Questions tagged [radare2]

Opensource reverse engineering framework to disassemble, debug, analyze, manipulate binary files and more.

Filter by
Sorted by
Tagged with
0 votes
0 answers
17 views

Searching for signal calls in a Mach-O multiarch binary

I'm searching for signals call in a Mach-O mutliarch using radare2. This is what I start with: file sample /tmp/sample (for architecture x86_64): Mach-O 64-bit executable x86_64 /tmp/sample (for ...
Plup's user avatar
  • 101
1 vote
1 answer
203 views

What are the substantive differences between radare2 and rizin?

Rizin was forked from Radare2 several years ago, mainly due to human factors. At the time, there weren't any important differences in features between the two. I understand that Rizin has rewritten ...
SRobertJames's user avatar
0 votes
0 answers
28 views

Is there any way to create alias/variable for memory-related value in Radare 2?

I wonder if it is possible in r2 to make alias for the value that repeats itself many times. For instance: I want to have an alias for rbp + rax - 0x1020 to be named as cwd[i]. Can it be done? I ...
satk0's user avatar
  • 101
1 vote
0 answers
58 views

How to quickly exit radare2 from debug mode?

Normally in CLI apps you can use Ctrl + c / Ctrl + d to terminate/exit, but they don't seem to do anything in r2 - at least not in debugger's v (visual) mode, which is how I use it. To exit, I press q,...
Mihai Rotaru's user avatar
1 vote
0 answers
134 views

Cyber Talent Basic Malware Reverse Engineering

I'm an absolutely beginner in the reverse engineering field. I have an exe program and I am to find: I have tried with Ghidra but i keep getting wrong submissions for the challenge. Here is the exe ...
Sheddymax's user avatar
1 vote
0 answers
40 views

Radare2: How to Create a Custom Scripted Panel?

TLDR: How do I get a panel in radare2 to correctly show the output of a radare2 command piped to an external script? e.g. afvd | python var_displayer.py This is my current view. Multiple panels, ...
Khalid's user avatar
  • 11
3 votes
1 answer
39 views

Can radare2 skip syscall when `db main;dts+;dc`

more detailed see this In short, I want to skip syscall when recording program, but it seems that the program would always stop after ths syscall. Hope someone can help me. Thanks. below is running ...
zg c's user avatar
  • 33
4 votes
1 answer
167 views

Mickey Mouse toy bin file analysis

I am trying to reverse engineer a Mickey Mouse toy just for fun but I am stuck. The toy has several buttons that play various phrases and songs. My aim was to see if I can read those songs from the ...
George Farcas's user avatar
1 vote
0 answers
16 views

Why rarun2 is not behave like it is described?

colleagues. Simplest question. As many articles in the Net (example https://r2wiki.readthedocs.io/en/latest/tools/rarun2/) and here on forum are describing, i have a rarun2 profile named "...
Roman's user avatar
  • 11
3 votes
0 answers
49 views

plugin/script for radare2 similar to mona for immunity debugger

I would like to use radare2 for windows exploit-development, however I could not find a way to emulate the functionality of using Immunity-Debugger + mona.py when checking for badchars. Is there a ...
s1gsegv's user avatar
  • 31
3 votes
0 answers
67 views

Using output of a command as argument in radare2

I'm trying to use the output of a command as argument for my program that i'm trying to debug. I created the following profile, similar to using a command output for stdin $ cat profile.rr2 #!/usr/bin/...
Mime's user avatar
  • 131
1 vote
1 answer
47 views

How to know each register value instruction by instruction in a binary using radare2?

As I am using the radare2 for reverse engineering, I find it very difficult to get all the register values instruction by instruction with the help of the Radare2 tool. Could someone please help me to ...
okokok hack's user avatar
2 votes
1 answer
49 views

Get radare2 to only display assembly code without other info

I'm using radare2 in a loop that looks similar to this: for item in `r2 -c "aaaa" -c "afl" -qq 67b79382375cc5169d869dccca033be3786aa06a71b9bc1245cd4b935a603dc2.bin | grep -Eo "...
user42071's user avatar
1 vote
0 answers
38 views

View v0, d0 registers in Cutter (ARM64)

When reversing an ARM64 binary in Cutter 2.1, I wanted to emulate certain instructions and view the values that were computed. Cutter's emulation showed the x0-x31 registers but how do I view the v0....
localacct's user avatar
  • 193
1 vote
0 answers
165 views

radare2: How to load a DLL along with the application?

I am reverse engineering a Windows application for which there is no PDB file available. When loading it in r2, I get the following imports (They are correct): nth vaddr bind type lib ...
movzxb's user avatar
  • 11
0 votes
2 answers
163 views

Radare2 - changing stdin during binary debugging

I'd like to know how to change stdin multiple times for the given binary for debugging purposes. I know I can launch the application with r2 -r profile.r2 -d binary Where, inside the profile.r2 file ...
Gordon Zar's user avatar
3 votes
1 answer
663 views

STM32 - Disable Voltage Check

I'm planning to edit the binary Firmware for an STM32F030K6T6 ARM microcontroller used in the IKEA Fyrtur blinds. In particular I'm trying to disable the Voltage check (allow alternative power source)...
vincent's user avatar
  • 131
3 votes
1 answer
197 views

Radare2 - Saving information/metadata from a debugging session

I'd like to know how I can save/restore comments or possibly other metadata during a debugging session. I know how to save this data when running radare without the -d flag but I often need to debug ...
Gordon Zar's user avatar
2 votes
2 answers
306 views

Examining memory without attaching to the process by using /proc/$PID/mem?

I have a gap in my understanding and tooling. Now I would prefer to use Radare2, but will consider any answer. Let's use this program as an example. #include <stdio.h> #include <unistd.h> ...
Evan Carroll's user avatar
  • 1,769
0 votes
1 answer
453 views

How can I use cutter like ida, trying to search by address

I'm new to reverse engineering and I'm trying to get into using a disassembler - I've been using reclass for a while now. I was looking at IDA Pro and that was 7k euros so that was not an option. I've ...
Dankri jk's user avatar
0 votes
1 answer
207 views

Radare2's equivalent of GDB's Radare2's equivalent of GDB's set $reg 0x2020

I would really like to change the registers during radare2's debugging sessiong. In GDB, set $reg 0x2020 was very useful.
Happy Jerry's user avatar
1 vote
2 answers
421 views

Changing the jne to je instruction causes program to generate error

I'm trying to change the instruction from jne to je I've change an instruction 75 0c jne [some_location] 75 0c is a 2 jump instruction. So, I've a chaged it to from 75 0c to 74 0c which is ...
user40683's user avatar
2 votes
1 answer
74 views

Radare2 only printing out the last byte at RSP when using pxq @ rsp

According to documentation, px[?][owq] [len]    hexdump of N bytes (o=octal, w=32bit, q=64bit) and pr[?][glx] [len]    print N raw bytes (in lines or hexblocks, 'g'unzip) These two ...
user40683's user avatar
2 votes
1 answer
70 views

How to make the default stack width/offset 8 bytes when debgging in radare2

If you start radare2 in debugging mode like: r2 -d /usr/bin you'll be prompted with something similar to: If you press V for the prompt, you get debugging view with panels. Then, if you select the ...
user40683's user avatar
1 vote
1 answer
211 views

How do you change the stack width/offset in radare2?

Currently, my stack view is 0x10 (16) bytes long. How do I change it so that the stack view is 8 bytes long? Edit: I have tried tabbing into the stack window, pressing e, and then typing pxr 256@r:SP ...
user40683's user avatar
3 votes
0 answers
67 views

Cutter console does not show printf result

I'm using last version (2.0.5) of Cutter. I am not able to find a way to display std in/out in Cutter Console. In the picture I cleared the console before starting debugging and you can see it after ...
Luigi 's user avatar
  • 31
2 votes
0 answers
80 views

Specifying multiple input files in radare2

If I want to pass several inputs, I know that I can write this with rarun2: #!/usr/bin/rarun2 stdin="first\nsecond\n" But what if I want to pass the input from a file file1 at the first ...
Aramya's user avatar
  • 21
0 votes
1 answer
38 views

radare2 convenience variables

gdb allows setting arbitrary convenience variables: set $a = "test" set $b = 3 p $a # => "test" p $b # => 3 Is there a way to do something similar in radare2? I'd like to be ...
SRobertJames's user avatar
0 votes
1 answer
302 views

How to insert asm code in file without overwriting in Radare2

I am learning reverse engineering tools. I notice that when you need to patch some file (at least in visual mode) you need to overwrite instructions, i.e. when using Shift+A in visual mode or I in ...
Guilherme's user avatar
  • 113
1 vote
1 answer
84 views

File not want to patch. Radare2

I am learning by doing some cracking in files that i made in C. One of this files is this: file.c: #include <stdio.h> #include <stdlib.h> int main() { char s[15] = "...
Guilherme's user avatar
  • 113
1 vote
0 answers
94 views

radare2 Loop over literal strings for search

In radare2, I can search and grep e.g. / needle ~:0 2>/dev/null. How I can I do that in a loop for multiple needles? E.g. something like for n in needle1 needle2 needle3; do / $n ~:0 2>/dev/...
SRobertJames's user avatar
1 vote
0 answers
116 views

Radare2 Load file from stdin fails

Radare2 supports loading a file from stdin via =. However, my attempts to use it don't work: $ r2 /bin/ls Warning: run r2 with -e bin.cache=true to fix relocations in disassembly [0x00006810]> q $ ...
SRobertJames's user avatar
1 vote
2 answers
241 views

How can I tell radare2 to show me a constant's value in disassembly

In radare2, I can disassemble like: 0x004006f0]> pd 3 ... 0x004006f0 ff2532092000 jmp qword [reloc.callme_three] ; [0x601028:8]=0x4006f6 0x004006f6 6802000000 push 2 ...
SRobertJames's user avatar
1 vote
1 answer
1k views

How can I use radare2 to list all xrefs to a string?

radare2 can list all strings with iz , and list all functions with afl. How can I use radar2e to list the XREFs for each string? That is, for each string, which funcs reference it? I'd like to be ...
SRobertJames's user avatar
3 votes
1 answer
623 views

Free alternative to Lighthouse Code Coverage Explorer?

I was trying to find if there is any free tool that allows an output similar to Lighthouse. I want to highlight the code paths taken so that I only reverse engineer the parts that are being executed. ...
Abhay Nayar's user avatar
2 votes
0 answers
979 views

Radare2 cannot open bin for writing

Im on Kali and im using Radare2 but it says r2 -d bin Killing child process 16151 due to an error Killing child process 16152 due to an error [w] Cannot open 'dbg://./bin' for writing. I tried chmod +...
JyanJohn's user avatar
1 vote
1 answer
152 views

print format in radare2 cannot output all my string

I was doing a CTF challenge and I need to see the value of RAX register in radare2. I first dumped all of printable ascii characters as input, one of the function encoded the input and spit out the ...
Haekal Al Ghifary's user avatar
1 vote
0 answers
93 views

Function Arguments/Name on Radare and IDA

I am starting with reverse engineering and Radare and I'm facing the following problem, on IDA Free I see the following code: mov ecx, 11h lea edi, [esp+1208h+StartupInfo] rep stosd lea ...
secjav's user avatar
  • 11
2 votes
1 answer
494 views

what is the difference between pd $s and pdf @@f in Radare2

I've tried searching around on how to disassemble a whole binary. I found that pd $s and pdf @@f are the 2 commands suggested most widely. I could understand the working of the latter, but I don't see ...
Moltres's user avatar
  • 123
2 votes
1 answer
1k views

How can I find an external function code correctly in Ghidra and Radare2?

This is a code to call an external function(get_random_name) in the main function push {fp, lr} add fp, sp, 4 sub sp, sp, 0x1d8 str r0, [fp, -0x1d8] str r1, [fp, -0x1dc] sub r3, fp, 0x44 ...
three2zero's user avatar
1 vote
1 answer
958 views

radare2 unable to run a binary file

I've been trying to debug a binary file in radare2 but it throws me this error. $ r2 -d bin Killing child process 1688 due to an error Killing child process 1689 due to an error [...
Nimrod's user avatar
  • 151
1 vote
0 answers
64 views

Change return value of a boolean function in arm library

I have an android library (arm cpu) that have a function named GetEisLinkWithDfr() that have a single line that returns boolean value of "true", and I want it to return a value of "...
Bilux's user avatar
  • 11
3 votes
1 answer
271 views

`af` does not seem to find all functions in Radare2

The disassembly at the entry point looks like this: : ;-- entry0: : ;-- _mainCRTStartup: : ;-- eip: : 0x004014e0 83ec0c sub esp, 0xc : ...
user1720897's user avatar
2 votes
1 answer
160 views

Radare2 does not reload payload correctly

I'm new to Radare2 so i'm trying to learn it by doing some basic buffer overflows. My problem is that, when i try to load some payloads, the stack seems to fake them in some differents ways... For ...
saltmorejo's user avatar
3 votes
1 answer
152 views

`af` vs `afr` in Radare2

I am trying to understand the difference between analyze functions and analyze functions recursively in Radare2. Given a code snippet like this: #include <stdio.h> void b() { printf("b ...
user1720897's user avatar
1 vote
1 answer
126 views

Radare2 - "/c pointer; offset" command not giving expected response to search instances of the same pair of similar instructions

I am trying to find an offset IOSURFACEROOTUSERCLIENT_VTAB from an iOS kext(IOSurface) using radare2 and there is a need to use the command "/c pointer; offset" as per the instructions in ...
iSeeker's user avatar
  • 63
0 votes
1 answer
124 views

What does anal.hasnext actually do?

I am trying to understand anal.hasnext control flow configuration option of Radare. The documentation says "Continue analysis after each function. Forces to find a function, after the end of a ...
user1720897's user avatar
2 votes
1 answer
332 views

How to reverse engineer structs in radare2?

Is there any way to indentify structs in radare2? when i tried to look them, they look like normal variables, i seen people using td and tl command but I don't know how to use them. If you know please ...
Mr. rc's user avatar
  • 45
0 votes
0 answers
81 views

Radare2 is showing weird disassembly as compared to disassembly of gcc

Today i was playing around with c code in r2. I compiled a file which had the following code. #include <stdio.h> int main(){ int a=9; float b=1.1; int sum; sum = ...
Mr. rc's user avatar
  • 45
0 votes
1 answer
84 views

Interpret radare2 help

So I run radare2 from the command line with r2 - and attempt to display the help with the ? command. I read this line which says: ?[??][expr] Help or evaluate math expression I am not ...
user1720897's user avatar

1
2 3 4 5
7