Questions tagged [radare2]
Opensource reverse engineering framework to disassemble, debug, analyze, manipulate binary files and more.
282
questions
0
votes
0answers
12 views
How can I have an interactive r2pipe session?
I am trying to make an interactive tutorial. It uses radare2 with r2pipe as its reverse engineering toolkit.
I want my users to be able to use the visual mode through r2pipe. In order for the visual ...
0
votes
1answer
23 views
Running radare command on each line of the output of another command
Say, I have a command in radare which produces multiple input, say afl. I can run it and extract many addresses:
[0x5579ca2e2196]> afl~[0]
0x5579ca2e2060
0x5579ca2e4fe0
0x5579ca2e2090
...
0
votes
0answers
22 views
No instruction in main function when debugging with winedbg
I'v try to debugging windows PE file under Linux.
winedbg --gdb --no-start a.exe ─╯
00bc:00c0: create process 'Z:\home\coolder\a.exe'/0x1106b8 @...
1
vote
1answer
32 views
Using angr/radare2 to estimate values given chunks of assembly
I'm currently using radare2 in order to construct a simple CFG, each block/node in that graph is composed of one or more assembly instructions, I wish to estimate the value of specific register or ...
1
vote
1answer
43 views
radare2 - radare2 doesn't display string value
I have some rare cases with radare2.
when I try to display all string using "iz" it does the job.
but when I do "pdf" or "pd" I can't see actual value of string:
I see ...
1
vote
1answer
47 views
Finding mapped memory page flags in Radare2
I have a memory dump of notepad.exe. Radare's iS to print sections gives me the mapped files (executable and it's dll's) as well as the many sections simply marked 'Memory_Section', which from what I ...
3
votes
1answer
115 views
Radare2 - what does dot mean in disassembly
I've just started using radare2 and I've noticed a dot when I tried to disassamble one on my programs. The output is:
0x00000000 48b841000000. movabs rax, 0x41
I understand that 0x48 is the REX ...
1
vote
1answer
64 views
How to find DOS Header and PE Header with an entry point in Radare2?
I am currently doing byte extraction from PE files using Radare2. I know how to find the byte sequence for Dos Header and PE Header when there is no entry point and the start is defaulted to 0x0. But ...
1
vote
1answer
44 views
Results of radare2 are not correct
I am using radare2 to analyze libpng_amd64.so.1.6.34, commands are as follows:
r2 = r2pipe.open(binary_file)
r2.cmd('aaa')
funcs = r2.cmdj('aflj')
len(funcs) is 461, but the number of functions got ...
0
votes
0answers
15 views
Why does `omb` sometimes not work in Radare2
I'm a little confused about the behaviour of the omb command in Radare2. Sometimes when I give it what I believe is a valid segment number and offset, it doesn't change it. (This is usually after I ...
0
votes
1answer
34 views
How do I use vi keybindings at the command line in Radare2?
The Radare2 command line (I believe it's called "interactive mode"?) allows bringing back history and editing it with the arrow keys. However, I prefer to use vi/vim keybindings for this. How do I ...
1
vote
2answers
46 views
How can I change the default input radix to hexadecimal in Radare2?
Frequently when I use Radare2 I work mostly in hexadecimal. This means I'm constantly having to remember to type 0x in front of addresses, which is different from the machine-language monitors I'm ...
2
votes
1answer
69 views
Modify value to pass jump and print a message with Radare2
I have a problem with understanding, why after modifying variable var_4h and passing positively through jne at 0x000006c3 I still cannot see the message. I use radare2
In debug mode, just before cmp ...
0
votes
2answers
106 views
asm snippet to pseudo-code
I'm looking into a way to generate pseudo-code from snippet of assembly,
let's assume I have this ASM
push rbp
mov rbp, rsp
mov DWORD PTR [rbp-4], edi
mov DWORD PTR [...
0
votes
1answer
69 views
Why there are only 8 hexa memory digits while my RAM is 16G
I'm totally new to reverse engineering, when I start debugging my c program with radare2, and start showing assembly, I found that addresses are only 8 hexa digits, which means 16^8 = 4294967296 ...
1
vote
0answers
37 views
radare2 stop on lazy loaded library (gdb's stop-on-solib-events)
I am running an application and would like to set a breakpoint, as soon as a relevant shared library is loaded. On gdb I can achieve it via
set stop-on-solib-events 1
I've been unable to find ...
1
vote
1answer
89 views
Is `movq rax, xmm0` buggy in Radare2?
Why doesn't rax get loaded from xmm0 here? radare2 bug?
GitHub issue `movq rax, xmm0` doesn't work in native debugger filed.
[0x0003b0e0]> drr
role reg value ref
―――――――――――――――――――...
0
votes
1answer
48 views
How to detect which shared libraries a binary is actually using?
I have a stripped-down Linux-based embedded system where a closed-source program(32-bit ELF binary for MIPS) depends on several shared libraries. Two of those libraries are actually the same libcurl ...
0
votes
0answers
42 views
How can I define an int array in Radare2?
I'm disassembling a C written binary using radare2:
The block of code im looking into corresponds to this one
int num[5];
int sum;
num[0] = 200;
num[1] = 150;...
0
votes
0answers
34 views
radare2 set data type at address
I've been using Ghidra a lot recently and have developed a nice workflow, but I'm trying to get back into r2.
I'm wondering if there's a way to set the data type at a given address. For example, when ...
0
votes
1answer
65 views
Replace string in hexa with a longer one in .bin without destroying the structure (in .data)
I would like to replace some hard-coded strings in a compiled exe (in .data) which is in chinese (with no possibility to put it in other languages).
I managed to replace strings in hexadecimal with ...
-1
votes
1answer
58 views
What does std::string::oprator__unsigned_long do?
I am new to reverse c++ program.
I met this code from r2 decompilation.
pcVar6 = (char *)sym.imp.std::string::operator___unsigned_long
(&...
0
votes
0answers
80 views
Anti-re tactics or radare problem while debugging
Here's the target application: https://www.sa-mp.com/download.php
While live debugging, the Windows application is starting a few threads, and Cutter auto breaks after entrypoint for a reason I'm not ...
0
votes
0answers
48 views
exploiting a binary using ret2libc
I ran into this binary at a CTF :
https://github.com/auehc/AUCTF-2020/tree/master/Pwn/House%20of%20Madness
I first tried to exploit it and get a shell using ret2libc technique, however I didn't ...
3
votes
2answers
201 views
Function prototypes given by Ghidra is not consistent
This is a follow up question to the question I posted over here. According to the answer, I was able to get all the function prototypes from the binary. However, the problem I am having is most of the ...
1
vote
1answer
201 views
Way to get all the function prototype using Ghidra
I have been trying to extract the function prototypes from a binary file using Ghidra. Up till now what I have done was to use Ghidra's included "Decompile" script and filtered out the function ...
1
vote
1answer
45 views
text_mn in Radare2 --> Meaning?
I compiled some source code and extracted functions with Radare2 (afj).
Often I get a function with "sym..text_mn" function name/ symbol.
The other functions are named correctly. What does this ...
0
votes
0answers
38 views
Decompile in Radare for use in AVR studio, byte addressing vs word addressing
Hoping this has a simple answer...
I'm trying to use Radare2 to generate assembly code that later can be compiled in Avr studio 7. What I notice is that Radare (running pD) generates assembly code ...
0
votes
1answer
76 views
Reference address by name in Radare2/Cutter
I have some experience with IDA and now I'm trying to use Radare2/Cutter the same way. I disassemble a DOS MZ file. I have the following:
;-- section.seg_000:
12: entry0 ();
0000:0000 push ds ...
1
vote
1answer
35 views
Command “f?flagname” doesn't work as expected in radare2
PS C:\_> r2 -v
radare2 4.3.1 6 @ windows-x86-64 git.4.3.1
commit: 54ac837b5503f10f91e2069ac357791f7a3e635a build: Fri 03/06/2020__15:52:24.93
PS C:\_> r2 --
-- 99 bugs, take one down pass it ...
0
votes
1answer
38 views
Start radare2 with pre-set visual mode configuration
This is the way I like to RE with radare visual mode. But I have to configure it everytime I start r2. How can I make it so r2 starts with this visual everytime I enter visual mode?
3
votes
3answers
411 views
Way to get basic blocks of a binary using Ghidra
I am using ghidra to do some reverse engineering of an ARM binary. I am wondering whether there is a way to get the basic blocks related to all the listing. Is there a function through the IDE or a ...
0
votes
0answers
106 views
Learning Certificate Pinning Bypass iOS
I want to understand how to do a Cert pinning bypass.
So this is what I've attempted:
Attempt 1
Use frida-trace -U THEAPPNAME -i "*NSURL*"
The problem with this approach is that is not matching ...
3
votes
2answers
396 views
Radare2 Debugging: How do I pipe a program's output to another's input?
I wrote a C program that constructs a ROP payload and sends it to stdout. Using Radare2's debug mode, how would I pipe this output to a binary I am trying to exploit that accepts input on stdin?
For ...
4
votes
1answer
219 views
How do I permanently change the disassembly syntax in Radare2?
As the title says, I am trying to change the default disassembly syntax in Radare2 from Intel to AT&T. Looking up documentation, I found the following.
[0x00405e1c]> e asm.syntax=att
However, ...
0
votes
3answers
261 views
Reverse engineer .so file from android app with radare2
I have a .so file from an android app, and I know how to list all functions in IDA Pro.
How can I do this with radare2?
1
vote
0answers
43 views
Add indirect branch target reference manually (xref, crossreference) in Cutter (radare2)?
How can I create a reference for an indirect branch instruction
blx r0
so that the call to the address stored in r0 shows up in the graph?
I've tried flagging the target (function), but that does ...
0
votes
1answer
109 views
Getting radare2 to load z80 binaries properly
I'm trying to disassemble some Sega Master System roms.
In order to do so, I've checked for the extra 512 bytes from old roms and once I was sure they weren't there, I proceeded to run radare2 on one ...
2
votes
1answer
173 views
Seek to value stored in memory in radare2
Using radare2, I am reverse engineering a custom language interpreter. It stores compiled functions as a list of pointers to language primitives. I would like to seek to these locations, but typing ...
0
votes
1answer
148 views
Extracting functions of .obj file (compiled by myself with Visual Studio 19) --> extracts wrong data
How can I find only real functions not data garbage like section..debug_S_105 ? *
I need to collect function data (assembler code) of Open Source C++ Files which I compile with Visual Studio 19 (sln ...
1
vote
1answer
402 views
Renaming variables radare2
I have a variable called var_14h in disassemble code. I want to rename this variable. I try to rename the variable by using the following
afvn var_14h i
However, radare complains and returns an ...
1
vote
0answers
100 views
Some obstacles in reversing a JNI Native library
I deleted my last question (it was not still answered and none's effort was wasted) as I got back and thought to re-read JNI documentation, to find I misinterpreted some bits. Things are now clearer
...
3
votes
0answers
156 views
Understanding output of rabin2
I am wondering what the crypto, linenum, pcalign, relocs and va values mean in the output of rabin2.
I took a look in the source code of radare2 and it seems for ELF va is always true, I assume it ...
6
votes
1answer
585 views
Is there any way to display the standard input and output of a program to Cutter's console while debugging?
So it's easy to transfer the standard input and output in radare2 to a new terminal using rarun2, here's how:
Debugging with radare2 using two terminals
i was wondering if i can use rarun2 with ...
2
votes
2answers
189 views
Add disassembly comment at rip in radare2
When in visual mode (command v) in radare, in the disassembly panel, I can press ; to add a comment at the location I am current seeked to (which is the top instruction in the disassembly view). I ...
0
votes
1answer
96 views
Radare2 produces null bytes on write
I've created a simple program in C that prints the text "Hello, World". I'm learning to use Radare and attempting to change the "Hello, World" string in the binary executable (PE in this case).
But ...
5
votes
0answers
129 views
Radare2 8051 code bank switching
Some of 8051 chips use bank switching to extend accessible code memory.
Good example is Silabs C8051F12x. Another example is here.
Code area in range 0x0000..0x7ffff is common always accessible code ...
0
votes
0answers
96 views
Radare2 jump/switch table walk for 8051
For 8051 target exist famous no-return function with body of
d083d082f8e4937012740193700da3a393f8740193f5828883e4737402936860efa3a3a380df
which correspond to ?C?CCASE function:
/ 38: fcn.00000000 ...
0
votes
0answers
42 views
Opening the test file in the Radare2 recording mode
I'm studying the radare2 utility (I installed it on Windows) and I wanted to edit the file with it. But an error constantly occurs:
[0x080486f5]> oo+
r_core_file_reopen: Cannot reopen file: C:\...
0
votes
1answer
303 views
How to decrypt the password using radare2 or gdb?
.--------------------------------------------------.
| [0x804851b] |
...
