Questions tagged [radare2]

Opensource reverse engineering framework to disassemble, debug, analyze, manipulate binary files and more.

Filter by
Sorted by
Tagged with
0 votes
0 answers
42 views

Unknown Mitsubishi automotive MCUs - are these using unknown architecture?

Please help ientify the architecture (ISA) of MH8200F and MH8110F which is found almost exclusively on Mazda ECUs with L3CK, L587, L5E8, LFAR, LFFR, LFJP firmwares I've revealed that the MH8501F is ...
Andy's user avatar
  • 1
0 votes
1 answer
52 views

radare2 cross reference problem

I am analyzing an Arm64 Android shared library and I am trying to find a pointer to dlopen. I have successfully manually achieved this in IDA64 and Ghidra, however I want to automate the process with ...
shluvme's user avatar
  • 111
0 votes
0 answers
36 views

radare2 on an architecture with custom instructions

I am exploring RISC-V binaries that contain custom instructions. Is there a way to add them to the disassembler?
confusedandsad's user avatar
1 vote
0 answers
46 views

How can I create a radare2 type for a variable-length struct?

I'm trying to parse a binary file and it has a structure similar to this, struct foo { int64_t count_things; int64_t offset_to_thing[count]; int8_t bytes[]; int64_t other fields; } ...
Evan Carroll's user avatar
  • 1,779
0 votes
0 answers
31 views

Why can't I resolve the 'system' dynamic addresss in ret_2_libc exploit?

First and foremost, I am a noob pwner. The problem at hand is from TryHackMe.com > pwn101 > pwn109. A simple ret_2_libc in which you exploit a simple buffer overflow, leak the addresses of gets()...
Christian Sanchez's user avatar
0 votes
1 answer
337 views

i need software to decode this subtitle xml file, anyone know what it encodes with?

This is a subtitle file encoded by xml, is there any way to decode this xml file to srt? Subtitle link xml
Đức Nguyễn's user avatar
0 votes
1 answer
98 views

Cracking cryptographic function with radare2

I want to reverse engineer an android game, found a method public static byte[] MNNOPKMJMFP(byte[] AFFEPNLBIIC, byte[] OENOGNMAMPO, byte[] GLLEHJKGIBK) { } Names are obfuscated, i know that this is a ...
Gold Moon's user avatar
0 votes
0 answers
29 views

Searching for signal calls in a Mach-O multiarch binary

I'm searching for signals call in a Mach-O mutliarch using radare2. This is what I start with: file sample /tmp/sample (for architecture x86_64): Mach-O 64-bit executable x86_64 /tmp/sample (for ...
Plup's user avatar
  • 101
3 votes
1 answer
1k views

What are the substantive differences between radare2 and rizin?

Rizin was forked from Radare2 several years ago, mainly due to human factors. At the time, there weren't any important differences in features between the two. I understand that Rizin has rewritten ...
SRobertJames's user avatar
1 vote
0 answers
66 views

Is there any way to create alias/variable for memory-related value in Radare 2?

I wonder if it is possible in r2 to make alias for the value that repeats itself many times. For instance: I want to have an alias for rbp + rax - 0x1020 to be named as cwd[i]. Can it be done? I ...
satk0's user avatar
  • 111
2 votes
0 answers
175 views

How to quickly exit radare2 from debug mode?

Normally in CLI apps you can use Ctrl + c / Ctrl + d to terminate/exit, but they don't seem to do anything in r2 - at least not in debugger's v (visual) mode, which is how I use it. To exit, I press q,...
Mihai Rotaru's user avatar
1 vote
0 answers
158 views

Cyber Talent Basic Malware Reverse Engineering

I'm an absolutely beginner in the reverse engineering field. I have an exe program and I am to find: I have tried with Ghidra but i keep getting wrong submissions for the challenge. Here is the exe ...
Sheddymax's user avatar
1 vote
0 answers
64 views

Radare2: How to Create a Custom Scripted Panel?

TLDR: How do I get a panel in radare2 to correctly show the output of a radare2 command piped to an external script? e.g. afvd | python var_displayer.py This is my current view. Multiple panels, ...
Khalid's user avatar
  • 11
3 votes
1 answer
44 views

Can radare2 skip syscall when `db main;dts+;dc`

more detailed see this In short, I want to skip syscall when recording program, but it seems that the program would always stop after ths syscall. Hope someone can help me. Thanks. below is running ...
An5Drama's user avatar
  • 133
4 votes
1 answer
187 views

Mickey Mouse toy bin file analysis

I am trying to reverse engineer a Mickey Mouse toy just for fun but I am stuck. The toy has several buttons that play various phrases and songs. My aim was to see if I can read those songs from the ...
George Farcas's user avatar
1 vote
0 answers
21 views

Why rarun2 is not behave like it is described?

colleagues. Simplest question. As many articles in the Net (example https://r2wiki.readthedocs.io/en/latest/tools/rarun2/) and here on forum are describing, i have a rarun2 profile named "...
Roman's user avatar
  • 11
3 votes
0 answers
59 views

plugin/script for radare2 similar to mona for immunity debugger

I would like to use radare2 for windows exploit-development, however I could not find a way to emulate the functionality of using Immunity-Debugger + mona.py when checking for badchars. Is there a ...
s1gsegv's user avatar
  • 31
3 votes
0 answers
95 views

Using output of a command as argument in radare2

I'm trying to use the output of a command as argument for my program that i'm trying to debug. I created the following profile, similar to using a command output for stdin $ cat profile.rr2 #!/usr/bin/...
Mime's user avatar
  • 131
1 vote
1 answer
57 views

How to know each register value instruction by instruction in a binary using radare2?

As I am using the radare2 for reverse engineering, I find it very difficult to get all the register values instruction by instruction with the help of the Radare2 tool. Could someone please help me to ...
okokok hack's user avatar
2 votes
1 answer
67 views

Get radare2 to only display assembly code without other info

I'm using radare2 in a loop that looks similar to this: for item in `r2 -c "aaaa" -c "afl" -qq 67b79382375cc5169d869dccca033be3786aa06a71b9bc1245cd4b935a603dc2.bin | grep -Eo "...
user42071's user avatar
1 vote
0 answers
47 views

View v0, d0 registers in Cutter (ARM64)

When reversing an ARM64 binary in Cutter 2.1, I wanted to emulate certain instructions and view the values that were computed. Cutter's emulation showed the x0-x31 registers but how do I view the v0....
localacct's user avatar
  • 193
1 vote
0 answers
259 views

radare2: How to load a DLL along with the application?

I am reverse engineering a Windows application for which there is no PDB file available. When loading it in r2, I get the following imports (They are correct): nth vaddr bind type lib ...
movzxb's user avatar
  • 11
0 votes
2 answers
256 views

Radare2 - changing stdin during binary debugging

I'd like to know how to change stdin multiple times for the given binary for debugging purposes. I know I can launch the application with r2 -r profile.r2 -d binary Where, inside the profile.r2 file ...
Gordon Zar's user avatar
3 votes
1 answer
989 views

STM32 - Disable Voltage Check

I'm planning to edit the binary Firmware for an STM32F030K6T6 ARM microcontroller used in the IKEA Fyrtur blinds. In particular I'm trying to disable the Voltage check (allow alternative power source)...
vincent's user avatar
  • 131
3 votes
1 answer
282 views

Radare2 - Saving information/metadata from a debugging session

I'd like to know how I can save/restore comments or possibly other metadata during a debugging session. I know how to save this data when running radare without the -d flag but I often need to debug ...
Gordon Zar's user avatar
2 votes
2 answers
341 views

Examining memory without attaching to the process by using /proc/$PID/mem?

I have a gap in my understanding and tooling. Now I would prefer to use Radare2, but will consider any answer. Let's use this program as an example. #include <stdio.h> #include <unistd.h> ...
Evan Carroll's user avatar
  • 1,779
1 vote
1 answer
703 views

How can I use cutter like ida, trying to search by address

I'm new to reverse engineering and I'm trying to get into using a disassembler - I've been using reclass for a while now. I was looking at IDA Pro and that was 7k euros so that was not an option. I've ...
Dankri jk's user avatar
0 votes
1 answer
256 views

Radare2's equivalent of GDB's Radare2's equivalent of GDB's set $reg 0x2020

I would really like to change the registers during radare2's debugging sessiong. In GDB, set $reg 0x2020 was very useful.
Happy Jerry's user avatar
1 vote
2 answers
614 views

Changing the jne to je instruction causes program to generate error

I'm trying to change the instruction from jne to je I've change an instruction 75 0c jne [some_location] 75 0c is a 2 jump instruction. So, I've a chaged it to from 75 0c to 74 0c which is ...
user40683's user avatar
2 votes
1 answer
91 views

Radare2 only printing out the last byte at RSP when using pxq @ rsp

According to documentation, px[?][owq] [len]    hexdump of N bytes (o=octal, w=32bit, q=64bit) and pr[?][glx] [len]    print N raw bytes (in lines or hexblocks, 'g'unzip) These two ...
user40683's user avatar
2 votes
1 answer
77 views

How to make the default stack width/offset 8 bytes when debgging in radare2

If you start radare2 in debugging mode like: r2 -d /usr/bin you'll be prompted with something similar to: If you press V for the prompt, you get debugging view with panels. Then, if you select the ...
user40683's user avatar
1 vote
1 answer
294 views

How do you change the stack width/offset in radare2?

Currently, my stack view is 0x10 (16) bytes long. How do I change it so that the stack view is 8 bytes long? Edit: I have tried tabbing into the stack window, pressing e, and then typing pxr 256@r:SP ...
user40683's user avatar
3 votes
0 answers
73 views

Cutter console does not show printf result

I'm using last version (2.0.5) of Cutter. I am not able to find a way to display std in/out in Cutter Console. In the picture I cleared the console before starting debugging and you can see it after ...
Luigi 's user avatar
  • 31
2 votes
0 answers
97 views

Specifying multiple input files in radare2

If I want to pass several inputs, I know that I can write this with rarun2: #!/usr/bin/rarun2 stdin="first\nsecond\n" But what if I want to pass the input from a file file1 at the first ...
Aramya's user avatar
  • 21
0 votes
1 answer
39 views

radare2 convenience variables

gdb allows setting arbitrary convenience variables: set $a = "test" set $b = 3 p $a # => "test" p $b # => 3 Is there a way to do something similar in radare2? I'd like to be ...
SRobertJames's user avatar
0 votes
1 answer
358 views

How to insert asm code in file without overwriting in Radare2

I am learning reverse engineering tools. I notice that when you need to patch some file (at least in visual mode) you need to overwrite instructions, i.e. when using Shift+A in visual mode or I in ...
Guilherme's user avatar
  • 113
1 vote
1 answer
107 views

File not want to patch. Radare2

I am learning by doing some cracking in files that i made in C. One of this files is this: file.c: #include <stdio.h> #include <stdlib.h> int main() { char s[15] = "...
Guilherme's user avatar
  • 113
1 vote
0 answers
117 views

radare2 Loop over literal strings for search

In radare2, I can search and grep e.g. / needle ~:0 2>/dev/null. How I can I do that in a loop for multiple needles? E.g. something like for n in needle1 needle2 needle3; do / $n ~:0 2>/dev/...
SRobertJames's user avatar
1 vote
0 answers
147 views

Radare2 Load file from stdin fails

Radare2 supports loading a file from stdin via =. However, my attempts to use it don't work: $ r2 /bin/ls Warning: run r2 with -e bin.cache=true to fix relocations in disassembly [0x00006810]> q $ ...
SRobertJames's user avatar
1 vote
2 answers
304 views

How can I tell radare2 to show me a constant's value in disassembly

In radare2, I can disassemble like: 0x004006f0]> pd 3 ... 0x004006f0 ff2532092000 jmp qword [reloc.callme_three] ; [0x601028:8]=0x4006f6 0x004006f6 6802000000 push 2 ...
SRobertJames's user avatar
1 vote
1 answer
2k views

How can I use radare2 to list all xrefs to a string?

radare2 can list all strings with iz , and list all functions with afl. How can I use radar2e to list the XREFs for each string? That is, for each string, which funcs reference it? I'd like to be ...
SRobertJames's user avatar
3 votes
1 answer
787 views

Free alternative to Lighthouse Code Coverage Explorer?

I was trying to find if there is any free tool that allows an output similar to Lighthouse. I want to highlight the code paths taken so that I only reverse engineer the parts that are being executed. ...
Abhay Nayar's user avatar
2 votes
0 answers
1k views

Radare2 cannot open bin for writing

Im on Kali and im using Radare2 but it says r2 -d bin Killing child process 16151 due to an error Killing child process 16152 due to an error [w] Cannot open 'dbg://./bin' for writing. I tried chmod +...
JyanJohn's user avatar
1 vote
1 answer
178 views

print format in radare2 cannot output all my string

I was doing a CTF challenge and I need to see the value of RAX register in radare2. I first dumped all of printable ascii characters as input, one of the function encoded the input and spit out the ...
Haekal Al Ghifary's user avatar
1 vote
0 answers
105 views

Function Arguments/Name on Radare and IDA

I am starting with reverse engineering and Radare and I'm facing the following problem, on IDA Free I see the following code: mov ecx, 11h lea edi, [esp+1208h+StartupInfo] rep stosd lea ...
secjav's user avatar
  • 11
2 votes
1 answer
635 views

what is the difference between pd $s and pdf @@f in Radare2

I've tried searching around on how to disassemble a whole binary. I found that pd $s and pdf @@f are the 2 commands suggested most widely. I could understand the working of the latter, but I don't see ...
Moltres's user avatar
  • 123
2 votes
1 answer
2k views

How can I find an external function code correctly in Ghidra and Radare2?

This is a code to call an external function(get_random_name) in the main function push {fp, lr} add fp, sp, 4 sub sp, sp, 0x1d8 str r0, [fp, -0x1d8] str r1, [fp, -0x1dc] sub r3, fp, 0x44 ...
three2zero's user avatar
1 vote
1 answer
1k views

radare2 unable to run a binary file

I've been trying to debug a binary file in radare2 but it throws me this error. $ r2 -d bin Killing child process 1688 due to an error Killing child process 1689 due to an error [...
Nimrod's user avatar
  • 151
1 vote
0 answers
67 views

Change return value of a boolean function in arm library

I have an android library (arm cpu) that have a function named GetEisLinkWithDfr() that have a single line that returns boolean value of "true", and I want it to return a value of "...
Bilux's user avatar
  • 11
3 votes
1 answer
370 views

`af` does not seem to find all functions in Radare2

The disassembly at the entry point looks like this: : ;-- entry0: : ;-- _mainCRTStartup: : ;-- eip: : 0x004014e0 83ec0c sub esp, 0xc : ...
user1720897's user avatar

1
2 3 4 5
7