Questions tagged [radare2]
Opensource reverse engineering framework to disassemble, debug, analyze, manipulate binary files and more.
330
questions
1
vote
0
answers
38
views
STM32 - Disable Voltage Check
I'm planning to edit the binary Firmware for an STM32F030K6T6 ARM microcontroller used in the IKEA Fyrtur blinds. In particular I'm trying to
disable the Voltage check (allow alternative power source)...
- 111
3
votes
0
answers
20
views
Radare2 - Saving information/metadata from a debugging session
I'd like to know how I can save/restore comments or possibly other metadata during a debugging session.
I know how to save this data when running radare without the -d flag but I often need to debug ...
- 31
1
vote
1
answer
168
views
Examining memory without attaching to the process by using /proc/$PID/mem?
I have a gap in my understanding and tooling. Now I would prefer to use Radare2, but will consider any answer. Let's use this program as an example.
#include <stdio.h>
#include <unistd.h>
...
- 1,654
0
votes
0
answers
45
views
Get function list with radare2
I need to get a list of function start and end addresses using r2. I'm pumping this information into a tool I'm building. First, I'm aware of aaa and afl but those don't seem to provide exactly what ...
0
votes
1
answer
75
views
How can I use cutter like ida, trying to search by address
I'm new to reverse engineering and I'm trying to get into using a disassembler - I've been using reclass for a while now. I was looking at IDA Pro and that was 7k euros so that was not an option. I've ...
0
votes
1
answer
40
views
Radare2's equivalent of GDB's Radare2's equivalent of GDB's set $reg 0x2020
I would really like to change the registers during radare2's debugging sessiong. In GDB,
set $reg 0x2020
was very useful.
0
votes
1
answer
105
views
Changing the jne to je instruction causes program to generate error
I'm trying to change the instruction from jne to je
I've change an instruction
75 0c jne [some_location]
75 0c is a 2 jump instruction.
So, I've a chaged it to from 75 0c to 74 0c which is ...
- 23
0
votes
0
answers
25
views
Radare2 only printing out the last byte at RSP when using pxq @ rsp
According to documentation,
px[?][owq] [len] hexdump of N bytes (o=octal, w=32bit, q=64bit)
and
pr[?][glx] [len] print N raw bytes (in lines or hexblocks,
'g'unzip)
These two ...
- 23
1
vote
0
answers
20
views
How to make the default stack width/offset 8 bytes when debgging in radare2
If you start radare2 in debugging mode like:
r2 -d /usr/bin
you'll be prompted with something similar to:
If you press V for the prompt, you get debugging view with panels. Then, if you select the ...
- 23
1
vote
1
answer
72
views
How do you change the stack width/offset in radare2?
Currently, my stack view is 0x10 (16) bytes long.
How do I change it so that the stack view is 8 bytes long?
Edit:
I have tried tabbing into the stack window, pressing e, and then typing pxr 256@r:SP ...
- 23
1
vote
0
answers
39
views
Cutter console does not show printf result
I'm using last version (2.0.5) of Cutter. I am not able to find a way to display std in/out in Cutter Console. In the picture I cleared the console before starting debugging and you can see it after ...
- 11
0
votes
0
answers
22
views
Specifying multiple input files in radare2
If I want to pass several inputs, I know that I can write this with rarun2:
#!/usr/bin/rarun2
stdin="first\nsecond\n"
But what if I want to pass the input from a file file1 at the first ...
- 1
0
votes
0
answers
17
views
radare2 convenience variables
gdb allows setting arbitrary convenience variables:
set $a = "test"
set $b = 3
p $a # => "test"
p $b # => 3
Is there a way to do something similar in radare2? I'd like to be ...
- 185
0
votes
1
answer
117
views
How to insert asm code in file without overwriting in Radare2
I am learning reverse engineering tools.
I notice that when you need to patch some file (at least in visual mode) you need to overwrite instructions, i.e. when using Shift+A in visual mode or I in ...
- 113
1
vote
0
answers
28
views
File not want to patch. Radare2
I am learning by doing some cracking in files that i made in C. One of this files is this:
file.c:
#include <stdio.h>
#include <stdlib.h>
int main() {
char s[15] = "...
- 113
1
vote
0
answers
40
views
radare2 Loop over literal strings for search
In radare2, I can search and grep e.g. / needle ~:0 2>/dev/null. How I can I do that in a loop for multiple needles? E.g. something like for n in needle1 needle2 needle3; do / $n ~:0 2>/dev/...
- 185
1
vote
0
answers
53
views
Radare2 Load file from stdin fails
Radare2 supports loading a file from stdin via =. However, my attempts to use it don't work:
$ r2 /bin/ls
Warning: run r2 with -e bin.cache=true to fix relocations in disassembly
[0x00006810]> q
$ ...
- 185
1
vote
2
answers
94
views
How can I tell radare2 to show me a constant's value in disassembly
In radare2, I can disassemble like:
0x004006f0]> pd 3
...
0x004006f0 ff2532092000 jmp qword [reloc.callme_three] ; [0x601028:8]=0x4006f6
0x004006f6 6802000000 push 2 ...
- 185
1
vote
1
answer
168
views
How can I use radare2 to list all xrefs to a string?
radare2 can list all strings with iz , and list all functions with afl. How can I use radar2e to list the XREFs for each string? That is, for each string, which funcs reference it?
I'd like to be ...
- 185
2
votes
1
answer
196
views
Free alternative to Lighthouse Code Coverage Explorer?
I was trying to find if there is any free tool that allows an output similar to Lighthouse. I want to highlight the code paths taken so that I only reverse engineer the parts that are being executed. ...
- 51
0
votes
0
answers
52
views
How can I retrieve dropped PE files from a dropper without the program necessary to execute the dropper?
I have a file (dll) that is a Cobalt Strike dropper based on the strings found inside. The file has an "entry0", and other general windows specific functions. The file appears to be ...
- 1
0
votes
0
answers
39
views
How to record all the "call instructions" for a brief interval?
I want to find the GUI push buttons callback function address (Qt app). I am thinking of recording all the call instructions during the short duration it takes to click the button and inspect all of ...
- 101
0
votes
0
answers
66
views
Is it possible to detect that a function has been called from a loop? - Radare-2
is it possible to detect a function is calling from inside a loop in Radare-2.
for (i = 0; i<n; i++)
foo()
foo() ==> 0x00402f90 // starting address
Thanks
1
vote
0
answers
317
views
Radare2 cannot open bin for writing
Im on Kali and im using Radare2 but it says
r2 -d bin
Killing child process 16151 due to an error
Killing child process 16152 due to an error
[w] Cannot open 'dbg://./bin' for writing.
I tried chmod +...
- 11
0
votes
0
answers
46
views
Radare2 give same assembly code with two different file.apk
I want to use the reverse engineering of radare2 (run on Kali Linux 2020) in order to get the assembly code of file.apk. But I do not know why two different file.apk give the same code. I checked many ...
1
vote
1
answer
72
views
print format in radare2 cannot output all my string
I was doing a CTF challenge and I need to see the value of RAX register in radare2.
I first dumped all of printable ascii characters as input, one of the function encoded the input and spit out the ...
0
votes
0
answers
158
views
radare2: Print strings in function for 32-bit binaries
I want to see the strings that are printed by the puts() function in the output of radare2's pdf, but it doesn't work. I have a similar problem as mentioned here, but I think it's somehow related to ...
- 1
1
vote
0
answers
55
views
Function Arguments/Name on Radare and IDA
I am starting with reverse engineering and Radare and I'm facing the following problem, on IDA Free I see the following code:
mov ecx, 11h
lea edi, [esp+1208h+StartupInfo]
rep stosd
lea ...
- 11
1
vote
1
answer
177
views
what is the difference between pd $s and pdf @@f in Radare2
I've tried searching around on how to disassemble a whole binary. I found that pd $s and pdf @@f are the 2 commands suggested most widely. I could understand the working of the latter, but I don't see ...
- 113
2
votes
1
answer
640
views
How can I find an external function code correctly in Ghidra and Radare2?
This is a code to call an external function(get_random_name) in the main function
push {fp, lr}
add fp, sp, 4
sub sp, sp, 0x1d8
str r0, [fp, -0x1d8]
str r1, [fp, -0x1dc]
sub r3, fp, 0x44
...
- 109
1
vote
1
answer
446
views
radare2 unable to run a binary file
I've been trying to debug a binary file in radare2 but it throws me this error.
$ r2 -d bin
Killing child process 1688 due to an error
Killing child process 1689 due to an error
[...
- 121
1
vote
0
answers
40
views
Change return value of a boolean function in arm library
I have an android library (arm cpu) that have a function named GetEisLinkWithDfr() that have a single line that returns boolean value of "true", and I want it to return a value of "...
- 11
2
votes
1
answer
118
views
`af` does not seem to find all functions in Radare2
The disassembly at the entry point looks like this:
: ;-- entry0:
: ;-- _mainCRTStartup:
: ;-- eip:
: 0x004014e0 83ec0c sub esp, 0xc
: ...
- 279
2
votes
1
answer
116
views
Radare2 does not reload payload correctly
I'm new to Radare2 so i'm trying to learn it by doing some basic buffer overflows. My problem is that, when i try to load some payloads, the stack seems to fake them in some differents ways...
For ...
- 23
3
votes
1
answer
114
views
`af` vs `afr` in Radare2
I am trying to understand the difference between analyze functions and analyze functions recursively in Radare2. Given a code snippet like this:
#include <stdio.h>
void b() {
printf("b ...
- 279
1
vote
1
answer
112
views
Radare2 - "/c pointer; offset" command not giving expected response to search instances of the same pair of similar instructions
I am trying to find an offset IOSURFACEROOTUSERCLIENT_VTAB from an iOS kext(IOSurface) using radare2 and there is a need to use the command "/c pointer; offset" as per the instructions in ...
- 63
0
votes
1
answer
82
views
What does anal.hasnext actually do?
I am trying to understand anal.hasnext control flow configuration option of Radare. The documentation says "Continue analysis after each function. Forces to find a function, after the end of a ...
- 279
0
votes
1
answer
137
views
How to reverse engineer structs in radare2?
Is there any way to indentify structs in radare2?
when i tried to look them, they look like normal variables, i seen people using td and tl command but I don't know how to use them. If you know please ...
- 25
0
votes
0
answers
64
views
Radare2 is showing weird disassembly as compared to disassembly of gcc
Today i was playing around with c code in r2.
I compiled a file which had the following code.
#include <stdio.h>
int main(){
int a=9;
float b=1.1;
int sum;
sum = ...
- 25
0
votes
1
answer
77
views
Interpret radare2 help
So I run radare2 from the command line with r2 - and attempt to display the help with the ? command. I read this line which says:
?[??][expr] Help or evaluate math expression
I am not ...
- 279
0
votes
0
answers
108
views
Why won't Radare2 display main's paramethers of a 32bit ELF on a 64 bit machine?
I am new to reversing and currently trying to follow this tutorial, in which the binary provided was compiled on a 32 bit machine hence the file is a "ELF 32-bit LSB executable". It runs ...
- 103
1
vote
1
answer
532
views
Golang program reversing with Radare2
I'm trying to understand how to reverse golang programs with radare2. In order to practice, i create a minimal program in Go:
package main
import "fmt"
func main() {
fmt.Println("...
- 11
2
votes
1
answer
261
views
Can't modify string in radare2 (.rodata section)
I was following the response to this question to change the string of an elf executable. No matter how many times I try, I just can't modify the string. I notice that probably the issue lies in the ...
- 153
0
votes
1
answer
417
views
main function not found in GCC compiled code
I'm trying to learn reverse engineering using Radare2.
For this I compiled a hello world program with GCC on Ubuntu (version: gcc (Ubuntu 9.3.0-17ubuntu1~20.04) 9.3.0).
#include <stdio.h>
int ...
- 3
0
votes
0
answers
45
views
"rabin2 -E" and "afll" no output for an exe file
$ rabin2 -I test.exe
arch x86
baddr 0x400000
binsz 3229424
bintype pe
bits 32
canary false
retguard false
class PE32
cmp.csum 0x0031d950
...
- 101
4
votes
1
answer
902
views
Ghidra + IDA cant detect a string but Radare2 can
Im new to reverse engineering, and ive trying Ghidra, IDA (Freeware) and Radare2 with a simple CrackMe, the problem is, both Ghidra and IDA couldnt detect a string while Radare2 (Using Cutter GUI) ...
- 143
2
votes
1
answer
119
views
Getting memory address of particular bytes in radare2
in pwnlib there is a possibility to search for particular bytes, e.g. as follows for 0x66 byte:
print(next(p.elf.search(b'f')))
which in turn results in the following output:
4195268
Having this ...
- 41
1
vote
0
answers
99
views
What do you think is the optimum environment for reverse engineering dynamically-linked aarch64 Golang binaries developed in Alpine Linux?
Direct quote from Golang's website: "GDB does not understand Go programs well. The stack management, threading, and runtime contain aspects that differ enough from the execution model GDB expects ...
- 257
1
vote
1
answer
225
views
Crackme assistance - change input of a function
Just as a preface, this is a crackme from https://hack.ainfosec.com/. I know you can submit these as part of a job app, I have no intentions of doing that. Very happy to have a job in a related, but ...
- 11
0
votes
0
answers
40
views
how do I use Remote Binary Protocol in cutter
how do I use Remote Binary Protocol I tried to connect to gdbserver through the normal method but it would just hang and not connect. I let it go like that for 1 hour
- 1