Questions tagged [radare2]
Opensource reverse engineering framework to disassemble, debug, analyze, manipulate binary files and more.
297
questions
0
votes
0answers
10 views
“rabin2 -E” and “afll” no output for an exe file
$ rabin2 -I test.exe
arch x86
baddr 0x400000
binsz 3229424
bintype pe
bits 32
canary false
retguard false
class PE32
cmp.csum 0x0031d950
...
3
votes
1answer
88 views
Ghidra + IDA cant detect a string but Radare2 can
Im new to reverse engineering, and ive trying Ghidra, IDA (Freeware) and Radare2 with a simple CrackMe, the problem is, both Ghidra and IDA couldnt detect a string while Radare2 (Using Cutter GUI) ...
0
votes
0answers
29 views
Bypassing debugger detection in radar2
I'm currently doing a reversee engineering challenge. I disassembled the ELF binary in radare2, however the binary checks whether its attached to a debugger. How can i bypass this detection ? Thanks ...
0
votes
0answers
26 views
radare2: disassemble functions of an executable compiled with gcc
I'm studying binary exploitation from CTF challenges. When I download a binary I don't have any problem to disassemble a function using the pdf command in radare2.
However, If I compile a C program ...
0
votes
1answer
44 views
Getting memory address of particular bytes in radare2
in pwnlib there is a possibility to search for particular bytes, e.g. as follows for 0x66 byte:
print(next(p.elf.search(b'f')))
which in turn results in the following output:
4195268
Having this ...
1
vote
0answers
40 views
What do you think is the optimum environment for reverse engineering dynamically-linked aarch64 Golang binaries developed in Alpine Linux?
Direct quote from Golang's website: "GDB does not understand Go programs well. The stack management, threading, and runtime contain aspects that differ enough from the execution model GDB expects ...
0
votes
1answer
108 views
Crackme assistance - change input of a function
Just as a preface, this is a crackme from https://hack.ainfosec.com/. I know you can submit these as part of a job app, I have no intentions of doing that. Very happy to have a job in a related, but ...
0
votes
0answers
27 views
how do I use Remote Binary Protocol in cutter
how do I use Remote Binary Protocol I tried to connect to gdbserver through the normal method but it would just hang and not connect. I let it go like that for 1 hour
0
votes
0answers
38 views
How to debug a shared library with radare2?
I am currently trying to pick up radare2 but I am struggling on a little hurdle..
I am given a shared library, let's call it shared.so.
I managed to perform some static analysis using
$ r2 shared.so
...
0
votes
1answer
61 views
How to change local_184h to skip past jump commands with Radare2?
I am trying to solve a CTF challenge but I am very much out of my depth and nothing online is helping me very much. This is what I'm working with currently
| 0x55b3fd508a41 4889e5 ...
0
votes
0answers
25 views
Check indirect call function in Radare2
I'm working on a tool to construct control flow graph (CFG) from binary code (x86). For comparison purpose, I need to compare our tool with radare2.
How could we determine if an indirect call function ...
1
vote
1answer
69 views
ARM binary dissasembly, Hopper works, Ghidra and Radare2 don't for some functions
I'm disassembling a large ARM binary and I see that for some functions both Ghidra and Radare2 appear to fail to disassemble certain functions whereas Hopper works for those same functions
In Ghidra - ...
1
vote
1answer
159 views
The Graph view in Cutter is empty
Following this question, I'm trying to figure out how cscript.exe parses the .wsh Windows Script Host control files. First I tried WinDbg, but Radare2-Cutter seems like a much nicer software TBH. What ...
1
vote
0answers
29 views
How can I rename location in radare2?
In radare2 I would like to be able to rename a node in the graph view. I though setting a flag to the entry of the graph node would also change its title, but the address of the nodes still shows ...
0
votes
0answers
31 views
Radare2: Running executable from a specific point
I am using radare2 to reverse engineer a standard crackme executable. I have obtained the password, but now I need use the program to read & print a restricted file to which the executable has ...
0
votes
1answer
44 views
How does radare2 create its memory layout?
Firstly Hello,
this is my first post on this forum even though im reading alot here.
Im trying to get into reversing and Low-Level stuff in general lately, and im a bit stuck right here.
I did read ...
0
votes
0answers
24 views
How can I have an interactive r2pipe session?
I am trying to make an interactive tutorial. It uses radare2 with r2pipe as its reverse engineering toolkit.
I want my users to be able to use the visual mode through r2pipe. In order for the visual ...
0
votes
1answer
28 views
Running radare command on each line of the output of another command
Say, I have a command in radare which produces multiple input, say afl. I can run it and extract many addresses:
[0x5579ca2e2196]> afl~[0]
0x5579ca2e2060
0x5579ca2e4fe0
0x5579ca2e2090
...
0
votes
0answers
32 views
No instruction in main function when debugging with winedbg
I'v try to debugging windows PE file under Linux.
winedbg --gdb --no-start a.exe āāÆ
00bc:00c0: create process 'Z:\home\coolder\a.exe'/0x1106b8 @...
1
vote
1answer
49 views
Using angr/radare2 to estimate values given chunks of assembly
I'm currently using radare2 in order to construct a simple CFG, each block/node in that graph is composed of one or more assembly instructions, I wish to estimate the value of specific register or ...
1
vote
1answer
62 views
radare2 - radare2 doesn't display string value
I have some rare cases with radare2.
when I try to display all string using "iz" it does the job.
but when I do "pdf" or "pd" I can't see actual value of string:
I see ...
1
vote
1answer
58 views
Finding mapped memory page flags in Radare2
I have a memory dump of notepad.exe. Radare's iS to print sections gives me the mapped files (executable and it's dll's) as well as the many sections simply marked 'Memory_Section', which from what I ...
3
votes
1answer
123 views
Radare2 - what does dot mean in disassembly
I've just started using radare2 and I've noticed a dot when I tried to disassamble one on my programs. The output is:
0x00000000 48b841000000. movabs rax, 0x41
I understand that 0x48 is the REX ...
1
vote
1answer
100 views
How to find DOS Header and PE Header with an entry point in Radare2?
I am currently doing byte extraction from PE files using Radare2. I know how to find the byte sequence for Dos Header and PE Header when there is no entry point and the start is defaulted to 0x0. But ...
1
vote
1answer
47 views
Results of radare2 are not correct
I am using radare2 to analyze libpng_amd64.so.1.6.34, commands are as follows:
r2 = r2pipe.open(binary_file)
r2.cmd('aaa')
funcs = r2.cmdj('aflj')
len(funcs) is 461, but the number of functions got ...
0
votes
0answers
16 views
Why does `omb` sometimes not work in Radare2
I'm a little confused about the behaviour of the omb command in Radare2. Sometimes when I give it what I believe is a valid segment number and offset, it doesn't change it. (This is usually after I ...
0
votes
1answer
62 views
How do I use vi keybindings at the command line in Radare2?
The Radare2 command line (I believe it's called "interactive mode"?) allows bringing back history and editing it with the arrow keys. However, I prefer to use vi/vim keybindings for this. How do I ...
1
vote
2answers
51 views
How can I change the default input radix to hexadecimal in Radare2?
Frequently when I use Radare2 I work mostly in hexadecimal. This means I'm constantly having to remember to type 0x in front of addresses, which is different from the machine-language monitors I'm ...
2
votes
1answer
105 views
Modify value to pass jump and print a message with Radare2
I have a problem with understanding, why after modifying variable var_4h and passing positively through jne at 0x000006c3 I still cannot see the message. I use radare2
In debug mode, just before cmp ...
0
votes
2answers
148 views
asm snippet to pseudo-code
I'm looking into a way to generate pseudo-code from snippet of assembly,
let's assume I have this ASM
push rbp
mov rbp, rsp
mov DWORD PTR [rbp-4], edi
mov DWORD PTR [...
0
votes
1answer
73 views
Why there are only 8 hexa memory digits while my RAM is 16G
I'm totally new to reverse engineering, when I start debugging my c program with radare2, and start showing assembly, I found that addresses are only 8 hexa digits, which means 16^8 = 4294967296 ...
1
vote
0answers
44 views
radare2 stop on lazy loaded library (gdb's stop-on-solib-events)
I am running an application and would like to set a breakpoint, as soon as a relevant shared library is loaded. On gdb I can achieve it via
set stop-on-solib-events 1
I've been unable to find ...
1
vote
1answer
97 views
Is `movq rax, xmm0` buggy in Radare2?
Why doesn't rax get loaded from xmm0 here? radare2 bug?
GitHub issue `movq rax, xmm0` doesn't work in native debugger filed.
[0x0003b0e0]> drr
role reg value ref
āāāāāāāāāāāāāāāāāāā...
0
votes
1answer
63 views
How to detect which shared libraries a binary is actually using?
I have a stripped-down Linux-based embedded system where a closed-source program(32-bit ELF binary for MIPS) depends on several shared libraries. Two of those libraries are actually the same libcurl ...
1
vote
0answers
54 views
How can I define an int array in Radare2?
I'm disassembling a C written binary using radare2:
The block of code im looking into corresponds to this one
int num[5];
int sum;
num[0] = 200;
num[1] = 150;...
0
votes
0answers
42 views
radare2 set data type at address
I've been using Ghidra a lot recently and have developed a nice workflow, but I'm trying to get back into r2.
I'm wondering if there's a way to set the data type at a given address. For example, when ...
0
votes
1answer
89 views
Replace string in hexa with a longer one in .bin without destroying the structure (in .data)
I would like to replace some hard-coded strings in a compiled exe (in .data) which is in chinese (with no possibility to put it in other languages).
I managed to replace strings in hexadecimal with ...
-1
votes
1answer
61 views
What does std::string::oprator__unsigned_long do?
I am new to reverse c++ program.
I met this code from r2 decompilation.
pcVar6 = (char *)sym.imp.std::string::operator___unsigned_long
(&...
0
votes
0answers
96 views
Anti-re tactics or radare problem while debugging
Here's the target application: https://www.sa-mp.com/download.php
While live debugging, the Windows application is starting a few threads, and Cutter auto breaks after entrypoint for a reason I'm not ...
0
votes
0answers
62 views
exploiting a binary using ret2libc
I ran into this binary at a CTF :
https://github.com/auehc/AUCTF-2020/tree/master/Pwn/House%20of%20Madness
I first tried to exploit it and get a shell using ret2libc technique, however I didn't ...
4
votes
2answers
417 views
Function prototypes given by Ghidra is not consistent
This is a follow up question to the question I posted over here. According to the answer, I was able to get all the function prototypes from the binary. However, the problem I am having is most of the ...
1
vote
1answer
318 views
Way to get all the function prototype using Ghidra
I have been trying to extract the function prototypes from a binary file using Ghidra. Up till now what I have done was to use Ghidra's included "Decompile" script and filtered out the function ...
1
vote
1answer
45 views
text_mn in Radare2 --> Meaning?
I compiled some source code and extracted functions with Radare2 (afj).
Often I get a function with "sym..text_mn" function name/ symbol.
The other functions are named correctly. What does this ...
0
votes
0answers
63 views
Decompile in Radare for use in AVR studio, byte addressing vs word addressing
Hoping this has a simple answer...
I'm trying to use Radare2 to generate assembly code that later can be compiled in Avr studio 7. What I notice is that Radare (running pD) generates assembly code ...
0
votes
1answer
99 views
Reference address by name in Radare2/Cutter
I have some experience with IDA and now I'm trying to use Radare2/Cutter the same way. I disassemble a DOS MZ file. I have the following:
;-- section.seg_000:
12: entry0 ();
0000:0000 push ds ...
1
vote
1answer
36 views
Command “f?flagname” doesn't work as expected in radare2
PS C:\_> r2 -v
radare2 4.3.1 6 @ windows-x86-64 git.4.3.1
commit: 54ac837b5503f10f91e2069ac357791f7a3e635a build: Fri 03/06/2020__15:52:24.93
PS C:\_> r2 --
-- 99 bugs, take one down pass it ...
0
votes
1answer
52 views
Start radare2 with pre-set visual mode configuration
This is the way I like to RE with radare visual mode. But I have to configure it everytime I start r2. How can I make it so r2 starts with this visual everytime I enter visual mode?
3
votes
3answers
607 views
Way to get basic blocks of a binary using Ghidra
I am using ghidra to do some reverse engineering of an ARM binary. I am wondering whether there is a way to get the basic blocks related to all the listing. Is there a function through the IDE or a ...
1
vote
0answers
164 views
Learning Certificate Pinning Bypass iOS
I want to understand how to do a Cert pinning bypass.
So this is what I've attempted:
Attempt 1
Use frida-trace -U THEAPPNAME -i "*NSURL*"
The problem with this approach is that is not matching ...
4
votes
2answers
801 views
Radare2 Debugging: How do I pipe a program's output to another's input?
I wrote a C program that constructs a ROP payload and sends it to stdout. Using Radare2's debug mode, how would I pipe this output to a binary I am trying to exploit that accepts input on stdin?
For ...
