Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [radare2]

Opensource reverse engineering framework to disassemble, debug, analyze, manipulate binary files and more.

1
vote
1answer
176 views

How to change a string in a arm 32bit lsb executable binary using radare2?

I have a arm 32bit lsb executable which prints "hello world" to the screen. How do I change the string to "Good bye" using radare2. I believe this will teach me the basics of RE and radare2. Thank ...
0
votes
2answers
549 views

How can i start the RE process in radare2?(make changes to the registers) [closed]

I'm an absolute newbie to reverse engineering. I have a 32bit lsb arm binary which I would like to reverse engineer using radare2. How should I begin ?
3
votes
1answer
358 views

No apparent entry point for stripped, PIE binary using radare2

I am running on 64-bit Windows 7 and am using radare2 to attempt both static and dynamic analysis of a binary executable. The issue is that I cannot seem to find the entry point of where the program ...
1
vote
2answers
201 views

Is there a way to get the headers with the Radare output?

When I use a command like fs, I get output like 0 0 * strings 1 6 * symbols 2 14 * sections 3 0 * relocs It's clear to me on the left is an incrementing number that represents the ...
0
votes
1answer
276 views

Radare can't seek to _start symbol

When I run is to show the symbols, I see [Symbols] 004 0x000000f0 0x006000f0 LOCAL NOTYPE 0 text1 005 0x000000cb 0x004000cb LOCAL NOTYPE 0 _print 006 0x000000d1 0x004000d1 LOCAL NOTYPE 0 ...
-1
votes
2answers
338 views

extract opcodes using radare

When we have many binaries, there is a python base solution for disassemble and extract opcodes from binaries in IDA program. Is there any or similar solution to disassemble binaries for Radare2?
1
vote
1answer
303 views

PDB file vs SDB file?

Radare has a format called a sdb. I asked a question here, What is an SDB file? The answer I got was, These sdbfiles contain function names (DLL's exports) and their equivalent ordinals for each ...
3
votes
3answers
158 views

Running just one function from an compiled executable or shared object?

Radare lets me view the assembly and pseudo-C code of a function. Can I run those instructions though outside of the process? Perhaps setting the register myself? If so, how would I go about doing ...
1
vote
3answers
115 views

What is the difference between a GLOBAL symbol and NONE?

I'm playing with a pe32 file. With is, Some of my symbols say GLOBAL others say NONE, 006 0x00027514 0x100428114 GLOBAL FUNC 0 k.exe_asdf .... 002 0x0002a808 0x10042c008 NONE FUNC 0 imp....
-2
votes
1answer
411 views

What does it mean when radare2 says “invalid”?

Just wondering what it means when in the visual display it shows invalid? Is that just a way of saying there is nothing at that address? 0x0003ce0c ff invalid 0x0003ce0d ff ...
4
votes
1answer
281 views

What is an SDB file?

In the abstract, I'm just wondering what an SDB file does and what role it plays. I see Radare2 is using them.. Here are some of the SDB files I have under ./libr/bin/d/dll/, what do these do? ./libr/...
-1
votes
1answer
137 views

What is a “goodboy/badboy” [closed]

I'm confused and I'm trying to follow the Radare 2 Crackme Challanges. In it, they say, This seems to be a goodboy/badboy. Is a "goodboy/badboy" lingo for a specific thing, and if so what?
5
votes
1answer
283 views

Difference between 'readelf' and 'radare2' addresses

I have an MIPS binary file that I want to analyze. I am having a little trouble understanding the way elfread and r2 interpret the adressing scheme from a binary. For example, r2 finds a function ...
2
votes
1answer
251 views

Disassemble CC2541 firmware (TI SensorTag)

I'm digging into a BLE product based on a CC2541 MCU (similar to the Texas Instruments SensorTag). So for experimenting we can use an official firmware: http://processors.wiki.ti.com/images/1/10/...
2
votes
1answer
602 views

Reverse Engineering BIOS (AMI A0.57)

Recently I got really interested in BIOS RE and I used chipsec to dump the content of SPI Flash ROM of my HP Omen Desktop PC to start my journey. But unlike older BIOSes, the binary file was pretty ...
2
votes
1answer
960 views

Radare2 set local variable

Is it possible to change the value of a local var within Radare2? I'm practicing with ESIL feature and now I want to set the value of local variable userInput: [0x080484e6]> afvd var userInput = ...
4
votes
2answers
143 views

Avatao R3v3rs3 2

I found this platform and its course path into Reverse Engineering. Although very easy (at first) I'm kinda stuck in this binary n.2. Binary looks pretty easy and straightforward, but I can't figure ...
8
votes
1answer
755 views

Radare2: inspecting renamed variables

I'm practicing with Radare2, latest commit. radare2 2.3.0-git 16814 @ linux-x86-64 git.2.2.0-5-g61a903315 During my sessions, I need to rename local variables to a more understandable name, e.g. ...
2
votes
1answer
870 views

Using stdin when debugging with r2pipe

I was using radare2 (2.2.0) with r2pipe (0.9.5) for python3 to debug the code generated by: #include <stdio.h> int main(){ char entrada[14]; gets(entrada); puts(entrada); ...
2
votes
2answers
810 views

How To Print Addresses in Radare2

I'm switching over to Radare2 from GDB mixed with peda. One of the things I love about GDB, is the p command. For example, p system prints out the address of system. As well, peda's searchmem function ...
4
votes
1answer
3k views

How to get a nice stack view in radare2?

This is the stack view that I'm getting in radare2 after entering the visual panel mode: This is the view from immunity debugger: How can I get a view similar to immunity debugger in radare2?
4
votes
2answers
577 views

radare2 get API library and name from address

When I disassemble a jmp I get: [0x004073d4]> pd 1 0x004073d4 ff2584804000 jmp dword [sym.imp.kernel32.dll_GetModuleHandleA] ; 0x408084 ; "j\x85" Is there a command I can get ...
7
votes
2answers
873 views

what is radare2's equivalent to GDB's 'find &system,+9999999,“/bin/sh”'

What is radare2's equivalent to GDB's find &system,+9999999,"/bin/sh"?
4
votes
2answers
560 views

Disassembling at a memory address

I started to use radare2 to debug a PE file because it stops working as soon as I run it. When I attach my debugger and continue execution to the point where the exception is thrown I get a memory ...
9
votes
1answer
689 views

Split view radare2 print heap

I recently start to use radare2 and I have a question How can I print info about the heap with dmhb dmhf etc. while debugging ? I would like to have the heap informations on the right and the ...
2
votes
1answer
160 views

How to debug a hang application with radare2?

Could anyone tell me the basic steps and most used radare2 commands for debugging a hang x86 application to find the source of the hang? I know this question may sound a bit broad but I don't know ...
12
votes
1answer
2k views

Debugging with radare2 using two terminals

I have been trying to figure this out for quite some time now, and would really need some help. Firstly, some intro: I am running the newest version of radare2 from Github on a 64bit Ubuntu 16.04 and ...
2
votes
0answers
208 views

Radare2 project opening

When I open a project r2 -p mypoject I get a bunch of errors with some numbers: 0 0 Cannot add reference to non-function Cannot add reference to non-function 1482 I use latest version of radare2 ...
2
votes
0answers
71 views

radare2 specifying bitfield or enum width

I'm using radare2 to deconstruct a binary blob. When defining bit-field value there seems to be no syntax to specify the width of the field that contains the enum. For instance with a C structure as ...
1
vote
1answer
1k views

reversing stripped & statically linked binary with radare2

As the question says I need to reverse a stripped elf binary with radare2. This binary is also statically linked. I already reversed it in IDA by identifying statically linked libraries using lscan ...
3
votes
2answers
250 views

How to find paths from current offset to given address using radare2?

According to Radare2 documentation, this is the command to find paths: agt [addr] find paths from current offset to given address But when I try the command, after running aaaaa analysis, ...
1
vote
1answer
1k views

Disassembling MIPS 32 version 1 binary with the Radare2 Framework

I am trying to disassemble a MIPS 32 version 1 binary with the Radare2 framework. Here is the full output of the file command: ELF 32-bit LSB executable, MIPS, MIPS32 version 1 (SYSV), dynamically ...
6
votes
1answer
2k views

How to make radare2 work for a large binary?

I compiled cpython with debugging headers and I want to perform the following analysis using radare2. The problem I encounter is that it takes forever (at least 27 hours) to perform the aaa (...
5
votes
1answer
727 views

Radare2 doesn't display the whole function

I am using radare2, I have disassembled the function: sym.loop, it contains a switch witch has 4 cases that calls different functions. After any of the function call, the program exits the loop ...
2
votes
0answers
132 views

Radare2 - recursive traversal visual mode

I know that both pdf @ func and pdr @ func disassemble the function, the first using linear and the second recursive traversal disassembly. VV @ func shows the disassembled function in visual mode, ...
2
votes
1answer
2k views

How to print all functions of a binary using radare2 c/c++ API

I need to write a program (in c++), that among other things needs to know all functions of a given PE file. Basically, It's an equivalent of opening a binary with "r2 -A binary_name" and then entering ...
6
votes
1answer
4k views

How to find a symbol in a binary using radare2?

I want to find an address of a symbol (e.g strcpy) inside a binary using radare2. I tried to use the f command to list all flags which are recognized by r2 but the list is enormous and it's not ...
4
votes
1answer
5k views

Visual View in radare2 while debugging

I am using radare2 in debugging mode (r2 -d ./program). I set up a breakpoint at a certain address (db 0x12341234) And next I have entered Visual View using: V! Following some tutorials, I saw them ...
6
votes
1answer
2k views

radare2 ascii graph to image?

After analysing a function and pressing VV to go into graph mode, is it somehow possible to export/render the whole graph to an image? I have some huge main functions and it would be nice to have it ...
2
votes
1answer
174 views

Did radare2 remove support of MSIL from some version?

When I read the radare2 book here: https://radare.gitbooks.io/radare2book/content/ It said it support MSIL: " _d 16 32 64 msil PD .NET Microsoft Intermediate Language " However, when I git clone ...
-1
votes
1answer
236 views

Practicing what SHOULD be a simple crackme. Program calls strlen() but never returns

I'm trying out a crackme from the "LSE CTF" called "Blue Box" worth only 10 points. I've attempted this inside GDB and radare2... It is very simple, takes one argument and first checks to make sure ...
3
votes
2answers
149 views

Two arguments pushed on stack, callee only shows one argument

I have found myself confused while reversing some programs (specifically the IOLI Crackme challenges). I have no trouble solving them, but I have come across something that I do not understand and it ...
1
vote
4answers
3k views

reversing on windows x86_64 with radare2

I am trying to get radare2 to "run" on my windows7 64-bit system. I downloaded the radare2-1.5.0.zip file from http://radare.org, but when I unzip it and try to run any of the tools, I simply get "...
-1
votes
0answers
116 views

Pass Signal to debugee in Radare2

Does anybody know how to something similar to GDB's handle SIGTRAP pass to pass a signal to the process that is being debugged? The only thing I found was dko <signal> [|skip|cont] // On ...
3
votes
2answers
8k views

How to use radare2 to disassemble an executable file?

I have a cgywin executable file (shall be in PE format) and would like to disassemble it to get the assembly code on the text section using radare2, most of the examples disassemble per instruction ...
4
votes
2answers
6k views

Radare2 C output

I made a simple hello world program, and put it in radare2. I then ran the pc command, which displayed C output. The output was this: #define _BUFFER_SIZE 256 const uint8_t buffer[256] = { 0x55, ...
4
votes
1answer
817 views

How to add a function symbol to a stripped executable with radare2?

I am struggling with a stripped binary, and I would like to visualize the main() function with the VVV command (ascii-art CFG representation). Usually, the steps are the following: #> r2 ./...
1
vote
1answer
676 views

Trying to identify a string in a strcmp instruction

Working to debug and analyze a piece of firmware, I've come across a bunch of cgi files which are all symlinked to a central cgi file. The first thing the main function does is run a series of string ...
-1
votes
0answers
836 views

Radare2 function arguments

Is there any way for radare2 to display the argument types a function accepts similarly to IDA? For example IDA displays the argument types next to the function name as a hint when there is a call ...
3
votes
2answers
1k views

How to display .text section of a PE in radare2?

I used rabin2 -Sr myfilename to get the size of the .text section of myfilename. But, how can I dump the whole hexadecimal section of the .text onto an output file? My purpose is to read the byte ...