Opensource reverse engineering framework to disassemble, debug, analyze, manipulate binary files and more.
1
vote
1answer
57 views
How to find a memory address of variable? [Radare2]
This question seems so basic but I have spent 5+ hours trying to figure it out. I have written a program in C++ that defines a few variables and does some other stuff. What I want to do is be able to ...
1
vote
0answers
19 views
Cannot open '/proc/…/maps': No such file or directory in radare2 debug mode
When I try to load a program to radare2 debug mode, most of the time I get the following error:
$sudo r2 -d a.out
Hello world!= attach 2851 2851
Cannot open '/proc/2851/maps': No such file or ...
1
vote
0answers
40 views
Can Radare2 emulate null pointer exceptions and others?
I'm wondering if anyone has had any luck with Radare2's configuration variables, esil.exectrap, esil.iotrap, and esil.nonull while emulating?
xor eax, eax
mov eax, dword [eax] <-
From what I can ...
2
votes
1answer
103 views
grep -E with Radare2
With Radare2, I love the iI command.
I want to limit the output with grep or radare's own grep syntax.
How do I run a iI | grep -E 'bits | pic | stripped' against my binary?
[0x100001200]> iI
...
0
votes
1answer
42 views
Radare2 - How to scale panel height in visual panels mode?
Visual Panels Mode (V!):
I need more space (height) for RegisterRefs and less for Registers (its 50% blank anyway). How can i do that? I can move the vertical split with H and L but i couldn't find ...
2
votes
0answers
17 views
Radare2 - How to save/restore metadata in debug session (BPs, flag, comments..)?
How can i save/reuse/preserve Radare2 metadata (BPs, comments, flags..) of a debug session for a new debug session? I restart the debugger alot and preserving environment would be very helpful.
I ...
3
votes
1answer
65 views
Radare2 debugging - How to get into lazy imported functions?
I have a linux binary that imports functions from an external library (shared object). The functions are lazy loaded and not available when rip is at @main or @entry. When i step into such a function (...
1
vote
0answers
54 views
radare2 not showing function names
I'm using radare2 and I've noticed that it simply prints function offsets rather than function names.
I've done some tests and I've discovered that on Kali it prints offsets and on debian it prints ...
0
votes
1answer
57 views
ELF binary corrupted after adding instruction in non-executable section
I've been messing around a little with Radare2 trying to master binary exploitation and patching.
I added a couple of assembly instructions to an x86 elf binary in a non-executable section of the file,...
1
vote
2answers
43 views
How do I find all references to an address with a memory segment?
If I want to find all references to fs:[0x28] how would I go about doing it with radare2? For example,
0x000006b5 64488b042528. mov rax, qword fs:[0x28] ; [0x28:8]=0x1978 ; '(' ; "x\x19"
I ...
2
votes
0answers
60 views
Radare2 - Insert asm instructions without overwriting
In order to patch a x86 elf file on Linux, I'm struggling to insert a specific assembler instruction into the binary file without overwriting any of the preexisting instructions.
I've been reading ...
5
votes
1answer
409 views
Import symbols containing strange characters
I am analyzing a macOS app with radare2, and the app depends on a number of Qt frameworks. When I printed out the import symbols of the app's main executable, the names of the frameworks' functions ...
0
votes
0answers
33 views
Radare -Q leaking, and does it even matter?
As a follow up to a self-answered question where I discovered -q and -Q
Radare -Q is documented as,
-Q quiet mode (no prompt) and quit faster (quickLeak=true)
man radare2 shows,
-Q Same as -q, ...
1
vote
1answer
20 views
Radare -c but exit afterward
I'm using Radare to print out some information on blobs, essentially I'm running
radare2 -c "pf ... " ./myblob.bin
I would like radare to edit after it runs that -c.
2
votes
1answer
42 views
How do you print fixed width strings with radare's print format `pf`?
Let's say I have a byte sequence where U is an unsigned int (4 bytes), and ccccccccccccccc is a 15 byte character array
UcccccccccccccccU
Is it possible to print this structure using pf? I can print ...
6
votes
1answer
239 views
What is the info displayed by radare2's afl?
I can't figure out what afl actually outputs. The docs are surprisingly uninformative.
So, I've got address on the first column and symbol on the last. What is on the 2nd, 3rd and 4th columns?
...
3
votes
1answer
55 views
How do I find out what section variables and strings are defined in?
Given a simple program like this,
void main (int argc, char * argv[] ) {
char * arr[] = {"foo", "bar", "baz"};
*(arr[0]) = 'F';
printf( "%s", arr[0] );
}
How do I find out what section ...
10
votes
1answer
238 views
How to write [sp+local_variable] in radare2
Hello I'm playing with my native android library, everything was going smoothly till now. I have problem with opcodes, i don't know how to tell radare2 to write str opcode with specifc registry, and ...
4
votes
1answer
145 views
Viewing Radare keybindings from inside Radare?
Is there a way to view the keybinidngs inside of Radare? Such that I can see which function keys do things like Step Over and Step Into in Debug mode?
e~key doesn't list any of the debug keys,
key.S ...
4
votes
1answer
113 views
Is there a way to explicitly connect r2pipe to an existing radare2 session that I have open?
I understand that I can execute my script within a session using [0x401000]> . server.py and the pipe will be connected to it when I call r2pipe.open() with no arguments.
Ideally I would like to ...
0
votes
0answers
44 views
Rarun2 Multiple Input Executable
After further analysis of a binary, ran into a separate issue debugging. Have an r2pipe script successfully providing 1 input (more about r2pipe in this solved question: r2pipe won't prompt for ...
1
vote
1answer
121 views
r2pipe won't prompt for user input like the binary does in r2 debugger mode
Have a functioning r2pipe script, but there's a need for hitting crtl-c to continue near the breakpoint(not a major issue,) however the script does not pause for input when the crackme asks for user ...
5
votes
1answer
345 views
Why do many imported functions jump to addresses that do not contain instructions?
I am learning to analyze binaries using radare2 and have been confused about what occurs within imported functions. In the binary below, titled Lab2B, I statically disassembled the binary and then ...
0
votes
1answer
160 views
Reverse mips binary with radare2
when I try to reverse my mips binary in radare2, I take some instruction invalid.
sudo r2 -a mips -b 32 -d 2700
start my binary:
sudo chroot . ./qemu-mips-static bin/resident
Sorry for this ...
0
votes
1answer
119 views
Radare2 cannot debug on windows 7
I downloaded radare 2.5 for windows. I am trying to debug a binary on windows with radare and have tried the following:
radare2 -d a.exe
fork_and_ptraceme/CreateProcess: The request is not supported.
...
7
votes
2answers
288 views
Radare2 Find command line arguments and location in stack
This might have a simple solution but I can't find it anywhere.
$> ./be1 11 AAAAA
With gdb, finding argv[] and argc is simple:
(gdb) print argv[0]@argc
$7 = {0xbffff872 "be1", 0xbffff89a "11", ...
1
vote
2answers
146 views
What does XREF mean?
I have been learning about the x86 assembly language by analyzing a binary using radare2 that is stored on a Intel 80386 machine. When I have been analyzing functions on the binary, I noticed that "...
1
vote
1answer
96 views
How to list breakpoints in radare2?
in gdb to list active breakpoints is info b how to do the same in radare2? is there any similar command in radare2 or something else?
4
votes
1answer
101 views
Radare2- How to see stdout in Visual Mode
I'm new to radare2 and reverse engineering, and I can't see to see to figure out how to display any standard write in display mode.
For example if I run 'dc' command it runs the program normally and ...
-1
votes
1answer
61 views
RFLAGS info and Radare?
Stepping through instructions I can see the result of rflags change,
rflags C1PSI
rflags 1PZI
Is there anything that expands this into the appropriate flags. I know Z is Zero-flag, and P is Parity, ...
4
votes
1answer
108 views
rasm2 giving different output each time for x64
Disassembling is great but when trying to re-assemble to opcode it gives different results each time. Example:
C:\>rasm2 -a x86 -b 64 -d "48898D80FEFFFF"
mov qword [rbp - 0x180], rcx
C:\>...
1
vote
2answers
82 views
Printing bytecode in bytes given a string of assembly?
Megabeets determined in this answer that depending on asm.bits Radare may show either
lea edx, [0x80490c8] (asm.bits=32)
lea edx, [rip + 0x80490c8] (asm.bits=64)
If I want to see what the ...
3
votes
2answers
1k views
Disassembly shows `LEA` with RIP?
When I disassemble this instruction using pad on Radare I get an LEA with rip
[0x00000000]> pad 8d 15 c8 90 04 08
lea edx, [rip + 0x80490c8]
I got this instruction from this post here I'm ...
2
votes
2answers
94 views
Can I provide bytes to Radare to be disassembled?
Let's say I want to check this guys work. He says that he is getting
8d 15 c8 90 04 08 lea 0x80490c8,%edx
ba c8 90 04 08 mov $0x80490c8,%edx
Is there an easy way with Radare to ...
1
vote
1answer
134 views
How does r2dec compare to pdc?
Radare has a command pdc
pdc pseudo disassembler output in C-like syntax
I'm curious to know how the plugin r2dec-js compares to pdc it seems like they do the same thing.
0
votes
0answers
20 views
Try to pass an argument a no printable characters in debug mode on radare2
I have a program and I like to know if the assigment of a value is correct, but when I try to run in debug mode and with an argument it sends this error:
$ r2 -d ./col "`python -c "print '\x41'*16+'\...
1
vote
1answer
120 views
How can I call a function in radare2 debug session?
In gdb I can easily do the following:
(gdb) call function(arg)
what is the equivalent in r2?
There is no call function in debug session so this doesn't work:
[0x08048795] call sym.func
Inject ...
1
vote
1answer
61 views
radare2- Unable to use wopO command
I am new to radare2. I am trying out radare2 with exercise from Protostar stack0
I generate raw De Bruijn Patterns with below command
$ ragg2 -P 500 -r
...
0
votes
1answer
90 views
Radare2 create section
Radare2 has S* commands, that can show, delete, modify sections. Is it possible to create new section in executable file and save it?
1
vote
3answers
225 views
Radare produces a bunch of `add byte [rax], al`, but why?
What does a bunch of add byte [rax], al mean? I see a lot of memory addressing point to specific parts of the shared library (.dll) that have for instance, this...
0x10064faf8 0000 ...
0
votes
1answer
122 views
Radare step into and step over, outside of visual pane mode
The Radare book says
Use F7 or s to step into and F8 or S to step over current instruction.
But, I don't see it telling you how to do this with the d command. When I run d? I see
ds[?] ...
2
votes
2answers
99 views
Radare using `pd` without the call graph lines?
If I run pd I get something like this,
[0x00400540]> pd @ main + 4
0x0040064a 4883ec20 sub rsp, 0x20
0x0040064e 897dec mov dword [rbp - 0x14], edi
...
0
votes
0answers
24 views
Engaging a binary debugger in a server running an event loop?
Is there any guide that talks about effectively using a debugger inside a server? Essentially the server,
Initializes
Runs in a loop
Now I want to provide input and track it. Because it's running in ...
1
vote
2answers
423 views
How do you use the Radare debugger with command line arguments (parameters)?
If I want to debug ls I can run,
radare -d /bin/ls
But, how do I provide an argument or parameter to ls? Like I would do if I wanted to run radare -d /bin/ls -1. I've tried it like that without ...
1
vote
1answer
81 views
How to change a string in a arm 32bit lsb executable binary using radare2?
I have a arm 32bit lsb executable which prints "hello world" to the screen. How do I change the string to "Good bye" using radare2.
I believe this will teach me the basics of RE and radare2.
Thank ...
0
votes
2answers
164 views
How can i start the RE process in radare2?(make changes to the registers) [closed]
I'm an absolute newbie to reverse engineering. I have a 32bit lsb arm binary which I would like to reverse engineer using radare2. How should I begin ?
3
votes
1answer
169 views
No apparent entry point for stripped, PIE binary using radare2
I am running on 64-bit Windows 7 and am using radare2 to attempt both static and dynamic analysis of a binary executable. The issue is that I cannot seem to find the entry point of where the program ...
1
vote
2answers
91 views
Is there a way to get the headers with the Radare output?
When I use a command like fs, I get output like
0 0 * strings
1 6 * symbols
2 14 * sections
3 0 * relocs
It's clear to me on the left is an incrementing number that represents the ...
0
votes
1answer
103 views
Radare can't seek to _start symbol
When I run is to show the symbols, I see
[Symbols]
004 0x000000f0 0x006000f0 LOCAL NOTYPE 0 text1
005 0x000000cb 0x004000cb LOCAL NOTYPE 0 _print
006 0x000000d1 0x004000d1 LOCAL NOTYPE 0 ...
-1
votes
2answers
195 views
extract opcodes using radare
When we have many binaries, there is a python base solution for disassemble and extract opcodes from binaries in IDA program.
Is there any or similar solution to disassemble binaries for Radare2?
