Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [radare2]

Opensource reverse engineering framework to disassemble, debug, analyze, manipulate binary files and more.

1
vote
1answer
40 views

How to make Radare2 automatically disassemble next instruction after each `ds` debug single-step?

How to make Radare2 automatically disassemble next instruction after each ds debug single-step? I thought that e asm.bytes=1 would achieve this, but that doesn't help. In particular, GDB supports ...
1
vote
1answer
30 views

Radare2 doesn't update current address, when single-step debugging using `ds`?

Radare2 doesn't update current address, when single-step debugging using ds? I'm debugging an ELF binary on Linux using single-step (ds). The problem is that the current address at the prompt doesn't ...
1
vote
1answer
34 views

How to get the memory-mapping (e.g. library) that contains a given address in Radare?

How to get the memory-mapping (e.g. library) that contains a given address in Radare? I've done a search in Radare for a specific string (search.in = dbg.maps), which resulted in an address. Now, I ...
0
votes
0answers
38 views

Find usage of string in object file with radare2

I have some compiled code and would like to use Cutter (Radare2) to find the place where a certain static string is printed out. The code is an object file, compiled for ARM, and to be included with ...
0
votes
1answer
31 views

How to identify different memory regions of an elf binary in radare2?

I'm just starting out with reverse engineering, one thing I'm finding difficult is identifying different areas of memory. I'm using radare2, and I would like to be able to easily seek and identify ...
5
votes
2answers
657 views

Writing ELF headers in Radare?

Reading Keith Makan's, "Introduction to the ELF Format : The ELF Header", he modifies e_entry, The e_entry field lists the offset in the file where the program should start executing.Normally it ...
1
vote
1answer
36 views

Make r2 -i <script> use python3 rather than python2

I have a r2 script that I'm running with r2 -i script.py test.x. By default this command uses python2. How can I get it to use python3? I couldn't find anything in the config.
1
vote
1answer
56 views

Radare's `aaaa` and -AA what does it do, exactly?

When I run aaa, Radare tells me, [x] Use -AA or aaaa to perform additional experimental analysis. But what does aaaa do? It's not documented under aa? nor aaa? nor [0x000028e0]> aaa? Usage: See ...
1
vote
1answer
39 views

Learning fine grained analysis in Radare with `a`?

The Radare community generally seems to look down upon simply running AAA or AAAA claiming that you need to instead learn the fine grained analysis and what they do. However, there seems to be no ...
2
votes
2answers
61 views

Writing a file with radare2 `w`?

Radare2 supports a w which writes a string. w foobar write string 'foobar' However, it doesn't seem to work for me, touch foo radare2 ./foo w foobar The file foo remains empty. Am I ...
2
votes
0answers
85 views

How to save Radare2 Analysis?

How do I save a radare2 session after I did "aa"? I know there is a command for saving a project, but this isn't working out for some reason (Ps PROJECTNAME). So I am looking for a way to save my ...
1
vote
0answers
57 views

Techniques for reversing (basic) hash function

Hi I'm relatively new to RE, and I'm using GDB and Radare2. As part of a crackme I'm trying to reverse a weak hash function that's a little too complicated for me to undo by hand. I've been trying to ...
0
votes
0answers
28 views

Does Radare offer the ability to invoke the linker and disassemble a function (import or reloc)?

Sometimes I'm doing static analysis outside of the debugger, and I want to see what a function that a symbol points to will do after the linker does runtime relocation. All I see in the disassembly is ...
0
votes
1answer
21 views

Does the Radare Debugger support STABS?

From the wiki on Stabs stabs (sometimes written STABS) is a debugging data format for storing information about computer programs for use by symbolic and source-level debuggers. Does Radare ...
1
vote
1answer
32 views

How do I read the “ascii-art bar of metadata in file boundaries”?

Radare2 has an option, p-, Usage: p-[hj] [nblocks] bar|json|histogram blocks | p- show ascii-art bar of metadata in file boundaries | p-h show histogram analysis of metadata per block | p-j ...
1
vote
2answers
42 views

Getting a high level overview of comparative size differences of binary files?

I have two binary files, one of them is pulled from Protostar's (stack0 example). The other one I compiled (from source) with the latest version of GCC. The size difference is massive. My version is ...
0
votes
1answer
55 views

Is there a way to get an instruction count with Radare2?

Let's say I want to find out how many instructions an arbitrary function foo decodes to, is there an easy way to do this? I'm trying to check against a version I am compiling with a stored binary on ...
0
votes
2answers
68 views

Debugging a process running in a Virtual Machine with Radare2?

Is there anyway to debug a process running on a Virtual Machine (guest) with Radare2 from the host? I'm currently using VirtualBox. It provides a built in debugger. I'm not sure if it's possible for ...
3
votes
0answers
37 views

radare2 difference between function offset and minbound

I am trying to understand the difference between a function's offset and its minbound in radare2. Consider this function in radare2 (output of aflj): { "offset": 4549740, "name": "...
0
votes
0answers
24 views

How can I get MIPS function cross-reference in radare2?

0x00418130 8f998054 lw t9, -0x7fac(gp) ; [0x4421a0:4]=0x8f998010 ; sym.imp.strcpy | 0x00418134 27b10018 addiu s1, sp, 0x18 | 0x00418138 00a08021 ...
1
vote
0answers
25 views

Radare2: pd command ignores cfg.bigendian setting

I am currently using radare2 to disassemble a raw ARM binary (bootloader) in little endian format. I used the command e cfg.bigendian = false to set the endianness, but the pd command seems to ignore ...
2
votes
0answers
46 views

Understanding ESIL

I cross-compiled a simple program with the aarch-linux-gnu-gcc compiler for ARM. So the machine is "ARM aarch64". I want to understand a single instruction and it's realization in ESIL. The opcode of ...
1
vote
2answers
100 views

Can I search Radare's help system?

Radare2 seems to have thousands of commands. Is there a way to search all of those commands? Like let's say I want to find all commands that had rot (for rot13), is there a method to do this?
1
vote
1answer
41 views

What does paddr, baddr, laddr, haddr, and hvaddr refer to?

When I run ie, I get multiple addresses. [0x41417641]> ie [Entrypoints] vaddr=0x080483d0 paddr=0x000003d0 baddr=0x08048000 laddr=0x00000000 haddr=0x00000018 hvaddr=0x08048018 type=program What ...
0
votes
2answers
37 views

`dmi libc puts~GLOBAL` does not show puts, just putspent?

On the tutorial by Megabeets, "A journey into Radare 2 – Part 2: Exploitation" [0x080483d0]> dmi libc puts~&GLOBAL, puts:0 532 0x000fdd60 0xf7e0bd60 GLOBAL FUNC 1181 putspent [0x080483d0]&...
2
votes
1answer
42 views

What does the `$r` do in `pd $r`?

I was just looking at the Megabeets tutorial again, and it he has, pd $r @ main I don't see the the $r explained anywhere though. What does $r do in that? It's also not explained in pd?
0
votes
1answer
41 views

Does RAX2 support setting bit width?

Is there anyway to set the width of the twos compliment used in binary display =2? 2 10b -2 1111111111111111111111111111111111111111111111111111111111111110b I would like to see a 3bit signed twos ...
3
votes
1answer
48 views

How do I view the registers as signed intergers?

Is there any way to view the results of something like dr= in signed interger form? > dr rax = 298; dr rdx = 42; dr= rax 0x0000012a rbx 0x00000000 rcx 0x00000000 rdx ...
7
votes
1answer
94 views

Radare2 Call $+5 and register-based cross-references not found

I have a library of ~65MB which uses this "technique" as a kind of PIC. First, it gets some kind of base address (it is always the same): 0x00708497 e800000000 call 0x70849c 0x0070849c ...
5
votes
2answers
97 views

Understanding branch delay slots for reversing MIPS

I am statically reversing some software compiled for an Atheros AR7161 using radare2. This processor implements MIPS, and I do recall that MIPS has a branch delay slot. This is indeed noticeable in ...
2
votes
1answer
55 views

Radare2 webui - need help setting it up

How can you set up Radare2 webui in Kali or Ubuntu or any other OS? I've tried so many different methods but none of them have worked so far. I think both of them are debian based so that might be ...
1
vote
2answers
71 views

What is a “trit”?

With Radare when I do ?, I get a list of answers in the result, [0x00400a04]> ? -0x120 + 0x110 hex 0xfffffffffffffff0 octal 01777777777777777777760 unit 17179869184.0G segment fffff000:...
2
votes
1answer
70 views

How can you get the symbol visibility with radare?

I created a quick x86_64 Assembly file with NASM to generate the four different visibility classes for ELF 64. With readelf --symbols I get the Symbol Visibility in the Vis column: DEFAULT, INTERNAL, ...
1
vote
1answer
69 views

Working with 16bit offsets and segments in Radare2

I have a simple DOS COM program which I want to analyse using Radare2: USE16 ORG 100h mov ax, cs dec ax mov ds, ax mov dx, message+10h mov ah, 9 int 21h ret message: db "Hello ...
1
vote
1answer
45 views

Addresses displayed in radare2

I am disassembling a binary with radare2 and I see some lines like this: | 0x004007f1 488b05981820. mov rax, qword [0x00602090] ; 0x602090:8]=0x400c60 I do not understand, what are the addresses ...
0
votes
1answer
91 views

Symbolic simplifications in radare2

Let's have a look to this assembly code in radare2: xxxxxxx mov rax,rbx xxxxxxx add rax,rax xxxxxxx add rax,rbx xxxxxxx shl rax,2 yyyyyyy nop Is there a way to ask radare2 to evaluate rax value ...
1
vote
1answer
131 views

Disassemble all functions with radare2

The pdf command is able to disassemble a function in radare2. Is there a way to disassemble all functions of a binary in a single radare2 command ?
1
vote
2answers
107 views

Get function from memory address with radare2

Lets suppose I have a memory address. This address points to an instruction. This instruction is inside a function. Is there a way to ask radare2 to search the beginning of this function, given the ...
0
votes
1answer
99 views

What does “Missing cjmp bb in predecessor” mean?

In new builds of Radare, I'm getting Missing cjmp bb in predecessor at 0x1006aa416 What does this mean? I filed a bug on this here. But, it was answered with Thanks for reporting but this is a ...
4
votes
1answer
83 views

Heap Chunk Structure Does Not Contain Previous Section Info

I'm reading Shellcoder's Handbook to learn more about exploitation and overflows. I reached the chapter on Heap Overflows. The book mentions that a heap is split into chunks where each chunk contains ...
2
votes
2answers
46 views

Headers for `iz` and such in key=value format?

In the MegaBeets tutorial, "A journey into Radare 2 – Part 1: Simple crackme" the authors iz has, vaddr=0x08048700 paddr=0x00000700 ordinal=000 sz=21 len=20 section=.rodata type=ascii string=\n .:: ...
1
vote
1answer
46 views

radare2 labels are not displayed in jmp instructions

Let's take an example of a 64 bits elf executable disassembled with pdf command in radare2: ... 0x00400ac0 0f859c000000 jne 0x400b62 ... 0x00400b62 90 nop ... I want to put a ...
3
votes
1answer
290 views

How to find a memory address of variable?

This question seems so basic but I have spent 5+ hours trying to figure it out. I have written a program in C++ that defines a few variables and does some other stuff. What I want to do in Radare2 is ...
2
votes
0answers
36 views

Cannot open '/proc/…/maps': No such file or directory in radare2 debug mode

When I try to load a program to radare2 debug mode, most of the time I get the following error: $sudo r2 -d a.out Hello world!= attach 2851 2851 Cannot open '/proc/2851/maps': No such file or ...
1
vote
0answers
47 views

Can Radare2 emulate null pointer exceptions and others?

I'm wondering if anyone has had any luck with Radare2's configuration variables, esil.exectrap, esil.iotrap, and esil.nonull while emulating? xor eax, eax mov eax, dword [eax] <- From what I can ...
2
votes
1answer
214 views

grep -E with Radare2

With Radare2, I love the iI command. I want to limit the output with grep or radare's own grep syntax. How do I run a iI | grep -E 'bits | pic | stripped' against my binary? [0x100001200]> iI ...
0
votes
1answer
81 views

Radare2 - How to scale panel height in visual panels mode?

Visual Panels Mode (V!): I need more space (height) for RegisterRefs and less for Registers (its 50% blank anyway). How can i do that? I can move the vertical split with H and L but i couldn't find ...
2
votes
0answers
72 views

Radare2 - How to save/restore metadata in debug session (BPs, flag, comments..)?

How can i save/reuse/preserve Radare2 metadata (BPs, comments, flags..) of a debug session for a new debug session? I restart the debugger alot and preserving environment would be very helpful. I ...
3
votes
1answer
225 views

Radare2 debugging - How to get into lazy imported functions?

I have a linux binary that imports functions from an external library (shared object). The functions are lazy loaded and not available when rip is at @main or @entry. When i step into such a function (...
1
vote
0answers
146 views

radare2 not showing function names

I'm using radare2 and I've noticed that it simply prints function offsets rather than function names. I've done some tests and I've discovered that on Kali it prints offsets and on debian it prints ...