Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [radare2]

Opensource reverse engineering framework to disassemble, debug, analyze, manipulate binary files and more.

2
votes
1answer
21 views

How to write sequence of machine code in radare2?

I know how to write an opcode and how to increment and decrement machine code using plus and minus keys. However, how do I write a sequence of machine code at an offset? E.g. if I want to write five ...
0
votes
2answers
67 views

crackme disassembly - are these local variables ever initialized?

I'm working on a crackme, where the objective is to find the valid password given a program. I'm using radare2 to reverse engineering the program. To do so, I need to enter a password that forces this ...
3
votes
2answers
388 views

Writing a file with radare2 `w`?

Radare2 supports a w which writes a string. w foobar write string 'foobar' However, it doesn't seem to work for me, $ touch foo $ radare2 ./foo w foobar The file foo remains empty. Am ...
7
votes
1answer
132 views

Radare2 Call $+5 and register-based cross-references not found

I have a library of ~65MB which uses this "technique" as a kind of PIC. First, it gets some kind of base address (it is always the same): 0x00708497 e800000000 call 0x70849c 0x0070849c ...
1
vote
0answers
95 views

Illegal instruction fault in stack based buffer overflow

I wrote this short C program to practice buffer overflow exploits: #include <stdio.h> #include <string.h> #include <stddef.h> #include <inttypes.h> char *decode(char *s){ ...
2
votes
1answer
26 views

When reopening file lose all information in radare2

I have problem with my radare2, when I try to reopen file in debug mode (ood) my radare loses all informations about that file. any help to avoid this?
1
vote
1answer
79 views

How to use aaa in radare2 while in -d (debug) mode?

This might be a stupid question, but I am trying to learn by myself and I encountered a problem which I cannot solve for the life of me. I tried googling and I can't find anything relevant, so here ...
1
vote
2answers
221 views

Radare2 - How to scale panel height in visual panels mode?

Visual Panels Mode (V!): I need more space (height) for RegisterRefs and less for Registers (its 50% blank anyway). How can i do that? I can move the vertical split with H and L but i couldn't find ...
4
votes
1answer
41 views

How do I type in hex input into radare2 debug mode?

#include<stdio.h> #include<stdlib.h> int main() { puts("Enter input: "); char buf[100]; fgets(buf, 100, stdin); printf("%s", buf); } Suppose I am debugging a program, such ...
1
vote
1answer
29 views

Passing hex strings to Radare2

I can quickly test hex string arguments in gdb like this: r $'\x61\x61\x61\x61' I'd like to do something similar in radare2 but all I can figure out is regular strings: doo aaaa I tried this but ...
3
votes
1answer
40 views

How to examine/edit stack memory contents using radare2 in debug mode?

How can i examine/edit stack contents using radare2, just like gdb ? Is there a way to examine memory using $rbp or $rsp register like below. x $rbp-10 <--- something like this which can dump from ...
0
votes
0answers
41 views

How to debug programs that load from another one? with radare2/gdb

I'm reversing engendering a plugin. This plugin is loaded into memory by the main program. I disassemble the plugin with radare2 but I don't know how to debug it. I try with gdb but same problem. I ...
1
vote
1answer
33 views

Is there watchpoints in radare2?

Is there any way to put breakpoints in radare2 that trigger when an address is read/write? In GDB those are call watchpoints ('rwatch' or 'awatch") I got this from radare2 [0xB7F08810]> !dr? ...
2
votes
1answer
117 views

Cannot open '/proc/…/maps': No such file or directory in radare2 debug mode

When I try to load a program to radare2 debug mode, most of the time I get the following error: $sudo r2 -d a.out Hello world!= attach 2851 2851 Cannot open '/proc/2851/maps': No such file or ...
0
votes
1answer
121 views

Reassembling reversed ASM

I am trying to reassemble code reversed from an executable using radare2. I have managed to extract the asm and am using nasm for reassembling. The question is, the code also contains commands like ...
3
votes
3answers
186 views

Debugging a process running in a Virtual Machine with Radare2?

Is there anyway to debug a process running on a Virtual Machine (guest) with Radare2 from the host? I'm currently using VirtualBox. It provides a built in debugger. I'm not sure if it's possible for ...
5
votes
1answer
15k views

How to debug (like gdb) with radare2?

I am new to radare2 and Linux. I got problem with r2. As the title states it, many tutorials, articles, videos about r2 are just about disassembling programs, and read assembly codes. But, I want ...
1
vote
1answer
29 views

What this “arw” line means when processing Mach-0 file with Radare2 or Rabin2?

Processing a Mach-0 file with Rabin2 I'm obtaining the following result: $ rabin2 -I mybinaryfile arw ...
2
votes
0answers
45 views

Radare2 cannot place a breakpoint on a MIPS code

I am doing a crack-me challenge, I would like to execute it to see v0 and v1 values. This is the file command's output : ./ch27.bin: ELF 32-bit LSB executable, MIPS, MIPS32 rel2 version 1 (SYSV), ...
1
vote
1answer
60 views

debugging with radare2

I am using radare2 for disassemble an x86 binary: $ r2 ./mynbinary [0x00001000]> aaa ... [0x00001000]> pdf ;-- section..text: ;-- section.LOAD1: ;-- rip: / (...
1
vote
1answer
92 views

Setting register names in Radare2

I am reverse-engineering an 8051 architecture program of a specific chip. The disassembly naturally doesn't contain any function names, and the register names are minimal. For example, address 0xb3 is ...
2
votes
1answer
106 views

How to print eax value with Radare2?

I am solving a crack me challenge but I am stuck. The challenge executes several jne tests. The first test is the simpliest but I don't arrive to print the eax value to know the content of cmp ...
1
vote
2answers
65 views

What does layout of Cutter/Radare2's function dissasembly mean?

Cutter displays functions like this: I'm having trouble understanding the layout of the functions For example: What does 184 mean? What does the green | mean at the beginning of each line? Why ...
0
votes
1answer
69 views

how to use core file in radare2?

In gdb i can backtrace with core file and executable file. It seems radare2 can read core file. like this $ r2 core Setting up coredump: asm.arch <-> x86 and asm.bits <-> 64 Setting up ...
1
vote
1answer
73 views

How to set a breakpoint in an execve'd program in radare2?

If I have a program A, which uses execve to run program B. How can I set a breakpoint in program B's main routine if I'm debugging program A? After a certain point in the execve routine, program B ...
1
vote
0answers
96 views

Password is right, but still wrong?

i am trying to find the password of a binary with radare2 - a crackme again :-) I already thought I've found the password ('pass'), but this seems to be not the right one. Or there is a trick I didn'...
2
votes
1answer
86 views

Radare2 does not display the entire assembler code

I am trying to solve this ELF - Ptrace crack me. Here are the commands I use : I start radare2 with the crack me as argument. radare2 ch3.bin I decide to go to the main and print the assembly code ...
0
votes
1answer
290 views

How to print the value of register with Radare 2

I am trying to solve this ELF - Ptrace challenge. I use Radare 2. This is the commands I execute to print the assembly code. radare2 ch3.bin [0x080482f0]> aaa [[anal.jmptbl] Missing cjmp bb in ...
7
votes
2answers
1k views

what is radare2's equivalent to GDB's 'find &system,+9999999,“/bin/sh”'

What is radare2's equivalent to GDB's find &system,+9999999,"/bin/sh"?
2
votes
1answer
52 views

radare2 how to interpret ascii-art color bars?

I can't understand the meaning of ascii-art color bars. what is the meaning of the # charaters? [0x08000210]> iS= 00 0x08000000 |---------------------------------| 0x08000000 0 --- 01 ...
0
votes
1answer
279 views

Radare2 create section

Radare2 has S* commands, that can show, delete, modify sections. Is it possible to create new section in executable file and save it?
1
vote
1answer
110 views

Radare2 Disassembler How Do You Organize Visual Panels (V!)?

I would like to use Radare2 to learn about how C is assembled into assembly but I am having trouble with the layout. I think the V! mode would be very handy as you can watch the registers update as ...
1
vote
1answer
79 views

Function names syntax returned by radare2's afl?

Radare2's afl command returns function names with a specific syntax that I could not find documentation on: For example: radare2 -2 -A -q -c "aflj" C:/Windows/system32/advapi32.dll 0x77cce13c 22 ...
0
votes
1answer
108 views

Print string at address with radare2

I have created a very basic golang program which display a message with fmt.Println(). Here is what is see in radare2: lea rcx, obj.main.statictmp_0 ; 0x4c84b0 ; "y[K" mov qword [local_48h], rcx lea ...
0
votes
2answers
57 views

How does this command modify the condition?

I'm new to radare2 here. Just started learning and I was trying out a challenge. What does the 3 columns in the radare2 visual mode represent? May I know how the command below: wa je 0x400976 @...
1
vote
1answer
60 views

Radare2 doesn't update current address, when single-step debugging using `ds`?

Radare2 doesn't update current address, when single-step debugging using ds? I'm debugging an ELF binary on Linux using single-step (ds). The problem is that the current address at the prompt doesn't ...
0
votes
1answer
67 views

rip adress not visible with dr command

I just finished this challenge. This is the content of main function : [0x08048a86]> pdf / (fcn) main 417 | main (int argc, char **argv, char **envp); | ; var int local_16h @ ebp-0x16 |...
2
votes
1answer
65 views

Why does -A (aaa) analysis show much more information, when using the -d (debug) CLI option in Radare2?

Why does -A (aaa) analysis show much more information, when using the -d (debug) CLI option in Radare2? I'm using the newest version of Radare2 to analyze the Windows application. As can be seen ...
2
votes
1answer
65 views

Debug point not hit with radare2

I am doing this reverse engenering challenge. I executed theses commands to analyse the main function : radare2.exe ch15.exe aaa s main pdf This is the output of the pdf command : [0x004017b8]> ...
-3
votes
2answers
397 views

What means sym prefix before functions name in radare2

What means sym prefix in disassembly? For examle, sym.main?
0
votes
1answer
163 views

ELF binary corrupted after adding instruction in non-executable section

I've been messing around a little with Radare2 trying to master binary exploitation and patching. I added a couple of assembly instructions to an x86 elf binary in a non-executable section of the file,...
1
vote
1answer
305 views

Impossible to execute a program with radare2 : TO DO continue

I am trying to crack a crackme. I already catch the flag because I seen the string variable which represants flag. I would like to catch the flag on an other way, I want to set a breakpoint when there ...
1
vote
1answer
161 views

Analyze all functions with radare2

I have a big library in which IDA found ~84300 functions but using aa in radare2 I was just able to found ~3000. I tried setting anal.hasnext to true, anal.from and anal.to to the start and the end ...
6
votes
1answer
349 views

Viewing Radare keybindings for Visual Pane mode (Function hotkeys)?

Is there a way to view the keybinidngs inside of Radare? Such that I can see which function keys do things like Step Over and Step Into in Debug mode? e~key doesn't list any of the debug keys, key.S ...
2
votes
1answer
1k views

Commands to step into and step over, outside of visual pane mode

The Radare book says Use F7 or s to step into and F8 or S to step over current instruction. But, I don't see it telling you how to do this with the d command. When I run d? I see ds[?] ...
2
votes
1answer
110 views

How to make Radare2 automatically disassemble next instruction after each `ds` debug single-step?

How to make Radare2 automatically disassemble next instruction after each ds debug single-step? I thought that e asm.bytes=1 would achieve this, but that doesn't help. In particular, GDB supports ...
1
vote
2answers
56 views

Getting a high level overview of comparative size differences of binary files?

I have two binary files, one of them is pulled from Protostar's (stack0 example). The other one I compiled (from source) with the latest version of GCC. The size difference is massive. My version is ...
3
votes
1answer
73 views

How to get the memory-mapping (e.g. library) that contains a given address in Radare?

How to get the memory-mapping (e.g. library) that contains a given address in Radare? I've done a search in Radare for a specific string (search.in = dbg.maps), which resulted in an address. Now, I ...
6
votes
1answer
2k views

radare2 ascii graph to image?

After analysing a function and pressing VV to go into graph mode, is it somehow possible to export/render the whole graph to an image? I have some huge main functions and it would be nice to have it ...
0
votes
1answer
76 views

How to identify different memory regions of an elf binary in radare2?

I'm just starting out with reverse engineering, one thing I'm finding difficult is identifying different areas of memory. I'm using radare2, and I would like to be able to easily seek and identify ...