Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange
This site is currently in read-only mode; we'll return with full functionality soon. Follow @StackStatus or visit our status blog for more info.

Questions tagged [radare2]

Opensource reverse engineering framework to disassemble, debug, analyze, manipulate binary files and more.

1
vote
0answers
45 views

Radare2: pd command ignores cfg.bigendian setting

I am currently using radare2 to disassemble a raw ARM binary (bootloader) in little endian format. I used the command e cfg.bigendian = false to set the endianness, but the pd command seems to ignore ...
2
votes
0answers
62 views

Understanding ESIL

I cross-compiled a simple program with the aarch-linux-gnu-gcc compiler for ARM. So the machine is "ARM aarch64". I want to understand a single instruction and it's realization in ESIL. The opcode of ...
1
vote
2answers
115 views

Can I search Radare's help system?

Radare2 seems to have thousands of commands. Is there a way to search all of those commands? Like let's say I want to find all commands that had rot (for rot13), is there a method to do this?
1
vote
1answer
124 views

What does paddr, baddr, laddr, haddr, and hvaddr refer to?

When I run ie, I get multiple addresses. [0x41417641]> ie [Entrypoints] vaddr=0x080483d0 paddr=0x000003d0 baddr=0x08048000 laddr=0x00000000 haddr=0x00000018 hvaddr=0x08048018 type=program What ...
0
votes
2answers
45 views

`dmi libc puts~GLOBAL` does not show puts, just putspent?

On the tutorial by Megabeets, "A journey into Radare 2 – Part 2: Exploitation" [0x080483d0]> dmi libc puts~&GLOBAL, puts:0 532 0x000fdd60 0xf7e0bd60 GLOBAL FUNC 1181 putspent [0x080483d0]&...
2
votes
1answer
63 views

What does the `$r` do in `pd $r`?

I was just looking at the Megabeets tutorial again, and it he has, pd $r @ main I don't see the the $r explained anywhere though. What does $r do in that? It's also not explained in pd?
0
votes
1answer
47 views

Does RAX2 support setting bit width?

Is there anyway to set the width of the twos compliment used in binary display =2? 2 10b -2 1111111111111111111111111111111111111111111111111111111111111110b I would like to see a 3bit signed twos ...
4
votes
1answer
91 views

How do I view the registers as signed intergers?

Is there any way to view the results of something like dr= in signed interger form? > dr rax = 298; dr rdx = 42; dr= rax 0x0000012a rbx 0x00000000 rcx 0x00000000 rdx ...
7
votes
1answer
132 views

Radare2 Call $+5 and register-based cross-references not found

I have a library of ~65MB which uses this "technique" as a kind of PIC. First, it gets some kind of base address (it is always the same): 0x00708497 e800000000 call 0x70849c 0x0070849c ...
5
votes
2answers
227 views

Understanding branch delay slots for reversing MIPS

I am statically reversing some software compiled for an Atheros AR7161 using radare2. This processor implements MIPS, and I do recall that MIPS has a branch delay slot. This is indeed noticeable in ...
2
votes
1answer
199 views

Radare2 webui - need help setting it up

How can you set up Radare2 webui in Kali or Ubuntu or any other OS? I've tried so many different methods but none of them have worked so far. I think both of them are debian based so that might be ...
1
vote
2answers
102 views

What is a “trit”?

With Radare when I do ?, I get a list of answers in the result, [0x00400a04]> ? -0x120 + 0x110 hex 0xfffffffffffffff0 octal 01777777777777777777760 unit 17179869184.0G segment fffff000:...
3
votes
1answer
115 views

How can you get the symbol visibility with radare?

I created a quick x86_64 Assembly file with NASM to generate the four different visibility classes for ELF 64. With readelf --symbols I get the Symbol Visibility in the Vis column: DEFAULT, INTERNAL, ...
1
vote
1answer
194 views

Working with 16bit offsets and segments in Radare2

I have a simple DOS COM program which I want to analyse using Radare2: USE16 ORG 100h mov ax, cs dec ax mov ds, ax mov dx, message+10h mov ah, 9 int 21h ret message: db "Hello ...
1
vote
1answer
52 views

Addresses displayed in radare2

I am disassembling a binary with radare2 and I see some lines like this: | 0x004007f1 488b05981820. mov rax, qword [0x00602090] ; 0x602090:8]=0x400c60 I do not understand, what are the addresses ...
0
votes
1answer
118 views

Symbolic simplifications in radare2

Let's have a look to this assembly code in radare2: xxxxxxx mov rax,rbx xxxxxxx add rax,rax xxxxxxx add rax,rbx xxxxxxx shl rax,2 yyyyyyy nop Is there a way to ask radare2 to evaluate rax value ...
1
vote
1answer
286 views

Disassemble all functions with radare2

The pdf command is able to disassemble a function in radare2. Is there a way to disassemble all functions of a binary in a single radare2 command ?
1
vote
2answers
384 views

Get function from memory address with radare2

Lets suppose I have a memory address. This address points to an instruction. This instruction is inside a function. Is there a way to ask radare2 to search the beginning of this function, given the ...
1
vote
1answer
193 views

What does “Missing cjmp bb in predecessor” mean?

In new builds of Radare, I'm getting Missing cjmp bb in predecessor at 0x1006aa416 What does this mean? I filed a bug on this here. But, it was answered with Thanks for reporting but this is a ...
4
votes
1answer
201 views

Heap Chunk Structure Does Not Contain Previous Section Info

I'm reading Shellcoder's Handbook to learn more about exploitation and overflows. I reached the chapter on Heap Overflows. The book mentions that a heap is split into chunks where each chunk contains ...
2
votes
2answers
54 views

Headers for `iz` and such in key=value format?

In the MegaBeets tutorial, "A journey into Radare 2 – Part 1: Simple crackme" the authors iz has, vaddr=0x08048700 paddr=0x00000700 ordinal=000 sz=21 len=20 section=.rodata type=ascii string=\n .:: ...
1
vote
1answer
82 views

radare2 labels are not displayed in jmp instructions

Let's take an example of a 64 bits elf executable disassembled with pdf command in radare2: ... 0x00400ac0 0f859c000000 jne 0x400b62 ... 0x00400b62 90 nop ... I want to put a ...
3
votes
1answer
552 views

How to find a memory address of variable?

This question seems so basic but I have spent 5+ hours trying to figure it out. I have written a program in C++ that defines a few variables and does some other stuff. What I want to do in Radare2 is ...
2
votes
1answer
118 views

Cannot open '/proc/…/maps': No such file or directory in radare2 debug mode

When I try to load a program to radare2 debug mode, most of the time I get the following error: $sudo r2 -d a.out Hello world!= attach 2851 2851 Cannot open '/proc/2851/maps': No such file or ...
1
vote
0answers
57 views

Can Radare2 emulate null pointer exceptions and others?

I'm wondering if anyone has had any luck with Radare2's configuration variables, esil.exectrap, esil.iotrap, and esil.nonull while emulating? xor eax, eax mov eax, dword [eax] <- From what I can ...
3
votes
1answer
385 views

grep -E with Radare2

With Radare2, I love the iI command. I want to limit the output with grep or radare's own grep syntax. How do I run a iI | grep -E 'bits | pic | stripped' against my binary? [0x100001200]> iI ...
1
vote
2answers
221 views

Radare2 - How to scale panel height in visual panels mode?

Visual Panels Mode (V!): I need more space (height) for RegisterRefs and less for Registers (its 50% blank anyway). How can i do that? I can move the vertical split with H and L but i couldn't find ...
4
votes
0answers
156 views

Radare2 - How to save/restore metadata in debug session (BPs, flag, comments..)?

How can i save/reuse/preserve Radare2 metadata (BPs, comments, flags..) of a debug session for a new debug session? I restart the debugger alot and preserving environment would be very helpful. I ...
3
votes
1answer
582 views

Radare2 debugging - How to get into lazy imported functions?

I have a linux binary that imports functions from an external library (shared object). The functions are lazy loaded and not available when rip is at @main or @entry. When i step into such a function (...
1
vote
0answers
258 views

radare2 not showing function names

I'm using radare2 and I've noticed that it simply prints function offsets rather than function names. I've done some tests and I've discovered that on Kali it prints offsets and on debian it prints ...
0
votes
1answer
163 views

ELF binary corrupted after adding instruction in non-executable section

I've been messing around a little with Radare2 trying to master binary exploitation and patching. I added a couple of assembly instructions to an x86 elf binary in a non-executable section of the file,...
2
votes
2answers
645 views

How do I find all references to an address with a memory segment?

If I want to find all references to fs:[0x28] how would I go about doing it with radare2? For example, 0x000006b5 64488b042528. mov rax, qword fs:[0x28] ; [0x28:8]=0x1978 ; '(' ; "x\x19" I ...
1
vote
1answer
384 views

Radare2 - Insert asm instructions without overwriting

In order to patch a x86 elf file on Linux, I'm struggling to insert a specific assembler instruction into the binary file without overwriting any of the preexisting instructions. I've been reading ...
5
votes
1answer
489 views

Import symbols containing strange characters

I am analyzing a macOS app with radare2, and the app depends on a number of Qt frameworks. When I printed out the import symbols of the app's main executable, the names of the frameworks' functions ...
0
votes
0answers
45 views

Radare -Q leaking, and does it even matter?

As a follow up to a self-answered question where I discovered -q and -Q Radare -Q is documented as, -Q quiet mode (no prompt) and quit faster (quickLeak=true) man radare2 shows, -Q Same as -q, ...
1
vote
1answer
91 views

Radare -c but exit afterward

I'm using Radare to print out some information on blobs, essentially I'm running radare2 -c "pf ... " ./myblob.bin I would like radare to edit after it runs that -c.
3
votes
1answer
167 views

How do you print fixed width strings with radare's print format `pf`?

Let's say I have a byte sequence where U is an unsigned int (4 bytes), and ccccccccccccccc is a 15 byte character array UcccccccccccccccU Is it possible to print this structure using pf? I can print ...
6
votes
1answer
631 views

What is the info displayed by radare2's afl?

I can't figure out what afl actually outputs. The docs are surprisingly uninformative. So, I've got address on the first column and symbol on the last. What is on the 2nd, 3rd and 4th columns? ...
5
votes
1answer
165 views

How do I find out what section variables and strings are defined in?

Given a simple program like this, void main (int argc, char * argv[] ) { char * arr[] = {"foo", "bar", "baz"}; *(arr[0]) = 'F'; printf( "%s", arr[0] ); } How do I find out what section ...
10
votes
1answer
452 views

How to write [sp+local_variable] in radare2

Hello I'm playing with my native android library, everything was going smoothly till now. I have problem with opcodes, i don't know how to tell radare2 to write str opcode with specifc registry, and ...
6
votes
1answer
353 views

Viewing Radare keybindings for Visual Pane mode (Function hotkeys)?

Is there a way to view the keybinidngs inside of Radare? Such that I can see which function keys do things like Step Over and Step Into in Debug mode? e~key doesn't list any of the debug keys, key.S ...
4
votes
1answer
273 views

Is there a way to explicitly connect r2pipe to an existing radare2 session that I have open?

I understand that I can execute my script within a session using [0x401000]> . server.py and the pipe will be connected to it when I call r2pipe.open() with no arguments. Ideally I would like to ...
1
vote
1answer
331 views

r2pipe won't prompt for user input like the binary does in r2 debugger mode

Have a functioning r2pipe script, but there's a need for hitting crtl-c to continue near the breakpoint(not a major issue,) however the script does not pause for input when the crackme asks for user ...
5
votes
1answer
384 views

Why do many imported functions jump to addresses that do not contain instructions?

I am learning to analyze binaries using radare2 and have been confused about what occurs within imported functions. In the binary below, titled Lab2B, I statically disassembled the binary and then ...
0
votes
1answer
492 views

Reverse mips binary with radare2

when I try to reverse my mips binary in radare2, I take some instruction invalid. sudo r2 -a mips -b 32 -d 2700 start my binary: sudo chroot . ./qemu-mips-static bin/resident Sorry for this ...
0
votes
1answer
465 views

Radare2 cannot debug on windows 7

I downloaded radare 2.5 for windows. I am trying to debug a binary on windows with radare and have tried the following: radare2 -d a.exe fork_and_ptraceme/CreateProcess: The request is not supported. ...
7
votes
2answers
766 views

Radare2 Find command line arguments and location in stack

This might have a simple solution but I can't find it anywhere. $> ./be1 11 AAAAA With gdb, finding argv[] and argc is simple: (gdb) print argv[0]@argc $7 = {0xbffff872 "be1", 0xbffff89a "11", ...
2
votes
2answers
998 views

What does XREF mean?

I have been learning about the x86 assembly language by analyzing a binary using radare2 that is stored on a Intel 80386 machine. When I have been analyzing functions on the binary, I noticed that "...
1
vote
1answer
639 views

How to list breakpoints in radare2?

in gdb to list active breakpoints is info b how to do the same in radare2? is there any similar command in radare2 or something else?
4
votes
1answer
389 views

Radare2- How to see stdout in Visual Mode

I'm new to radare2 and reverse engineering, and I can't see to see to figure out how to display any standard write in display mode. For example if I run 'dc' command it runs the program normally and ...