Questions tagged [radare2]
Opensource reverse engineering framework to disassemble, debug, analyze, manipulate binary files and more.
236
questions
0
votes
1answer
95 views
How to decrypt the password using radare2 or gdb?
.--------------------------------------------------.
| [0x804851b] |
...
0
votes
0answers
49 views
Radare2 not showing memory value correctly
I am debugging a bootloader running on QEMU i386.
The issue is the red value of 0x6069 shown as zero. In reality the value is the same as register al (non zero value) and the following je happens.
...
0
votes
1answer
36 views
radare2 memory changing in debug mode
I have tiny program:
0x08048080 66a1a0900408 mov ax, word loc.name
0x08048086 66bbafbe mov bx, 0xbeaf
0x0804808a 66891da09004. mov word loc.name,...
3
votes
2answers
71 views
Get certain instruction count for multi-architecture binaries
I need to get an ELF binary's total count of
Function call instruction
conditional jump (branch) instruction
The binary could be any CPU architecture, like x64, ARM, MIPS, Motorola 68K, etc.
It ...
2
votes
0answers
26 views
How i can do several input via rarun2?
How can i do several input via rarun2, if my program requares two input?
I try this:
0
votes
1answer
63 views
Radare complains, “fatal error: r_cons.h: No such file or directory”
When I try to run r2pm install r2-dec, I get.
duktape/duk_console.c:13:10: fatal error: r_cons.h: No such file or directory
#include <r_cons.h>
^~~~~~~~~~
compilation terminated.
2
votes
0answers
59 views
Radare2 - How to debug Android native code (dynamic analysis)?
I'm using Termux(root) on LineageOS 16 (Android 9) with radare2 (v3.6.0 linux-arm32). When i attach to a process with 'r2 -d pid' the app freezes properly but doesn't continue with 'dc'. I'm not sure ...
0
votes
1answer
36 views
Radare2 substituting second operand of lea instruction with a random register
I was trying to debug a crackme with radare2. I found an interesting function which radare2 flagged as sym.xxx. The following listing is trimmed version of disassembled output of the function sym.xxx.
...
0
votes
0answers
91 views
Differences between IDA Pro and Radare2
I am familiar with Hopper Disassembler and OllyDbg as favorite and simple tools, but I would like to try switching to IDA to work on Windows.
However, I know about radare2 and that it is open source,...
1
vote
1answer
34 views
How to set search scope in radare2
Iam wondering how to change search scope in radare2. I`ve made some research and set variables search.from and search.to, according to Radare2 Book, but it doesn't work at all!
Could you help me ...
0
votes
1answer
25 views
How can I iterate over syscalls (as returned with `axt`) and rewrite them?
Let's say I want to list all calls that issue kill,
axt @ sym.imp.kill
How can I now NOP out the syscall at all of the addresses given? I want to strip the program of calls to kill.
3
votes
1answer
103 views
Radare2 ptrace can not attach
First my setup:
Linux Mint 64bit 4.15.0-20-generic
radare2 the newest version from github
/etc/sysctl.d/10-ptrace.conf = 0
Executable:
ELF 64-bit LSB executable, x86-64
read write and ...
0
votes
0answers
37 views
radare2 (v3.6.0) on windows(x64) not change registers values in debug mode
Whats wrong:
d:\radare2\bin\radare2 -A -d d:\test.exe
Spawned new process with pid 7192, tid = 8572
...
[0x014eb83c]> pd 5
┌ (fcn) entry0 2066
│ entry0 ();
│ bp: 0 (vars 0, args 0)
│ sp: 0 (...
3
votes
0answers
125 views
How to do debug a running java process in linux?
TLDR I want to do live debugging of a java program on a linux machine, and don't how/what debugger to attach to the JVM to get this done.
I expect that this is a well-solved problem, but I lack the ...
1
vote
1answer
131 views
Change instruction test eax, eax to text eax, 1
I'm trying to change an instruction in assembly. Try with test eax, eax to test eax, 1. I try modify the opcodes.
For example opcode of test eax, eax: 85c0
Try to understand why is 85c0 with this ...
1
vote
0answers
62 views
write radare2 output to a file
I am trying to write all the write logs of a binary program into a file for further analysis. I am using radare2 for it. I don't know what's the issue, I am not able to write the 'dte' output to a ...
2
votes
1answer
54 views
What is actually loaded here and different hexdump outputs on util-linux hexdump and on cutter and ghidra's hexdump
I was trying to understand what segment of file gets loaded by fourth LOAD header on phdr array.
First 6 headers are shown below from readelf
Program Headers:
Type Offset ...
0
votes
2answers
65 views
Radare2 show current RIP and current instruction while stepping
How can I get the same behavior as in gdb when using disassemble-next-line on?
When I step in radare2, I just see:
[0x7fea91263220]> ds
[0x7fea91263220]> ds
[0x7fea91263220]> ds
Why doesn'...
3
votes
1answer
98 views
Illegal instruction error in simple buffer overflow
I using following C code for testing stack based simple buffer overflow
#include<stdio.h>
#include<string.h>
void copier(char *arg){
char buffer[100];
strcpy(buffer,arg);
}
int ...
2
votes
0answers
59 views
radare2 wrong output
I saw rasm2 giving different output each time for x64
Take a look at this:
C:\WINDOWS\system32>rasm2 -a x86 -b 64 -d "41f6c7FF"
test r15b, 0xff
C:\WINDOWS\system32>rasm2 -a x86 -b 64 "test ...
2
votes
1answer
60 views
Invert stack view in radare2
Is it possible to invert the stack view when debugging in radare2 such that higher addresses are at the top?
0
votes
1answer
57 views
How to view registers values in string
Is it possible that radare2 will show registers values also in strings ?
For example, when I run ar I am getting the liste of registers and I have:
rax = 0x000000042
Is there a way to also show ...
1
vote
1answer
80 views
radare2 shows main function arguments argv as pointer to char on the stack, not as pointer to pointer to char
Well, I've been digging around process command line arguments as well as environment variables a bit these last days, especially looking up the way main function arguments were pushed onto the stack. ...
3
votes
1answer
142 views
function call trace with radare2 or break on all function call
I want to script with python using r2pipe. Is there a way that when debugging I can break on each call function, thus I can get the parameter? What's more, I won't jump into system library.
Or is ...
0
votes
1answer
43 views
How to increment and decrement machine code in radare2?
I watched a video (I believe it was a talk by the author of radare2) of how to increment machine code in radare2 very easily, simply by hitting 'c' and then using + and - to respectively increment and ...
2
votes
1answer
48 views
How to write sequence of machine code in radare2?
I know how to write an opcode and how to increment and decrement machine code using plus and minus keys. However, how do I write a sequence of machine code at an offset?
E.g. if I want to write five ...
0
votes
2answers
120 views
crackme disassembly - are these local variables ever initialized?
I'm working on a crackme, where the objective is to find the valid password given a program. I'm using radare2 to reverse engineering the program. To do so, I need to enter a password that forces this ...
2
votes
1answer
77 views
When reopening file lose all information in radare2
I have problem with my radare2, when I try to reopen file in debug mode (ood) my radare loses all informations about that file.
any help to avoid this?
4
votes
1answer
173 views
How do I type in hex input into radare2 debug mode?
#include<stdio.h>
#include<stdlib.h>
int main() {
puts("Enter input: ");
char buf[100];
fgets(buf, 100, stdin);
printf("%s", buf);
}
Suppose I am debugging a program, such ...
2
votes
1answer
88 views
How to examine/edit stack memory contents using radare2 in debug mode?
How can i examine/edit stack contents using radare2, just like gdb ?
Is there a way to examine memory using $rbp or $rsp register like below.
x $rbp-10 <--- something like this which can dump from ...
1
vote
1answer
62 views
Passing hex strings to Radare2
I can quickly test hex string arguments in gdb like this:
r $'\x61\x61\x61\x61'
I'd like to do something similar in radare2 but all I can figure out is regular strings:
doo aaaa
I tried this but ...
1
vote
0answers
191 views
Illegal instruction fault in stack based buffer overflow
I wrote this short C program to practice buffer overflow exploits:
#include <stdio.h>
#include <string.h>
#include <stddef.h>
#include <inttypes.h>
char *decode(char *s){
...
0
votes
0answers
57 views
How to debug programs that load from another one? with radare2/gdb
I'm reversing engendering a plugin. This plugin is loaded into memory by the main program.
I disassemble the plugin with radare2 but I don't know how to debug it.
I try with gdb but same problem.
I ...
1
vote
1answer
83 views
Is there watchpoints in radare2?
Is there any way to put breakpoints in radare2 that trigger when an address is read/write?
In GDB those are call watchpoints ('rwatch' or 'awatch")
I got this from radare2
[0xB7F08810]> !dr?
...
0
votes
1answer
161 views
Reassembling reversed ASM
I am trying to reassemble code reversed from an executable using radare2. I have managed to extract the asm and am using nasm for reassembling.
The question is, the code also contains commands like
...
1
vote
1answer
36 views
What this “arw” line means when processing Mach-0 file with Radare2 or Rabin2?
Processing a Mach-0 file with Rabin2 I'm obtaining the following result:
$ rabin2 -I mybinaryfile
arw ...
1
vote
1answer
82 views
debugging with radare2
I am using radare2 for disassemble an x86 binary:
$ r2 ./mynbinary
[0x00001000]> aaa
...
[0x00001000]> pdf
;-- section..text:
;-- section.LOAD1:
;-- rip:
/ (...
2
votes
1answer
248 views
How to print eax value with Radare2?
I am solving a crack me challenge but I am stuck. The challenge executes several jne tests. The first test is the simpliest but I don't arrive to print the eax value to know the content of cmp ...
1
vote
2answers
96 views
What does layout of Cutter/Radare2's function dissasembly mean?
Cutter displays functions like this:
I'm having trouble understanding the layout of the functions
For example:
What does 184 mean?
What does the green | mean at the beginning of each line?
Why ...
1
vote
1answer
110 views
How to use aaa in radare2 while in -d (debug) mode?
This might be a stupid question, but I am trying to learn by myself and I encountered a problem which I cannot solve for the life of me. I tried googling and I can't find anything relevant, so here ...
1
vote
1answer
105 views
How to set a breakpoint in an execve'd program in radare2?
If I have a program A, which uses execve to run program B. How can I set a breakpoint in program B's main routine if I'm debugging program A?
After a certain point in the execve routine, program B ...
1
vote
0answers
122 views
Password is right, but still wrong?
i am trying to find the password of a binary with radare2 - a crackme again :-)
I already thought I've found the password ('pass'), but this seems to be not the right one. Or there is a trick I didn'...
0
votes
1answer
1k views
How to print the value of register with Radare 2
I am trying to solve this ELF - Ptrace challenge. I use Radare 2. This is the commands I execute to print the assembly code.
radare2 ch3.bin
[0x080482f0]> aaa
[[anal.jmptbl] Missing cjmp bb in ...
2
votes
1answer
119 views
Radare2 does not display the entire assembler code
I am trying to solve this ELF - Ptrace crack me. Here are the commands I use :
I start radare2 with the crack me as argument.
radare2 ch3.bin
I decide to go to the main and print the assembly code ...
1
vote
1answer
135 views
Setting register names in Radare2
I am reverse-engineering an 8051 architecture program of a specific chip.
The disassembly naturally doesn't contain any function names, and the register names are minimal. For example, address 0xb3 is ...
0
votes
1answer
251 views
how to use core file in radare2?
In gdb i can backtrace with core file and executable file.
It seems radare2 can read core file. like this
$ r2 core
Setting up coredump: asm.arch <-> x86 and asm.bits <-> 64
Setting up ...
2
votes
1answer
74 views
radare2 how to interpret ascii-art color bars?
I can't understand the meaning of ascii-art color bars.
what is the meaning of the # charaters?
[0x08000210]> iS=
00 0x08000000 |---------------------------------| 0x08000000 0 ---
01 ...
3
votes
1answer
308 views
Radare2 Disassembler How Do You Organize Visual Panels (V!)?
I would like to use Radare2 to learn about how C is assembled into assembly but I am having trouble with the layout. I think the V! mode would be very handy as you can watch the registers update as ...
1
vote
1answer
148 views
Function names syntax returned by radare2's afl?
Radare2's afl command returns function names with a specific syntax that I could not find documentation on:
For example:
radare2 -2 -A -q -c "aflj" C:/Windows/system32/advapi32.dll
0x77cce13c 22 ...
0
votes
1answer
472 views
Print string at address with radare2
I have created a very basic golang program which display a message with fmt.Println().
Here is what is see in radare2:
lea rcx, obj.main.statictmp_0 ; 0x4c84b0 ; "y[K"
mov qword [local_48h], rcx
lea ...
