Questions tagged [radare2]

Opensource reverse engineering framework to disassemble, debug, analyze, manipulate binary files and more.

Filter by
Sorted by
Tagged with
0
votes
0answers
9 views

radare2 convenience variables

gdb allows setting arbitrary convenience variables: set $a = "test" set $b = 3 p $a # => "test" p $b # => 3 Is there a way to do something similar in radare2? I'd like to be ...
0
votes
0answers
20 views

How to insert asm code in file without overwriting in Radare2

I am learning reverse engineering tools. I notice that when you need to patch some file (as least in visual mode) you need to overwrite instructions, i.e when using shift+a in visual mode or i in ...
1
vote
0answers
15 views

File not want to patch. Radare2

I am learning by doing some cracking in files that i made in C. One of this files is this: file.c: #include <stdio.h> #include <stdlib.h> int main() { char s[15] = "...
1
vote
0answers
22 views

radare2 Loop over literal strings for search

In radare2, I can search and grep e.g. / needle ~:0 2>/dev/null. How I can I do that in a loop for multiple needles? E.g. something like for n in needle1 needle2 needle3; do / $n ~:0 2>/dev/...
1
vote
0answers
20 views

Radare2 Load file from stdin fails

Radare2 supports loading a file from stdin via =. However, my attempts to use it don't work: $ r2 /bin/ls Warning: run r2 with -e bin.cache=true to fix relocations in disassembly [0x00006810]> q $ ...
1
vote
2answers
50 views

How can I tell radare2 to show me a constant's value in disassembly

In radare2, I can disassemble like: 0x004006f0]> pd 3 ... 0x004006f0 ff2532092000 jmp qword [reloc.callme_three] ; [0x601028:8]=0x4006f6 0x004006f6 6802000000 push 2 ...
1
vote
1answer
45 views

How can I use radare2 to list all xrefs to a string?

radare2 can list all strings with iz , and list all functions with afl. How can I use radar2e to list the XREFs for each string? That is, for each string, which funcs reference it? I'd like to be ...
2
votes
1answer
66 views

Free alternative to Lighthouse Code Coverage Explorer?

I was trying to find if there is any free tool that allows an output similar to Lighthouse. I want to highlight the code paths taken so that I only reverse engineer the parts that are being executed. ...
0
votes
0answers
30 views

How can I retrieve dropped PE files from a dropper without the program necessary to execute the dropper?

I have a file (dll) that is a Cobalt Strike dropper based on the strings found inside. The file has an "entry0", and other general windows specific functions. The file appears to be ...
0
votes
0answers
35 views

How to record all the "call instructions" for a brief interval?

I want to find the GUI push buttons callback function address (Qt app). I am thinking of recording all the call instructions during the short duration it takes to click the button and inspect all of ...
0
votes
0answers
55 views

Is it possible to detect that a function has been called from a loop? - Radare-2

is it possible to detect a function is calling from inside a loop in Radare-2. for (i = 0; i<n; i++) foo() foo() ==> 0x00402f90 // starting address Thanks
1
vote
0answers
116 views

Radare2 cannot open bin for writing

Im on Kali and im using Radare2 but it says r2 -d bin Killing child process 16151 due to an error Killing child process 16152 due to an error [w] Cannot open 'dbg://./bin' for writing. I tried chmod +...
0
votes
0answers
42 views

Radare2 give same assembly code with two different file.apk

I want to use the reverse engineering of radare2 (run on Kali Linux 2020) in order to get the assembly code of file.apk. But I do not know why two different file.apk give the same code. I checked many ...
1
vote
1answer
56 views

print format in radare2 cannot output all my string

I was doing a CTF challenge and I need to see the value of RAX register in radare2. I first dumped all of printable ascii characters as input, one of the function encoded the input and spit out the ...
0
votes
0answers
86 views

radare2: Print strings in function for 32-bit binaries

I want to see the strings that are printed by the puts() function in the output of radare2's pdf, but it doesn't work. I have a similar problem as mentioned here, but I think it's somehow related to ...
1
vote
0answers
38 views

Function Arguments/Name on Radare and IDA

I am starting with reverse engineering and Radare and I'm facing the following problem, on IDA Free I see the following code: mov ecx, 11h lea edi, [esp+1208h+StartupInfo] rep stosd lea ...
1
vote
1answer
92 views

what is the difference between pd $s and pdf @@f in Radare2

I've tried searching around on how to disassemble a whole binary. I found that pd $s and pdf @@f are the 2 commands suggested most widely. I could understand the working of the latter, but I don't see ...
2
votes
1answer
391 views

How can I find an external function code correctly in Ghidra and Radare2?

This is a code to call an external function(get_random_name) in the main function push {fp, lr} add fp, sp, 4 sub sp, sp, 0x1d8 str r0, [fp, -0x1d8] str r1, [fp, -0x1dc] sub r3, fp, 0x44 ...
0
votes
0answers
65 views

What are "covrage and "codesz" in radare2?

[0x00009124]> a fcns 0 xrefs 0 calls 0 strings 126 symbols 74 imports 27 covrage 347 codesz 27543 percent 8% Sorry, this is a newbie question, but what are covrage and codesz? How can I ...
1
vote
1answer
244 views

radare2 unable to run a binary file

I've been trying to debug a binary file in radare2 but it throws me this error. $ r2 -d bin Killing child process 1688 due to an error Killing child process 1689 due to an error [...
0
votes
0answers
52 views

Function name from Ordinal number in Radare2

When disassembling dll or exe files in radare2, I sometimes encounter function calls via ordinals (call sub. mfc140u.dll_Ordinal_2246). As I understand it, the problem is that there is no pdb file for ...
1
vote
0answers
32 views

Change return value of a boolean function in arm library

I have an android library (arm cpu) that have a function named GetEisLinkWithDfr() that have a single line that returns boolean value of "true", and I want it to return a value of "...
2
votes
1answer
74 views

`af` does not seem to find all functions in Radare2

The disassembly at the entry point looks like this: : ;-- entry0: : ;-- _mainCRTStartup: : ;-- eip: : 0x004014e0 83ec0c sub esp, 0xc : ...
2
votes
1answer
89 views

Radare2 does not reload payload correctly

I'm new to Radare2 so i'm trying to learn it by doing some basic buffer overflows. My problem is that, when i try to load some payloads, the stack seems to fake them in some differents ways... For ...
0
votes
0answers
34 views

Can I find out what methods are being swizzled in runtime?

I have an obfuscated dylib injecting into a process in macOS to swizzle objc methods. Obviously I can decompile it to check what it is hooking, but its heavily obfuscated. Hence, can I find out what ...
3
votes
1answer
101 views

`af` vs `afr` in Radare2

I am trying to understand the difference between analyze functions and analyze functions recursively in Radare2. Given a code snippet like this: #include <stdio.h> void b() { printf("b ...
1
vote
1answer
106 views

Radare2 - "/c pointer; offset" command not giving expected response to search instances of the same pair of similar instructions

I am trying to find an offset IOSURFACEROOTUSERCLIENT_VTAB from an iOS kext(IOSurface) using radare2 and there is a need to use the command "/c pointer; offset" as per the instructions in ...
0
votes
1answer
79 views

What does anal.hasnext actually do?

I am trying to understand anal.hasnext control flow configuration option of Radare. The documentation says "Continue analysis after each function. Forces to find a function, after the end of a ...
0
votes
0answers
29 views

Saving a breakpoint in radare2 loses the format string

Good day to you all. I'm new to radare2 and reverse engineering in general. Debugging a small crackme. I want to save breakpoints. Initially, everything is fine: db* > bps and load breakpoints: ...
0
votes
0answers
60 views

How to reverse engineer structs in radare2?

Is there any way to indentify structs in radare2? when i tried to look them, they look like normal variables, i seen people using td and tl command but I don't know how to use them. If you know please ...
0
votes
0answers
59 views

Radare2 is showing weird disassembly as compared to disassembly of gcc

Today i was playing around with c code in r2. I compiled a file which had the following code. #include <stdio.h> int main(){ int a=9; float b=1.1; int sum; sum = ...
0
votes
1answer
72 views

Interpret radare2 help

So I run radare2 from the command line with r2 - and attempt to display the help with the ? command. I read this line which says: ?[??][expr] Help or evaluate math expression I am not ...
0
votes
0answers
91 views

Why won't Radare2 display main's paramethers of a 32bit ELF on a 64 bit machine?

I am new to reversing and currently trying to follow this tutorial, in which the binary provided was compiled on a 32 bit machine hence the file is a "ELF 32-bit LSB executable". It runs ...
1
vote
1answer
362 views

Golang program reversing with Radare2

I'm trying to understand how to reverse golang programs with radare2. In order to practice, i create a minimal program in Go: package main import "fmt" func main() { fmt.Println("...
0
votes
0answers
21 views

radare2 can't see error/signal messages

I'm in visual mode on the debug screen. I'm stepping through some function code with the 'F7' shortcut key, when I hit a part of the code that yields an error or some kind of message, the message text ...
0
votes
0answers
134 views

Control flow graph of entire binary file

Is it possible to get the control flow graph of the entire binary file using any disassembler? IDA Pro generates the CFG for each function. Can we use it to get the CFG of the entire program?
2
votes
1answer
167 views

Can't modify string in radare2 (.rodata section)

I was following the response to this question to change the string of an elf executable. No matter how many times I try, I just can't modify the string. I notice that probably the issue lies in the ...
0
votes
1answer
241 views

main function not found in GCC compiled code

I'm trying to learn reverse engineering using Radare2. For this I compiled a hello world program with GCC on Ubuntu (version: gcc (Ubuntu 9.3.0-17ubuntu1~20.04) 9.3.0). #include <stdio.h> int ...
0
votes
0answers
35 views

"rabin2 -E" and "afll" no output for an exe file

$ rabin2 -I test.exe arch x86 baddr 0x400000 binsz 3229424 bintype pe bits 32 canary false retguard false class PE32 cmp.csum 0x0031d950 ...
4
votes
1answer
608 views

Ghidra + IDA cant detect a string but Radare2 can

Im new to reverse engineering, and ive trying Ghidra, IDA (Freeware) and Radare2 with a simple CrackMe, the problem is, both Ghidra and IDA couldnt detect a string while Radare2 (Using Cutter GUI) ...
2
votes
1answer
90 views

Getting memory address of particular bytes in radare2

in pwnlib there is a possibility to search for particular bytes, e.g. as follows for 0x66 byte: print(next(p.elf.search(b'f'))) which in turn results in the following output: 4195268 Having this ...
1
vote
0answers
91 views

What do you think is the optimum environment for reverse engineering dynamically-linked aarch64 Golang binaries developed in Alpine Linux?

Direct quote from Golang's website: "GDB does not understand Go programs well. The stack management, threading, and runtime contain aspects that differ enough from the execution model GDB expects ...
1
vote
1answer
216 views

Crackme assistance - change input of a function

Just as a preface, this is a crackme from https://hack.ainfosec.com/. I know you can submit these as part of a job app, I have no intentions of doing that. Very happy to have a job in a related, but ...
0
votes
0answers
35 views

how do I use Remote Binary Protocol in cutter

how do I use Remote Binary Protocol I tried to connect to gdbserver through the normal method but it would just hang and not connect. I let it go like that for 1 hour
1
vote
1answer
92 views

How to change local_184h to skip past jump commands with Radare2?

I am trying to solve a CTF challenge but I am very much out of my depth and nothing online is helping me very much. This is what I'm working with currently | 0x55b3fd508a41 4889e5 ...
1
vote
1answer
504 views

ARM binary dissasembly, Hopper works, Ghidra and Radare2 don't for some functions

I'm disassembling a large ARM binary and I see that for some functions both Ghidra and Radare2 appear to fail to disassemble certain functions whereas Hopper works for those same functions In Ghidra - ...
1
vote
1answer
242 views

The Graph view in Cutter is empty

Following this question, I'm trying to figure out how cscript.exe parses the .wsh Windows Script Host control files. First I tried WinDbg, but Radare2-Cutter seems like a much nicer software TBH. What ...
1
vote
0answers
75 views

How can I rename location in radare2?

In radare2 I would like to be able to rename a node in the graph view. I though setting a flag to the entry of the graph node would also change its title, but the address of the nodes still shows ...
0
votes
0answers
46 views

Radare2: Running executable from a specific point

I am using radare2 to reverse engineer a standard crackme executable. I have obtained the password, but now I need use the program to read & print a restricted file to which the executable has ...
0
votes
1answer
128 views

How does radare2 create its memory layout?

Firstly Hello, this is my first post on this forum even though im reading alot here. Im trying to get into reversing and Low-Level stuff in general lately, and im a bit stuck right here. I did read ...

1
2 3 4 5
7