241
views
How can I tell radare2 to show me a constant's value in disassembly
In radare2, I can disassemble like:
0x004006f0]> pd 3
...
0x004006f0 ff2532092000 jmp qword [reloc.callme_three] ; [0x601028:8]=0x4006f6
0x004006f6 6802000000 push 2 ...
- 187
1
vote
1
answer
1k
views
How can I use radare2 to list all xrefs to a string?
radare2 can list all strings with iz , and list all functions with afl. How can I use radar2e to list the XREFs for each string? That is, for each string, which funcs reference it?
I'd like to be ...
- 187
3
votes
1
answer
623
views
Free alternative to Lighthouse Code Coverage Explorer?
I was trying to find if there is any free tool that allows an output similar to Lighthouse. I want to highlight the code paths taken so that I only reverse engineer the parts that are being executed. ...
- 61
2
votes
0
answers
979
views
Radare2 cannot open bin for writing
Im on Kali and im using Radare2 but it says
r2 -d bin
Killing child process 16151 due to an error
Killing child process 16152 due to an error
[w] Cannot open 'dbg://./bin' for writing.
I tried chmod +...
- 21
1
vote
1
answer
152
views
print format in radare2 cannot output all my string
I was doing a CTF challenge and I need to see the value of RAX register in radare2.
I first dumped all of printable ascii characters as input, one of the function encoded the input and spit out the ...
1
vote
0
answers
93
views
Function Arguments/Name on Radare and IDA
I am starting with reverse engineering and Radare and I'm facing the following problem, on IDA Free I see the following code:
mov ecx, 11h
lea edi, [esp+1208h+StartupInfo]
rep stosd
lea ...
- 11
2
votes
1
answer
494
views
what is the difference between pd $s and pdf @@f in Radare2
I've tried searching around on how to disassemble a whole binary. I found that pd $s and pdf @@f are the 2 commands suggested most widely. I could understand the working of the latter, but I don't see ...
- 123
2
votes
1
answer
1k
views
How can I find an external function code correctly in Ghidra and Radare2?
This is a code to call an external function(get_random_name) in the main function
push {fp, lr}
add fp, sp, 4
sub sp, sp, 0x1d8
str r0, [fp, -0x1d8]
str r1, [fp, -0x1dc]
sub r3, fp, 0x44
...
- 109
1
vote
1
answer
958
views
radare2 unable to run a binary file
I've been trying to debug a binary file in radare2 but it throws me this error.
$ r2 -d bin
Killing child process 1688 due to an error
Killing child process 1689 due to an error
[...
- 151
1
vote
0
answers
64
views
Change return value of a boolean function in arm library
I have an android library (arm cpu) that have a function named GetEisLinkWithDfr() that have a single line that returns boolean value of "true", and I want it to return a value of "...
- 11
3
votes
1
answer
271
views
`af` does not seem to find all functions in Radare2
The disassembly at the entry point looks like this:
: ;-- entry0:
: ;-- _mainCRTStartup:
: ;-- eip:
: 0x004014e0 83ec0c sub esp, 0xc
: ...
- 319
2
votes
1
answer
160
views
Radare2 does not reload payload correctly
I'm new to Radare2 so i'm trying to learn it by doing some basic buffer overflows. My problem is that, when i try to load some payloads, the stack seems to fake them in some differents ways...
For ...
- 23
3
votes
1
answer
152
views
`af` vs `afr` in Radare2
I am trying to understand the difference between analyze functions and analyze functions recursively in Radare2. Given a code snippet like this:
#include <stdio.h>
void b() {
printf("b ...
- 319
1
vote
1
answer
126
views
Radare2 - "/c pointer; offset" command not giving expected response to search instances of the same pair of similar instructions
I am trying to find an offset IOSURFACEROOTUSERCLIENT_VTAB from an iOS kext(IOSurface) using radare2 and there is a need to use the command "/c pointer; offset" as per the instructions in ...
- 63
0
votes
1
answer
124
views
What does anal.hasnext actually do?
I am trying to understand anal.hasnext control flow configuration option of Radare. The documentation says "Continue analysis after each function. Forces to find a function, after the end of a ...
- 319
2
votes
1
answer
332
views
How to reverse engineer structs in radare2?
Is there any way to indentify structs in radare2?
when i tried to look them, they look like normal variables, i seen people using td and tl command but I don't know how to use them. If you know please ...
- 45
0
votes
0
answers
81
views
Radare2 is showing weird disassembly as compared to disassembly of gcc
Today i was playing around with c code in r2.
I compiled a file which had the following code.
#include <stdio.h>
int main(){
int a=9;
float b=1.1;
int sum;
sum = ...
- 45
0
votes
1
answer
84
views
Interpret radare2 help
So I run radare2 from the command line with r2 - and attempt to display the help with the ? command. I read this line which says:
?[??][expr] Help or evaluate math expression
I am not ...
- 319