Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [radare2]

Opensource reverse engineering framework to disassemble, debug, analyze, manipulate binary files and more.

5
votes
1answer
6k views

Visual View in radare2 while debugging

I am using radare2 in debugging mode (r2 -d ./program). I set up a breakpoint at a certain address (db 0x12341234) And next I have entered Visual View using: V! Following some tutorials, I saw them ...
6
votes
1answer
2k views

radare2 ascii graph to image?

After analysing a function and pressing VV to go into graph mode, is it somehow possible to export/render the whole graph to an image? I have some huge main functions and it would be nice to have it ...
2
votes
1answer
188 views

Did radare2 remove support of MSIL from some version?

When I read the radare2 book here: https://radare.gitbooks.io/radare2book/content/ It said it support MSIL: " _d 16 32 64 msil PD .NET Microsoft Intermediate Language " However, when I git clone ...
-1
votes
1answer
258 views

Practicing what SHOULD be a simple crackme. Program calls strlen() but never returns

I'm trying out a crackme from the "LSE CTF" called "Blue Box" worth only 10 points. I've attempted this inside GDB and radare2... It is very simple, takes one argument and first checks to make sure ...
3
votes
2answers
155 views

Two arguments pushed on stack, callee only shows one argument

I have found myself confused while reversing some programs (specifically the IOLI Crackme challenges). I have no trouble solving them, but I have come across something that I do not understand and it ...
1
vote
4answers
3k views

reversing on windows x86_64 with radare2

I am trying to get radare2 to "run" on my windows7 64-bit system. I downloaded the radare2-1.5.0.zip file from http://radare.org, but when I unzip it and try to run any of the tools, I simply get "...
4
votes
2answers
9k views

How to use radare2 to disassemble an executable file?

I have a cgywin executable file (shall be in PE format) and would like to disassemble it to get the assembly code on the text section using radare2, most of the examples disassemble per instruction ...
5
votes
2answers
7k views

Radare2 C output

I made a simple hello world program, and put it in radare2. I then ran the pc command, which displayed C output. The output was this: #define _BUFFER_SIZE 256 const uint8_t buffer[256] = { 0x55, ...
5
votes
1answer
909 views

How to add a function symbol to a stripped executable with radare2?

I am struggling with a stripped binary, and I would like to visualize the main() function with the VVV command (ascii-art CFG representation). Usually, the steps are the following: #> r2 ./...
1
vote
1answer
718 views

Trying to identify a string in a strcmp instruction

Working to debug and analyze a piece of firmware, I've come across a bunch of cgi files which are all symlinked to a central cgi file. The first thing the main function does is run a series of string ...
3
votes
2answers
2k views

How to display .text section of a PE in radare2?

I used rabin2 -Sr myfilename to get the size of the .text section of myfilename. But, how can I dump the whole hexadecimal section of the .text onto an output file? My purpose is to read the byte ...
1
vote
1answer
2k views

Editing memory in radare2

It sounds like a stupid question but I honestly can't find the answer... I've looked at https://radare.gitbooks.io/radare2book/content/ and googled for hours but it still eludes me. How do I modify ...
2
votes
1answer
1k views

Finding hidden string location using radare2 on ELF binaries

I'm working through some reverse engineering sample programs (IOLI crackmes) crackme0x00 - crackme0x09 which are gcc compiled ELF format binaries. I was provided these by a colleague and can be ...
1
vote
2answers
603 views

How to determine architecture from firmware file

I have a .bin file from a vendors website that I want to walk through with radare2. I've determined that the device has a DRAM chip, a RTL8304 network controller and a DSPgroup dsp. Here's a link to ...
0
votes
2answers
209 views

Can Radare2 support word-oriented architectures?

I'd like to write a Radare2 plugin for a legacy 48-bit word-oriented CPU which has two 24-bit instructions per word, and, naturally, uses word addressing. I wrote a disassembler plugin which prints ...
1
vote
1answer
982 views

Radare2 console output?

I have been playing around with radare2, and i am wondering something that seems almost obvious to me but after much googling down the rabbit hole i can not find out how to view the console output of ...
0
votes
2answers
483 views

Reverse Engineering a binary file with no extension

Is it possible to reverse engineer a binary file with no extension? For example this file: https://github.com/commaai/openpilot/tree/master/selfdrive/visiond I have tried radare2 but it throws out ...
0
votes
2answers
4k views

edit instructions directly in visual mode

I know we can edit opcodes in radare2's visual mode using i. But is there any way to edit instructions directly in visual mode? In my case, instruction is jae 0x8048450, and i want change it to jnbe ...
1
vote
2answers
3k views

Binary patching using radare2 in debug mode

Im a newbe in radare and while I tried to patch a crackme binary, I opened it the first time in debug mode (-d), while debugging I used oo+ to reopen it with write mode, when I modify an instruction ...
-3
votes
2answers
397 views

What means sym prefix before functions name in radare2

What means sym prefix in disassembly? For examle, sym.main?
2
votes
1answer
1k views

Not in a function. Type 'df' to define it here

I'm trying to disassemble main of programs function in Visual Mode and i want to see Disassembly Graph, but radare2 show me this message: Not in a function. Type 'df' to define it here googling result ...
4
votes
0answers
145 views

Comparing two UEFI applications?

I have two x86-64 UEFI applications original.efi and patched.efi. I want to find out what have been changed in patched.efi and what these changes do. I have tried to use the Radare2 framework to ...
1
vote
1answer
282 views

Radare2: how to change operand from integer value to (flag + offset) in disassembly output?

this is Easy_ELF from Reversing.Kr Right now R2 displays absolute address for a character inside of a string: [0x08048454]> pdf ... 0x08048454 0fb60521a004. movzx eax, byte [0x804a021]...
7
votes
4answers
5k views

Radare2 (noob question) can't set breakpoint?

I was following this video: https://www.youtube.com/watch?v=3NTXFUxcKPc at the end it show how to do basic stuff with Radare2. When i try to set a break point with: db 0x004005bd where '0x004005bd' ...
1
vote
1answer
284 views

Why 0xc(%ebp) becomes dword [ebp+arg_3]?

I'm reversing an x86 binary and I have an instruction that using the at&t syntax is movl 0xc(%ebp), %eax while using the intel syntax is mov eax, dword [ebp+arg_3] I'm using radare2, and at ...
2
votes
2answers
1k views

Radare2 to show code hints like IDA Pro?

I am trying to disassemble a binary with radare2, as a free alternative to IDA. Here is how the IDA disassembly of that section looks like : Here is what I am doing with Radare2 (with an additional ...
0
votes
1answer
236 views

How to DUMP the full hexa of each function extracted by analysis of binary file?

I used a script python from radare2-bindings to write a code analysing a binary file, i extracted the name , the start address and the size of each function , but i can't dump the hexa of each ...
2
votes
1answer
99 views

My Radare2 Installation Not Working As Expected

So I am trying to learn radare2 by following an on-line guide, but from what I have seen there and on other sites, my r2 behavior is wacky. The author's disassembly looks like this, with neat little ...
1
vote
0answers
409 views

To write a Python file to return a JSON represented list [closed]

I need to write a script that uses the r2pipe API to call the radare2 instance, analyze notepad.exe, and have it return a JSON-represented list of each function in the binary along with its virtual ...
1
vote
1answer
112 views

radare2 search first occurrence before

Is it possible to use radare2 to perform a search like the following: first occurence of ldr r1 before address 0x000048b4 In the following example it should return: 0x000048b2 ldr r1, [pc, 0x20] ...
2
votes
1answer
453 views

radare2 not resolve XREF

I'm trying analyze study example. Some article illustrates radar2 work, and there radar2 resolve string by XREF: 0x00400ee4 be00244000 mov esi, str....
2
votes
1answer
2k views

Radare2 find xrefs to a function in the import table

What is the Radare2 equivalent of going to the import table in ida, hitting enter on a function and then pressing ctrl+x? When I use axt, it can only find xrefs to strings.
-1
votes
2answers
152 views

rasm2 output differs from radare2

radare2 disassembles an instruction in the following way (binary here): 0x0040425f 0f847b020000 je 0x4044e0 Why is giving rasm2 different result? rasm2 -a x86 -b 64 -d '0f847b020000' je 0x281
-1
votes
2answers
191 views

Radare2 Flare-on 2015, Why results different?

Learning how to use radare2 while getting the feel for crackmes. Following the steps for Flare-on 2015 Challenge One on hxxp://solidsec.blogspot.com/2015/10/ctf-fire-eye-flareon-2015-challenges-1-3....
3
votes
2answers
1k views

Dumping binary with radare2

I have found the command r2 -c 'pi $s' to dump a binary with radare2. I have tried this redirecting the output to a file: r2 -c 'pi $s' binary > dump.txt. The dump is created but radare2 gets ...
2
votes
2answers
2k views

Static analysis of Windows executable from a Linux platform

I am trying to do some static analysis on crackmes written for Windows on a Linux platform. I am using radare2. My problem is that most of the time I am unable to find the "real" code, for example the ...
1
vote
1answer
516 views

Interpreting variable names in radare2

I am reversing an ELF executable, and got the following: 0x080480ab b880800408 movl $entry0, %eax ; eip 0x080480b0 bb23810408 movl $section_end.LOAD0, %ebx ; section_end....
0
votes
1answer
801 views

radare2 does not show reference to memory address

I am debugging Challenge 6 from the 2014 FlareOn challenges. For incorrect imput it displays the "bad" message. Running /i bad returns 0x004f3bf2 hit0_0 "bad". ps @ 0x004f3bf2 returns bad as expected. ...
5
votes
1answer
2k views

Radare2 forwarding input to scanf from a file

I'm debugging a file with radare2 and when I come to scanf function I want to forward input from a .txt file. In gdb I would do this by typing r < text.txt. Is something like that possible in ...
3
votes
1answer
436 views

Examining memory in radare2 using registers

I can inspect esp in radar2 using dr esp. In order to inspect 0x15(%esp) I do the following: dr esp 0xff966c60 ? 0xff966c60 + 0x15 0xff966c75 px 4 @ 0xff966c75 Is there an easier way to ...
1
vote
2answers
5k views

How to print from pointers in radare2 in debug session

when I am using the radare2 debugger, it happens that I have sometimes to examine variables and memory. Consider the following instruction 0x08048498 8b4508 mov eax, dword [ebp+arg2] ...
4
votes
1answer
676 views

Changing code to data in radare2

I really like radare2 and I am trying to follow a tutorial in which some code is changed to data. The tutorial uses IDA, I have tryed this with radare2. I entered visual mode by pressing V and cursor ...
4
votes
1answer
386 views

Radare2 and Boomerang

I found this post stating that Radare can work with Boomerang. However when I try do exactly as they say, I get the following error: sh: 1: rsc: not found. From what I can see, rsc is an extra ...
5
votes
2answers
2k views

Method disassembly of Objective C Mach-O with Radare 2

Is is possible to retrieve the dissassembly of Objective-C methods declared in Mach-O files using Radare 2 ?
4
votes
2answers
2k views

Debugging forked child in an anti-debug protected crackme

I am interested in the anti-debugging method implemented in the crackme called trace-p. A child process is forked, which communicates with the parent using int3 instructions. I would like to debug the ...
2
votes
2answers
1k views

Help with IOLI crackme0x02

I am studying IOLI crackme0x02. It is clear to me that rewriting the jump at 0x8048451 with no instructions the crackme can be patched. However, I want to understand better what the code does. My ...
10
votes
2answers
17k views

Find reference to string in radare2

In this crackme solution first the strings are found: $ rabin2 -z crackserial_linux addr=0x00000aa0 off=0x00000aa0 ordinal=000 sz=7 len=7 section=.rodata type=A string=User: addr=0x00000aa7 off=...
3
votes
1answer
2k views

Demangle c++ functions in radare2

I am learning radare2. Is there a way to demangle c++ functions during disassembling? For example in gdb set print asm-demangle changes callq 0x400a30 <_ZNSo3putEc@plt> to callq 0x400a30 &...
1
vote
2answers
6k views

Examining memory in radare2

How can I examine a memory address in radare2 using registers? I would like to achive what this command does in gdb: x/s $ebp+0x4
0
votes
1answer
2k views

How to debug with remote binaries radare2?

i am reading differents documentation about radare2 but i don't read nothing about how can i debug a binary in remote machine. Actually i am a security research and i need execute binaries in other ...