Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [radare2]

Opensource reverse engineering framework to disassemble, debug, analyze, manipulate binary files and more.

-1
votes
1answer
201 views

RFLAGS info and Radare?

Stepping through instructions I can see the result of rflags change, rflags C1PSI rflags 1PZI Is there anything that expands this into the appropriate flags. I know Z is Zero-flag, and P is Parity, ...
4
votes
1answer
120 views

rasm2 giving different output each time for x64

Disassembling is great but when trying to re-assemble to opcode it gives different results each time. Example: C:\>rasm2 -a x86 -b 64 -d "48898D80FEFFFF" mov qword [rbp - 0x180], rcx C:\>...
1
vote
2answers
211 views

Printing bytecode in bytes given a string of assembly?

Megabeets determined in this answer that depending on asm.bits Radare may show either lea edx, [0x80490c8] (asm.bits=32) lea edx, [rip + 0x80490c8] (asm.bits=64) If I want to see what the ...
5
votes
2answers
2k views

Disassembly shows `LEA` with RIP?

When I disassemble this instruction using pad on Radare I get an LEA with rip [0x00000000]> pad 8d 15 c8 90 04 08 lea edx, [rip + 0x80490c8] I got this instruction from this post here I'm ...
2
votes
2answers
262 views

Can I provide bytes to Radare to be disassembled?

Let's say I want to check this guys work. He says that he is getting 8d 15 c8 90 04 08 lea 0x80490c8,%edx ba c8 90 04 08 mov $0x80490c8,%edx Is there an easy way with Radare to ...
3
votes
1answer
747 views

How does r2dec compare to pdc?

Radare has a command pdc pdc pseudo disassembler output in C-like syntax I'm curious to know how the plugin r2dec-js compares to pdc it seems like they do the same thing.
1
vote
1answer
521 views

How can I call a function in radare2 debug session?

In gdb I can easily do the following: (gdb) call function(arg) what is the equivalent in r2? There is no call function in debug session so this doesn't work: [0x08048795] call sym.func Inject ...
1
vote
1answer
111 views

radare2- Unable to use wopO command

I am new to radare2. I am trying out radare2 with exercise from Protostar stack0 I generate raw De Bruijn Patterns with below command $ ragg2 -P 500 -r ...
0
votes
1answer
279 views

Radare2 create section

Radare2 has S* commands, that can show, delete, modify sections. Is it possible to create new section in executable file and save it?
1
vote
3answers
614 views

Radare produces a bunch of `add byte [rax], al`, but why?

What does a bunch of add byte [rax], al mean? I see a lot of memory addressing point to specific parts of the shared library (.dll) that have for instance, this... 0x10064faf8 0000 ...
2
votes
1answer
1k views

Commands to step into and step over, outside of visual pane mode

The Radare book says Use F7 or s to step into and F8 or S to step over current instruction. But, I don't see it telling you how to do this with the d command. When I run d? I see ds[?] ...
3
votes
2answers
209 views

Radare using `pd` without the call graph lines?

If I run pd I get something like this, [0x00400540]> pd @ main + 4 0x0040064a 4883ec20 sub rsp, 0x20 0x0040064e 897dec mov dword [rbp - 0x14], edi ...
2
votes
2answers
1k views

How do you use the Radare debugger with command line arguments (parameters)?

If I want to debug ls I can run, radare -d /bin/ls But, how do I provide an argument or parameter to ls? Like I would do if I wanted to run radare -d /bin/ls -1. I've tried it like that without ...
1
vote
1answer
264 views

How to change a string in a arm 32bit lsb executable binary using radare2?

I have a arm 32bit lsb executable which prints "hello world" to the screen. How do I change the string to "Good bye" using radare2. I believe this will teach me the basics of RE and radare2. Thank ...
0
votes
2answers
756 views

How can i start the RE process in radare2?(make changes to the registers) [closed]

I'm an absolute newbie to reverse engineering. I have a 32bit lsb arm binary which I would like to reverse engineer using radare2. How should I begin ?
3
votes
1answer
433 views

No apparent entry point for stripped, PIE binary using radare2

I am running on 64-bit Windows 7 and am using radare2 to attempt both static and dynamic analysis of a binary executable. The issue is that I cannot seem to find the entry point of where the program ...
1
vote
2answers
240 views

Is there a way to get the headers with the Radare output?

When I use a command like fs, I get output like 0 0 * strings 1 6 * symbols 2 14 * sections 3 0 * relocs It's clear to me on the left is an incrementing number that represents the ...
0
votes
1answer
342 views

Radare can't seek to _start symbol

When I run is to show the symbols, I see [Symbols] 004 0x000000f0 0x006000f0 LOCAL NOTYPE 0 text1 005 0x000000cb 0x004000cb LOCAL NOTYPE 0 _print 006 0x000000d1 0x004000d1 LOCAL NOTYPE 0 ...
-1
votes
2answers
413 views

extract opcodes using radare

When we have many binaries, there is a python base solution for disassemble and extract opcodes from binaries in IDA program. Is there any or similar solution to disassemble binaries for Radare2?
2
votes
1answer
353 views

PDB file vs SDB file?

Radare has a format called a sdb. I asked a question here, What is an SDB file? The answer I got was, These sdbfiles contain function names (DLL's exports) and their equivalent ordinals for each ...
4
votes
3answers
174 views

Running just one function from an compiled executable or shared object?

Radare lets me view the assembly and pseudo-C code of a function. Can I run those instructions though outside of the process? Perhaps setting the register myself? If so, how would I go about doing ...
1
vote
3answers
138 views

What is the difference between a GLOBAL symbol and NONE?

I'm playing with a pe32 file. With is, Some of my symbols say GLOBAL others say NONE, 006 0x00027514 0x100428114 GLOBAL FUNC 0 k.exe_asdf .... 002 0x0002a808 0x10042c008 NONE FUNC 0 imp....
-2
votes
1answer
487 views

What does it mean when radare2 says “invalid”?

Just wondering what it means when in the visual display it shows invalid? Is that just a way of saying there is nothing at that address? 0x0003ce0c ff invalid 0x0003ce0d ff ...
4
votes
1answer
333 views

What is an SDB file?

In the abstract, I'm just wondering what an SDB file does and what role it plays. I see Radare2 is using them.. Here are some of the SDB files I have under ./libr/bin/d/dll/, what do these do? ./libr/...
-1
votes
1answer
144 views

What is a “goodboy/badboy” [closed]

I'm confused and I'm trying to follow the Radare 2 Crackme Challanges. In it, they say, This seems to be a goodboy/badboy. Is a "goodboy/badboy" lingo for a specific thing, and if so what?
5
votes
1answer
348 views

Difference between 'readelf' and 'radare2' addresses

I have an MIPS binary file that I want to analyze. I am having a little trouble understanding the way elfread and r2 interpret the adressing scheme from a binary. For example, r2 finds a function ...
2
votes
1answer
273 views

Disassemble CC2541 firmware (TI SensorTag)

I'm digging into a BLE product based on a CC2541 MCU (similar to the Texas Instruments SensorTag). So for experimenting we can use an official firmware: http://processors.wiki.ti.com/images/1/10/...
2
votes
1answer
709 views

Reverse Engineering BIOS (AMI A0.57)

Recently I got really interested in BIOS RE and I used chipsec to dump the content of SPI Flash ROM of my HP Omen Desktop PC to start my journey. But unlike older BIOSes, the binary file was pretty ...
2
votes
1answer
1k views

Radare2 set local variable

Is it possible to change the value of a local var within Radare2? I'm practicing with ESIL feature and now I want to set the value of local variable userInput: [0x080484e6]> afvd var userInput = ...
4
votes
2answers
151 views

Avatao R3v3rs3 2

I found this platform and its course path into Reverse Engineering. Although very easy (at first) I'm kinda stuck in this binary n.2. Binary looks pretty easy and straightforward, but I can't figure ...
8
votes
1answer
907 views

Radare2: inspecting renamed variables

I'm practicing with Radare2, latest commit. radare2 2.3.0-git 16814 @ linux-x86-64 git.2.2.0-5-g61a903315 During my sessions, I need to rename local variables to a more understandable name, e.g. ...
2
votes
1answer
999 views

Using stdin when debugging with r2pipe

I was using radare2 (2.2.0) with r2pipe (0.9.5) for python3 to debug the code generated by: #include <stdio.h> int main(){ char entrada[14]; gets(entrada); puts(entrada); ...
2
votes
2answers
926 views

How To Print Addresses in Radare2

I'm switching over to Radare2 from GDB mixed with peda. One of the things I love about GDB, is the p command. For example, p system prints out the address of system. As well, peda's searchmem function ...
7
votes
1answer
4k views

How to get a nice stack view in radare2?

This is the stack view that I'm getting in radare2 after entering the visual panel mode: This is the view from immunity debugger: How can I get a view similar to immunity debugger in radare2?
4
votes
2answers
648 views

radare2 get API library and name from address

When I disassemble a jmp I get: [0x004073d4]> pd 1 0x004073d4 ff2584804000 jmp dword [sym.imp.kernel32.dll_GetModuleHandleA] ; 0x408084 ; "j\x85" Is there a command I can get ...
7
votes
2answers
1k views

what is radare2's equivalent to GDB's 'find &system,+9999999,“/bin/sh”'

What is radare2's equivalent to GDB's find &system,+9999999,"/bin/sh"?
4
votes
2answers
633 views

Disassembling at a memory address

I started to use radare2 to debug a PE file because it stops working as soon as I run it. When I attach my debugger and continue execution to the point where the exception is thrown I get a memory ...
9
votes
1answer
755 views

Split view radare2 print heap

I recently start to use radare2 and I have a question How can I print info about the heap with dmhb dmhf etc. while debugging ? I would like to have the heap informations on the right and the ...
2
votes
1answer
169 views

How to debug a hang application with radare2?

Could anyone tell me the basic steps and most used radare2 commands for debugging a hang x86 application to find the source of the hang? I know this question may sound a bit broad but I don't know ...
14
votes
1answer
2k views

Debugging with radare2 using two terminals

I have been trying to figure this out for quite some time now, and would really need some help. Firstly, some intro: I am running the newest version of radare2 from Github on a 64bit Ubuntu 16.04 and ...
4
votes
0answers
239 views

Radare2 project opening

When I open a project r2 -p mypoject I get a bunch of errors with some numbers: 0 0 Cannot add reference to non-function Cannot add reference to non-function 1482 I use latest version of radare2 ...
2
votes
0answers
75 views

radare2 specifying bitfield or enum width

I'm using radare2 to deconstruct a binary blob. When defining bit-field value there seems to be no syntax to specify the width of the field that contains the enum. For instance with a C structure as ...
1
vote
1answer
1k views

reversing stripped & statically linked binary with radare2

As the question says I need to reverse a stripped elf binary with radare2. This binary is also statically linked. I already reversed it in IDA by identifying statically linked libraries using lscan ...
3
votes
2answers
278 views

How to find paths from current offset to given address using radare2?

According to Radare2 documentation, this is the command to find paths: agt [addr] find paths from current offset to given address But when I try the command, after running aaaaa analysis, ...
1
vote
1answer
1k views

Disassembling MIPS 32 version 1 binary with the Radare2 Framework

I am trying to disassemble a MIPS 32 version 1 binary with the Radare2 framework. Here is the full output of the file command: ELF 32-bit LSB executable, MIPS, MIPS32 version 1 (SYSV), dynamically ...
6
votes
1answer
2k views

How to make radare2 work for a large binary?

I compiled cpython with debugging headers and I want to perform the following analysis using radare2. The problem I encounter is that it takes forever (at least 27 hours) to perform the aaa (...
5
votes
1answer
787 views

Radare2 doesn't display the whole function

I am using radare2, I have disassembled the function: sym.loop, it contains a switch witch has 4 cases that calls different functions. After any of the function call, the program exits the loop ...
2
votes
0answers
143 views

Radare2 - recursive traversal visual mode

I know that both pdf @ func and pdr @ func disassemble the function, the first using linear and the second recursive traversal disassembly. VV @ func shows the disassembled function in visual mode, ...
2
votes
1answer
2k views

How to print all functions of a binary using radare2 c/c++ API

I need to write a program (in c++), that among other things needs to know all functions of a given PE file. Basically, It's an equivalent of opening a binary with "r2 -A binary_name" and then entering ...
6
votes
1answer
4k views

How to find a symbol in a binary using radare2?

I want to find an address of a symbol (e.g strcpy) inside a binary using radare2. I tried to use the f command to list all flags which are recognized by r2 but the list is enormous and it's not ...