Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [radare2]

Opensource reverse engineering framework to disassemble, debug, analyze, manipulate binary files and more.

1
vote
1answer
41 views

How to set a breakpoint in an execve'd program in radare2?

If I have a program A, which uses execve to run program B. How can I set a breakpoint in program B's main routine if I'm debugging program A? After a certain point in the execve routine, program B ...
1
vote
0answers
79 views

Password is right, but still wrong?

i am trying to find the password of a binary with radare2 - a crackme again :-) I already thought I've found the password ('pass'), but this seems to be not the right one. Or there is a trick I didn'...
2
votes
1answer
65 views

Radare2 does not display the entire assembler code

I am trying to solve this ELF - Ptrace crack me. Here are the commands I use : I start radare2 with the crack me as argument. radare2 ch3.bin I decide to go to the main and print the assembly code ...
0
votes
1answer
32 views

How to print the value of register with Radare 2

I am trying to solve this ELF - Ptrace challenge. I use Radare 2. This is the commands I execute to print the assembly code. radare2 ch3.bin [0x080482f0]> aaa [[anal.jmptbl] Missing cjmp bb in ...
1
vote
1answer
61 views

Setting register names in Radare2

I am reverse-engineering an 8051 architecture program of a specific chip. The disassembly naturally doesn't contain any function names, and the register names are minimal. For example, address 0xb3 is ...
-1
votes
0answers
25 views

Is the inability to run an application after the editing of a Mach O library due to improper editing or of a verification mismatch?

So there is an application (Audio Hijack specifically) that I am trying to edit after having downloaded it, and it (obviously) only includes the compiled code. This includes a Mach-O 64-bit ...
7
votes
2answers
873 views

what is radare2's equivalent to GDB's 'find &system,+9999999,“/bin/sh”'

What is radare2's equivalent to GDB's find &system,+9999999,"/bin/sh"?
0
votes
1answer
35 views

how to use core file in radare2?

In gdb i can backtrace with core file and executable file. It seems radare2 can read core file. like this $ r2 core Setting up coredump: asm.arch <-> x86 and asm.bits <-> 64 Setting up ...
2
votes
1answer
45 views

radare2 how to interpret ascii-art color bars?

I can't understand the meaning of ascii-art color bars. what is the meaning of the # charaters? [0x08000210]> iS= 00 0x08000000 |---------------------------------| 0x08000000 0 --- 01 ...
0
votes
1answer
229 views

Radare2 create section

Radare2 has S* commands, that can show, delete, modify sections. Is it possible to create new section in executable file and save it?
0
votes
1answer
70 views

Radare2 Disassembler How Do You Organize Visual Panels (V!)?

I would like to use Radare2 to learn about how C is assembled into assembly but I am having trouble with the layout. I think the V! mode would be very handy as you can watch the registers update as ...
1
vote
1answer
57 views

Function names syntax returned by radare2's afl?

Radare2's afl command returns function names with a specific syntax that I could not find documentation on: For example: radare2 -2 -A -q -c "aflj" C:/Windows/system32/advapi32.dll 0x77cce13c 22 ...
0
votes
1answer
56 views

Print string at address with radare2

I have created a very basic golang program which display a message with fmt.Println(). Here is what is see in radare2: lea rcx, obj.main.statictmp_0 ; 0x4c84b0 ; "y[K" mov qword [local_48h], rcx lea ...
0
votes
2answers
44 views

How does this command modify the condition?

I'm new to radare2 here. Just started learning and I was trying out a challenge. What does the 3 columns in the radare2 visual mode represent? May I know how the command below: wa je 0x400976 @...
1
vote
1answer
47 views

Radare2 doesn't update current address, when single-step debugging using `ds`?

Radare2 doesn't update current address, when single-step debugging using ds? I'm debugging an ELF binary on Linux using single-step (ds). The problem is that the current address at the prompt doesn't ...
0
votes
1answer
57 views

rip adress not visible with dr command

I just finished this challenge. This is the content of main function : [0x08048a86]> pdf / (fcn) main 417 | main (int argc, char **argv, char **envp); | ; var int local_16h @ ebp-0x16 |...
2
votes
1answer
49 views

Why does -A (aaa) analysis show much more information, when using the -d (debug) CLI option in Radare2?

Why does -A (aaa) analysis show much more information, when using the -d (debug) CLI option in Radare2? I'm using the newest version of Radare2 to analyze the Windows application. As can be seen ...
0
votes
2answers
116 views

Debugging a process running in a Virtual Machine with Radare2?

Is there anyway to debug a process running on a Virtual Machine (guest) with Radare2 from the host? I'm currently using VirtualBox. It provides a built in debugger. I'm not sure if it's possible for ...
2
votes
1answer
55 views

Debug point not hit with radare2

I am doing this reverse engenering challenge. I executed theses commands to analyse the main function : radare2.exe ch15.exe aaa s main pdf This is the output of the pdf command : [0x004017b8]> ...
-3
votes
2answers
336 views

What means sym prefix before functions name in radare2

What means sym prefix in disassembly? For examle, sym.main?
0
votes
1answer
153 views

ELF binary corrupted after adding instruction in non-executable section

I've been messing around a little with Radare2 trying to master binary exploitation and patching. I added a couple of assembly instructions to an x86 elf binary in a non-executable section of the file,...
1
vote
1answer
135 views

Impossible to execute a program with radare2 : TO DO continue

I am trying to crack a crackme. I already catch the flag because I seen the string variable which represants flag. I would like to catch the flag on an other way, I want to set a breakpoint when there ...
7
votes
1answer
112 views

Radare2 Call $+5 and register-based cross-references not found

I have a library of ~65MB which uses this "technique" as a kind of PIC. First, it gets some kind of base address (it is always the same): 0x00708497 e800000000 call 0x70849c 0x0070849c ...
1
vote
1answer
107 views

Analyze all functions with radare2

I have a big library in which IDA found ~84300 functions but using aa in radare2 I was just able to found ~3000. I tried setting anal.hasnext to true, anal.from and anal.to to the start and the end ...
6
votes
1answer
267 views

Viewing Radare keybindings for Visual Pane mode (Function hotkeys)?

Is there a way to view the keybinidngs inside of Radare? Such that I can see which function keys do things like Step Over and Step Into in Debug mode? e~key doesn't list any of the debug keys, key.S ...
1
vote
1answer
709 views

Commands to step into and step over, outside of visual pane mode

The Radare book says Use F7 or s to step into and F8 or S to step over current instruction. But, I don't see it telling you how to do this with the d command. When I run d? I see ds[?] ...
2
votes
1answer
67 views

How to make Radare2 automatically disassemble next instruction after each `ds` debug single-step?

How to make Radare2 automatically disassemble next instruction after each ds debug single-step? I thought that e asm.bytes=1 would achieve this, but that doesn't help. In particular, GDB supports ...
1
vote
2answers
49 views

Getting a high level overview of comparative size differences of binary files?

I have two binary files, one of them is pulled from Protostar's (stack0 example). The other one I compiled (from source) with the latest version of GCC. The size difference is massive. My version is ...
1
vote
1answer
46 views

How to get the memory-mapping (e.g. library) that contains a given address in Radare?

How to get the memory-mapping (e.g. library) that contains a given address in Radare? I've done a search in Radare for a specific string (search.in = dbg.maps), which resulted in an address. Now, I ...
6
votes
1answer
2k views

radare2 ascii graph to image?

After analysing a function and pressing VV to go into graph mode, is it somehow possible to export/render the whole graph to an image? I have some huge main functions and it would be nice to have it ...
0
votes
1answer
48 views

How to identify different memory regions of an elf binary in radare2?

I'm just starting out with reverse engineering, one thing I'm finding difficult is identifying different areas of memory. I'm using radare2, and I would like to be able to easily seek and identify ...
5
votes
2answers
783 views

Writing ELF headers in Radare?

Reading Keith Makan's, "Introduction to the ELF Format : The ELF Header", he modifies e_entry, The e_entry field lists the offset in the file where the program should start executing.Normally it ...
1
vote
1answer
49 views

Make r2 -i <script> use python3 rather than python2

I have a r2 script that I'm running with r2 -i script.py test.x. By default this command uses python2. How can I get it to use python3? I couldn't find anything in the config.
2
votes
2answers
183 views

Writing a file with radare2 `w`?

Radare2 supports a w which writes a string. w foobar write string 'foobar' However, it doesn't seem to work for me, touch foo radare2 ./foo w foobar The file foo remains empty. Am I ...
1
vote
1answer
53 views

Learning fine grained analysis in Radare with `a`?

The Radare community generally seems to look down upon simply running AAA or AAAA claiming that you need to instead learn the fine grained analysis and what they do. However, there seems to be no ...
1
vote
1answer
114 views

Radare's `aaaa` and -AA what does it do, exactly?

When I run aaa, Radare tells me, [x] Use -AA or aaaa to perform additional experimental analysis. But what does aaaa do? It's not documented under aa? nor aaa? nor [0x000028e0]> aaa? Usage: See ...
2
votes
0answers
131 views

How to save Radare2 Analysis?

How do I save a radare2 session after I did "aa"? I know there is a command for saving a project, but this isn't working out for some reason (Ps PROJECTNAME). So I am looking for a way to save my ...
1
vote
0answers
68 views

Techniques for reversing (basic) hash function

Hi I'm relatively new to RE, and I'm using GDB and Radare2. As part of a crackme I'm trying to reverse a weak hash function that's a little too complicated for me to undo by hand. I've been trying to ...
9
votes
2answers
6k views

How do you can you disassemble and dump an entire binary?

It's easy to seek to a particular function and dump it's contents as Assembly language. However, I cannot find an obvious way to immediately disassemble and dump an entire binary. I want to use it ...
12
votes
1answer
2k views

Debugging with radare2 using two terminals

I have been trying to figure this out for quite some time now, and would really need some help. Firstly, some intro: I am running the newest version of radare2 from Github on a 64bit Ubuntu 16.04 and ...
0
votes
1answer
26 views

Does the Radare Debugger support STABS?

From the wiki on Stabs stabs (sometimes written STABS) is a debugging data format for storing information about computer programs for use by symbolic and source-level debuggers. Does Radare ...
1
vote
1answer
37 views

How do I read the “ascii-art bar of metadata in file boundaries”?

Radare2 has an option, p-, Usage: p-[hj] [nblocks] bar|json|histogram blocks | p- show ascii-art bar of metadata in file boundaries | p-h show histogram analysis of metadata per block | p-j ...
0
votes
0answers
48 views

Does Radare offer the ability to invoke the linker and disassemble a function (import or reloc)?

Sometimes I'm doing static analysis outside of the debugger, and I want to see what a function that a symbol points to will do after the linker does runtime relocation. All I see in the disassembly is ...
0
votes
1answer
70 views

Is there a way to get an instruction count with Radare2?

Let's say I want to find out how many instructions an arbitrary function foo decodes to, is there an easy way to do this? I'm trying to check against a version I am compiling with a stored binary on ...
3
votes
1answer
427 views

How to find a memory address of variable?

This question seems so basic but I have spent 5+ hours trying to figure it out. I have written a program in C++ that defines a few variables and does some other stuff. What I want to do in Radare2 is ...
1
vote
2answers
102 views

Can I search Radare's help system?

Radare2 seems to have thousands of commands. Is there a way to search all of those commands? Like let's say I want to find all commands that had rot (for rot13), is there a method to do this?
3
votes
0answers
46 views

radare2 difference between function offset and minbound

I am trying to understand the difference between a function's offset and its minbound in radare2. Consider this function in radare2 (output of aflj): { "offset": 4549740, "name": "...
4
votes
1answer
614 views

Changing code to data in radare2

I really like radare2 and I am trying to follow a tutorial in which some code is changed to data. The tutorial uses IDA, I have tryed this with radare2. I entered visual mode by pressing V and cursor ...
1
vote
0answers
31 views

Radare2: pd command ignores cfg.bigendian setting

I am currently using radare2 to disassemble a raw ARM binary (bootloader) in little endian format. I used the command e cfg.bigendian = false to set the endianness, but the pd command seems to ignore ...
2
votes
2answers
438 views

How do I find all references to an address with a memory segment?

If I want to find all references to fs:[0x28] how would I go about doing it with radare2? For example, 0x000006b5 64488b042528. mov rax, qword fs:[0x28] ; [0x28:8]=0x1978 ; '(' ; "x\x19" I ...