Questions tagged [radare2]

Opensource reverse engineering framework to disassemble, debug, analyze, manipulate binary files and more.

Filter by
Sorted by
Tagged with
0
votes
1answer
56 views

Why there are only 8 hexa memory digits while my RAM is 16G

I'm totally new to reverse engineering, when I start debugging my c program with radare2, and start showing assembly, I found that addresses are only 8 hexa digits, which means 16^8 = 4294967296 ...
2
votes
1answer
48 views

Modify value to pass jump and print a message with Radare2

I have a problem with understanding, why after modifying variable var_4h and passing positively through jne at 0x000006c3 I still cannot see the message. I use radare2 In debug mode, just before cmp ...
0
votes
2answers
79 views

asm snippet to pseudo-code

I'm looking into a way to generate pseudo-code from snippet of assembly, let's assume I have this ASM push rbp mov rbp, rsp mov DWORD PTR [rbp-4], edi mov DWORD PTR [...
1
vote
1answer
42 views

text_mn in Radare2 --> Meaning?

I compiled some source code and extracted functions with Radare2 (afj). Often I get a function with "sym..text_mn" function name/ symbol. The other functions are named correctly. What does this ...
1
vote
0answers
29 views

radare2 stop on lazy loaded library (gdb's stop-on-solib-events)

I am running an application and would like to set a breakpoint, as soon as a relevant shared library is loaded. On gdb I can achieve it via set stop-on-solib-events 1 I've been unable to find ...
3
votes
2answers
114 views

Function prototypes given by Ghidra is not consistent

This is a follow up question to the question I posted over here. According to the answer, I was able to get all the function prototypes from the binary. However, the problem I am having is most of the ...
1
vote
1answer
63 views

How to set search scope in radare2

Iam wondering how to change search scope in radare2. I`ve made some research and set variables search.from and search.to, according to Radare2 Book, but it doesn't work at all! Could you help me ...
1
vote
1answer
82 views

Is `movq rax, xmm0` buggy in Radare2?

Why doesn't rax get loaded from xmm0 here? radare2 bug? GitHub issue `movq rax, xmm0` doesn't work in native debugger filed. [0x0003b0e0]> drr role reg value ref ―――――――――――――――――――...
2
votes
1answer
90 views

What is actually loaded here and different hexdump outputs on util-linux hexdump and on cutter and ghidra's hexdump

I was trying to understand what segment of file gets loaded by fourth LOAD header on phdr array. First 6 headers are shown below from readelf Program Headers: Type Offset ...
0
votes
1answer
40 views

How to detect which shared libraries a binary is actually using?

I have a stripped-down Linux-based embedded system where a closed-source program(32-bit ELF binary for MIPS) depends on several shared libraries. Two of those libraries are actually the same libcurl ...
0
votes
0answers
38 views

How can I define an int array in Radare2?

I'm disassembling a C written binary using radare2: The block of code im looking into corresponds to this one int num[5]; int sum; num[0] = 200; num[1] = 150;...
0
votes
1answer
49 views

Reference address by name in Radare2/Cutter

I have some experience with IDA and now I'm trying to use Radare2/Cutter the same way. I disassemble a DOS MZ file. I have the following: ;-- section.seg_000: 12: entry0 (); 0000:0000 push ds ...
0
votes
0answers
24 views

radare2 set data type at address

I've been using Ghidra a lot recently and have developed a nice workflow, but I'm trying to get back into r2. I'm wondering if there's a way to set the data type at a given address. For example, when ...
0
votes
1answer
54 views

Replace string in hexa with a longer one in .bin without destroying the structure (in .data)

I would like to replace some hard-coded strings in a compiled exe (in .data) which is in chinese (with no possibility to put it in other languages). I managed to replace strings in hexadecimal with ...
-1
votes
1answer
56 views

What does std::string::oprator__unsigned_long do?

I am new to reverse c++ program. I met this code from r2 decompilation. pcVar6 = (char *)sym.imp.std::string::operator___unsigned_long (&...
0
votes
0answers
71 views

Anti-re tactics or radare problem while debugging

Here's the target application: https://www.sa-mp.com/download.php While live debugging, the Windows application is starting a few threads, and Cutter auto breaks after entrypoint for a reason I'm not ...
0
votes
0answers
38 views

exploiting a binary using ret2libc

I ran into this binary at a CTF : https://github.com/auehc/AUCTF-2020/tree/master/Pwn/House%20of%20Madness I first tried to exploit it and get a shell using ret2libc technique, however I didn't ...
0
votes
3answers
130 views

Reverse engineer .so file from android app with radare2

I have a .so file from an android app, and I know how to list all functions in IDA Pro. How can I do this with radare2?
0
votes
1answer
79 views

Way to get all the function prototype using Ghidra

I have been trying to extract the function prototypes from a binary file using Ghidra. Up for now what I have done was to use the Ghidra's included "Decompile" script and filtered out the function ...
11
votes
2answers
23k views

Find reference to string in radare2

In this crackme solution first the strings are found: $ rabin2 -z crackserial_linux addr=0x00000aa0 off=0x00000aa0 ordinal=000 sz=7 len=7 section=.rodata type=A string=User: addr=0x00000aa7 off=...
0
votes
0answers
30 views

Decompile in Radare for use in AVR studio, byte addressing vs word addressing

Hoping this has a simple answer... I'm trying to use Radare2 to generate assembly code that later can be compiled in Avr studio 7. What I notice is that Radare (running pD) generates assembly code ...
1
vote
1answer
34 views

Command “f?flagname” doesn't work as expected in radare2

PS C:\_> r2 -v radare2 4.3.1 6 @ windows-x86-64 git.4.3.1 commit: 54ac837b5503f10f91e2069ac357791f7a3e635a build: Fri 03/06/2020__15:52:24.93 PS C:\_> r2 -- -- 99 bugs, take one down pass it ...
0
votes
1answer
34 views

Start radare2 with pre-set visual mode configuration

This is the way I like to RE with radare visual mode. But I have to configure it everytime I start r2. How can I make it so r2 starts with this visual everytime I enter visual mode?
3
votes
3answers
205 views

Way to get basic blocks of a binary using Ghidra

I am using ghidra to do some reverse engineering of an ARM binary. I am wondering whether there is a way to get the basic blocks related to all the listing. Is there a function through the IDE or a ...
0
votes
1answer
82 views

Getting radare2 to load z80 binaries properly

I'm trying to disassemble some Sega Master System roms. In order to do so, I've checked for the extra 512 bytes from old roms and once I was sure they weren't there, I proceeded to run radare2 on one ...
9
votes
6answers
9k views

Radare2 (noob question) can't set breakpoint?

I was following this video: https://www.youtube.com/watch?v=3NTXFUxcKPc at the end it show how to do basic stuff with Radare2. When i try to set a break point with: db 0x004005bd where '0x004005bd' ...
3
votes
2answers
101 views

Get certain instruction count for multi-architecture binaries

I need to get an ELF binary's total count of Function call instruction conditional jump (branch) instruction The binary could be any CPU architecture, like x64, ARM, MIPS, Motorola 68K, etc. It ...
2
votes
2answers
239 views

Radare2 Debugging: How do I pipe a program's output to another's input?

I wrote a C program that constructs a ROP payload and sends it to stdout. Using Radare2's debug mode, how would I pipe this output to a binary I am trying to exploit that accepts input on stdin? For ...
0
votes
0answers
69 views

Learning Certificate Pinning Bypass iOS

I want to understand how to do a Cert pinning bypass. So this is what I've attempted: Attempt 1 Use frida-trace -U THEAPPNAME -i "*NSURL*" The problem with this approach is that is not matching ...
1
vote
1answer
213 views

Renaming variables radare2

I have a variable called var_14h in disassemble code. I want to rename this variable. I try to rename the variable by using the following afvn var_14h i However, radare complains and returns an ...
2
votes
1answer
192 views

Setting register names in Radare2

I am reverse-engineering an 8051 architecture program of a specific chip. The disassembly naturally doesn't contain any function names, and the register names are minimal. For example, address 0xb3 is ...
4
votes
1answer
148 views

How do I permanently change the disassembly syntax in Radare2?

As the title says, I am trying to change the default disassembly syntax in Radare2 from Intel to AT&T. Looking up documentation, I found the following. [0x00405e1c]> e asm.syntax=att However, ...
2
votes
2answers
3k views

How to display .text section of a PE in radare2?

I used rabin2 -Sr myfilename to get the size of the .text section of myfilename. But, how can I dump the whole hexadecimal section of the .text onto an output file? My purpose is to read the byte ...
2
votes
1answer
248 views

Radare2 - How to debug Android native code (dynamic analysis)?

I'm using Termux(root) on LineageOS 16 (Android 9) with radare2 (v3.6.0 linux-arm32). When i attach to a process with 'r2 -d pid' the app freezes properly but doesn't continue with 'dc'. I'm not sure ...
1
vote
0answers
41 views

Add indirect branch target reference manually (xref, crossreference) in Cutter (radare2)?

How can I create a reference for an indirect branch instruction blx r0 so that the call to the address stored in r0 shows up in the graph? I've tried flagging the target (function), but that does ...
0
votes
1answer
491 views

how to use core file in radare2?

In gdb i can backtrace with core file and executable file. It seems radare2 can read core file. like this $ r2 core Setting up coredump: asm.arch <-> x86 and asm.bits <-> 64 Setting up ...
4
votes
1answer
627 views

How to do debug a running java process in linux?

TLDR I want to do live debugging of a java program on a linux machine, and don't how/what debugger to attach to the JVM to get this done. I expect that this is a well-solved problem, but I lack the ...
2
votes
1answer
110 views

Seek to value stored in memory in radare2

Using radare2, I am reverse engineering a custom language interpreter. It stores compiled functions as a list of pointers to language primitives. I would like to seek to these locations, but typing ...
0
votes
1answer
68 views

radare2 memory changing in debug mode

I have tiny program: 0x08048080 66a1a0900408 mov ax, word loc.name 0x08048086 66bbafbe mov bx, 0xbeaf 0x0804808a 66891da09004. mov word loc.name,...
0
votes
1answer
81 views

Extracting functions of .obj file (compiled by myself with Visual Studio 19) --> extracts wrong data

How can I find only real functions not data garbage like section..debug_S_105 ? * I need to collect function data (assembler code) of Open Source C++ Files which I compile with Visual Studio 19 (sln ...
0
votes
1answer
215 views

Symbolic simplifications in radare2

Let's have a look to this assembly code in radare2: xxxxxxx mov rax,rbx xxxxxxx add rax,rax xxxxxxx add rax,rbx xxxxxxx shl rax,2 yyyyyyy nop Is there a way to ask radare2 to evaluate rax value ...
1
vote
0answers
65 views

Some obstacles in reversing a JNI Native library

I deleted my last question (it was not still answered and none's effort was wasted) as I got back and thought to re-read JNI documentation, to find I misinterpreted some bits. Things are now clearer ...
0
votes
0answers
80 views

Radare2 jump/switch table walk for 8051

For 8051 target exist famous no-return function with body of d083d082f8e4937012740193700da3a393f8740193f5828883e4737402936860efa3a3a380df which correspond to ?C?CCASE function: / 38: fcn.00000000 ...
3
votes
1answer
429 views

Disassemble CC2541 firmware (TI SensorTag)

I'm digging into a BLE product based on a CC2541 MCU (similar to the Texas Instruments SensorTag). So for experimenting we can use an official firmware: http://processors.wiki.ti.com/images/1/10/...
2
votes
1answer
1k views

Reverse Engineering BIOS (AMI A0.57)

Recently I got really interested in BIOS RE and I used chipsec to dump the content of SPI Flash ROM of my HP Omen Desktop PC to start my journey. But unlike older BIOSes, the binary file was pretty ...
0
votes
1answer
87 views

Radare2 produces null bytes on write

I've created a simple program in C that prints the text "Hello, World". I'm learning to use Radare and attempting to change the "Hello, World" string in the binary executable (PE in this case). But ...
2
votes
1answer
467 views

Radare2 create section

Radare2 has S* commands, that can show, delete, modify sections. Is it possible to create new section in executable file and save it?
6
votes
1answer
365 views

Is there any way to display the standard input and output of a program to Cutter's console while debugging?

So it's easy to transfer the standard input and output in radare2 to a new terminal using rarun2, here's how: Debugging with radare2 using two terminals i was wondering if i can use rarun2 with ...
6
votes
2answers
4k views

Disassembly shows `LEA` with RIP?

When I disassemble this instruction using pad on Radare I get an LEA with rip [0x00000000]> pad 8d 15 c8 90 04 08 lea edx, [rip + 0x80490c8] I got this instruction from this post here I'm ...
2
votes
2answers
234 views

Radare2 doesn't update current address, when single-step debugging using `ds`?

Radare2 doesn't update current address, when single-step debugging using ds? I'm debugging an ELF binary on Linux using single-step (ds). The problem is that the current address at the prompt doesn't ...

1
2 3 4 5 6