Questions tagged [radare2]
Opensource reverse engineering framework to disassemble, debug, analyze, manipulate binary files and more.
314
questions
1
vote
1answer
27 views
what is the difference between pd $s and pdf @@f in Radare2
I've tried searching around on how to disassemble a whole binary. I found that pd $s and pdf @@f are the 2 commands suggested most widely. I could understand the working of the latter, but I don't see ...
2
votes
1answer
187 views
How can I find an external function code correctly in Ghidra and Radare2?
This is a code to call an external function(get_random_name) in the main function
push {fp, lr}
add fp, sp, 4
sub sp, sp, 0x1d8
str r0, [fp, -0x1d8]
str r1, [fp, -0x1dc]
sub r3, fp, 0x44
...
0
votes
0answers
62 views
What are “covrage and ”codesz" in radare2?
[0x00009124]> a
fcns 0
xrefs 0
calls 0
strings 126
symbols 74
imports 27
covrage 347
codesz 27543
percent 8%
Sorry, this is a newbie question, but what are covrage and codesz?
How can I ...
1
vote
0answers
42 views
radare2 unable to run a binary file
I've been trying to debug a binary file in radare2 but it throws me this error.
$ r2 -d bin
Killing child process 1688 due to an error
Killing child process 1689 due to an error
[...
0
votes
0answers
25 views
Function name from Ordinal number in Radare2
When disassembling dll or exe files in radare2, I sometimes encounter function calls via ordinals (call sub. mfc140u.dll_Ordinal_2246). As I understand it, the problem is that there is no pdb file for ...
1
vote
0answers
28 views
Change return value of a boolean function in arm library
I have an android library (arm cpu) that have a function named GetEisLinkWithDfr() that have a single line that returns boolean value of "true", and I want it to return a value of "...
2
votes
1answer
50 views
`af` does not seem to find all functions in Radare2
The disassembly at the entry point looks like this:
: ;-- entry0:
: ;-- _mainCRTStartup:
: ;-- eip:
: 0x004014e0 83ec0c sub esp, 0xc
: ...
2
votes
1answer
67 views
Radare2 does not reload payload correctly
I'm new to Radare2 so i'm trying to learn it by doing some basic buffer overflows. My problem is that, when i try to load some payloads, the stack seems to fake them in some differents ways...
For ...
0
votes
0answers
27 views
Can I find out what methods are being swizzled in runtime?
I have an obfuscated dylib injecting into a process in macOS to swizzle objc methods. Obviously I can decompile it to check what it is hooking, but its heavily obfuscated. Hence, can I find out what ...
3
votes
1answer
81 views
`af` vs `afr` in Radare2
I am trying to understand the difference between analyze functions and analyze functions recursively in Radare2. Given a code snippet like this:
#include <stdio.h>
void b() {
printf("b ...
1
vote
1answer
96 views
Radare2 - “/c pointer; offset” command not giving expected response to search instances of the same pair of similar instructions
I am trying to find an offset IOSURFACEROOTUSERCLIENT_VTAB from an iOS kext(IOSurface) using radare2 and there is a need to use the command "/c pointer; offset" as per the instructions in ...
0
votes
1answer
79 views
What does anal.hasnext actually do?
I am trying to understand anal.hasnext control flow configuration option of Radare. The documentation says "Continue analysis after each function. Forces to find a function, after the end of a ...
0
votes
0answers
27 views
Saving a breakpoint in radare2 loses the format string
Good day to you all.
I'm new to radare2 and reverse engineering in general.
Debugging a small crackme.
I want to save breakpoints.
Initially, everything is fine: db* > bps and load breakpoints: ...
0
votes
0answers
28 views
How to reverse engineer structs in radare2?
Is there any way to indentify structs in radare2?
when i tried to look them, they look like normal variables, i seen people using td and tl command but I don't know how to use them. If you know please ...
0
votes
0answers
54 views
Radare2 is showing weird disassembly as compared to disassembly of gcc
Today i was playing around with c code in r2.
I compiled a file which had the following code.
#include <stdio.h>
int main(){
int a=9;
float b=1.1;
int sum;
sum = ...
0
votes
1answer
64 views
Interpret radare2 help
So I run radare2 from the command line with r2 - and attempt to display the help with the ? command. I read this line which says:
?[??][expr] Help or evaluate math expression
I am not ...
0
votes
0answers
62 views
Why won't Radare2 display main's paramethers of a 32bit ELF on a 64 bit machine?
I am new to reversing and currently trying to follow this tutorial, in which the binary provided was compiled on a 32 bit machine hence the file is a "ELF 32-bit LSB executable". It runs ...
0
votes
1answer
99 views
Golang program reversing with Radare2
I'm trying to understand how to reverse golang programs with radare2. In order to practice, i create a minimal program in Go:
package main
import "fmt"
func main() {
fmt.Println("...
0
votes
0answers
19 views
radare2 can't see error/signal messages
I'm in visual mode on the debug screen. I'm stepping through some function code with the 'F7' shortcut key, when I hit a part of the code that yields an error or some kind of message, the message text ...
0
votes
0answers
55 views
Control flow graph of entire binary file
Is it possible to get the control flow graph of the entire binary file using any disassembler? IDA Pro generates the CFG for each function. Can we use it to get the CFG of the entire program?
2
votes
1answer
77 views
Can't modify string in radare2 (.rodata section)
I was following the response to this question to change the string of an elf executable. No matter how many times I try, I just can't modify the string. I notice that probably the issue lies in the ...
0
votes
1answer
124 views
main function not found in GCC compiled code
I'm trying to learn reverse engineering using Radare2.
For this I compiled a hello world program with GCC on Ubuntu (version: gcc (Ubuntu 9.3.0-17ubuntu1~20.04) 9.3.0).
#include <stdio.h>
int ...
0
votes
0answers
24 views
“rabin2 -E” and “afll” no output for an exe file
$ rabin2 -I test.exe
arch x86
baddr 0x400000
binsz 3229424
bintype pe
bits 32
canary false
retguard false
class PE32
cmp.csum 0x0031d950
...
4
votes
1answer
221 views
Ghidra + IDA cant detect a string but Radare2 can
Im new to reverse engineering, and ive trying Ghidra, IDA (Freeware) and Radare2 with a simple CrackMe, the problem is, both Ghidra and IDA couldnt detect a string while Radare2 (Using Cutter GUI) ...
0
votes
0answers
36 views
Bypassing debugger detection in radar2
I'm currently doing a reversee engineering challenge. I disassembled the ELF binary in radare2, however the binary checks whether its attached to a debugger. How can i bypass this detection ? Thanks ...
0
votes
0answers
61 views
radare2: disassemble functions of an executable compiled with gcc
I'm studying binary exploitation from CTF challenges. When I download a binary I don't have any problem to disassemble a function using the pdf command in radare2.
However, If I compile a C program ...
2
votes
1answer
67 views
Getting memory address of particular bytes in radare2
in pwnlib there is a possibility to search for particular bytes, e.g. as follows for 0x66 byte:
print(next(p.elf.search(b'f')))
which in turn results in the following output:
4195268
Having this ...
1
vote
0answers
54 views
What do you think is the optimum environment for reverse engineering dynamically-linked aarch64 Golang binaries developed in Alpine Linux?
Direct quote from Golang's website: "GDB does not understand Go programs well. The stack management, threading, and runtime contain aspects that differ enough from the execution model GDB expects ...
0
votes
1answer
158 views
Crackme assistance - change input of a function
Just as a preface, this is a crackme from https://hack.ainfosec.com/. I know you can submit these as part of a job app, I have no intentions of doing that. Very happy to have a job in a related, but ...
0
votes
0answers
30 views
how do I use Remote Binary Protocol in cutter
how do I use Remote Binary Protocol I tried to connect to gdbserver through the normal method but it would just hang and not connect. I let it go like that for 1 hour
0
votes
0answers
69 views
How to debug a shared library with radare2?
I am currently trying to pick up radare2 but I am struggling on a little hurdle..
I am given a shared library, let's call it shared.so.
I managed to perform some static analysis using
$ r2 shared.so
...
1
vote
1answer
84 views
How to change local_184h to skip past jump commands with Radare2?
I am trying to solve a CTF challenge but I am very much out of my depth and nothing online is helping me very much. This is what I'm working with currently
| 0x55b3fd508a41 4889e5 ...
0
votes
0answers
40 views
Check indirect call function in Radare2
I'm working on a tool to construct control flow graph (CFG) from binary code (x86). For comparison purpose, I need to compare our tool with radare2.
How could we determine if an indirect call function ...
1
vote
1answer
217 views
ARM binary dissasembly, Hopper works, Ghidra and Radare2 don't for some functions
I'm disassembling a large ARM binary and I see that for some functions both Ghidra and Radare2 appear to fail to disassemble certain functions whereas Hopper works for those same functions
In Ghidra - ...
1
vote
1answer
193 views
The Graph view in Cutter is empty
Following this question, I'm trying to figure out how cscript.exe parses the .wsh Windows Script Host control files. First I tried WinDbg, but Radare2-Cutter seems like a much nicer software TBH. What ...
1
vote
0answers
48 views
How can I rename location in radare2?
In radare2 I would like to be able to rename a node in the graph view. I though setting a flag to the entry of the graph node would also change its title, but the address of the nodes still shows ...
0
votes
0answers
35 views
Radare2: Running executable from a specific point
I am using radare2 to reverse engineer a standard crackme executable. I have obtained the password, but now I need use the program to read & print a restricted file to which the executable has ...
0
votes
1answer
63 views
How does radare2 create its memory layout?
Firstly Hello,
this is my first post on this forum even though im reading alot here.
Im trying to get into reversing and Low-Level stuff in general lately, and im a bit stuck right here.
I did read ...
0
votes
0answers
30 views
How can I have an interactive r2pipe session?
I am trying to make an interactive tutorial. It uses radare2 with r2pipe as its reverse engineering toolkit.
I want my users to be able to use the visual mode through r2pipe. In order for the visual ...
0
votes
1answer
31 views
Running radare command on each line of the output of another command
Say, I have a command in radare which produces multiple input, say afl. I can run it and extract many addresses:
[0x5579ca2e2196]> afl~[0]
0x5579ca2e2060
0x5579ca2e4fe0
0x5579ca2e2090
...
0
votes
0answers
39 views
No instruction in main function when debugging with winedbg
I'v try to debugging windows PE file under Linux.
winedbg --gdb --no-start a.exe ─╯
00bc:00c0: create process 'Z:\home\coolder\a.exe'/0x1106b8 @...
1
vote
1answer
71 views
Using angr/radare2 to estimate values given chunks of assembly
I'm currently using radare2 in order to construct a simple CFG, each block/node in that graph is composed of one or more assembly instructions, I wish to estimate the value of specific register or ...
1
vote
1answer
91 views
radare2 - radare2 doesn't display string value
I have some rare cases with radare2.
when I try to display all string using "iz" it does the job.
but when I do "pdf" or "pd" I can't see actual value of string:
I see ...
1
vote
1answer
92 views
Finding mapped memory page flags in Radare2
I have a memory dump of notepad.exe. Radare's iS to print sections gives me the mapped files (executable and it's dll's) as well as the many sections simply marked 'Memory_Section', which from what I ...
3
votes
1answer
128 views
Radare2 - what does dot mean in disassembly
I've just started using radare2 and I've noticed a dot when I tried to disassamble one on my programs. The output is:
0x00000000 48b841000000. movabs rax, 0x41
I understand that 0x48 is the REX ...
1
vote
1answer
142 views
How to find DOS Header and PE Header with an entry point in Radare2?
I am currently doing byte extraction from PE files using Radare2. I know how to find the byte sequence for Dos Header and PE Header when there is no entry point and the start is defaulted to 0x0. But ...
1
vote
1answer
50 views
Results of radare2 are not correct
I am using radare2 to analyze libpng_amd64.so.1.6.34, commands are as follows:
r2 = r2pipe.open(binary_file)
r2.cmd('aaa')
funcs = r2.cmdj('aflj')
len(funcs) is 461, but the number of functions got ...
0
votes
1answer
95 views
How do I use vi keybindings at the command line in Radare2?
The Radare2 command line (I believe it's called "interactive mode"?) allows bringing back history and editing it with the arrow keys. However, I prefer to use vi/vim keybindings for this. How do I ...
1
vote
2answers
70 views
How can I change the default input radix to hexadecimal in Radare2?
Frequently when I use Radare2 I work mostly in hexadecimal. This means I'm constantly having to remember to type 0x in front of addresses, which is different from the machine-language monitors I'm ...
2
votes
1answer
167 views
Modify value to pass jump and print a message with Radare2
I have a problem with understanding, why after modifying variable var_4h and passing positively through jne at 0x000006c3 I still cannot see the message. I use radare2
In debug mode, just before cmp ...
