Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [radare2]

Opensource reverse engineering framework to disassemble, debug, analyze, manipulate binary files and more.

0
votes
1answer
1k views

Editing memory in radare2

It sounds like a stupid question but I honestly can't find the answer... I've looked at https://radare.gitbooks.io/radare2book/content/ and googled for hours but it still eludes me. How do I modify ...
2
votes
1answer
951 views

Finding hidden string location using radare2 on ELF binaries

I'm working through some reverse engineering sample programs (IOLI crackmes) crackme0x00 - crackme0x09 which are gcc compiled ELF format binaries. I was provided these by a colleague and can be ...
1
vote
2answers
518 views

How to determine architecture from firmware file

I have a .bin file from a vendors website that I want to walk through with radare2. I've determined that the device has a DRAM chip, a RTL8304 network controller and a DSPgroup dsp. Here's a link to ...
0
votes
2answers
207 views

Can Radare2 support word-oriented architectures?

I'd like to write a Radare2 plugin for a legacy 48-bit word-oriented CPU which has two 24-bit instructions per word, and, naturally, uses word addressing. I wrote a disassembler plugin which prints ...
1
vote
1answer
906 views

Radare2 console output?

I have been playing around with radare2, and i am wondering something that seems almost obvious to me but after much googling down the rabbit hole i can not find out how to view the console output of ...
0
votes
2answers
453 views

Reverse Engineering a binary file with no extension

Is it possible to reverse engineer a binary file with no extension? For example this file: https://github.com/commaai/openpilot/tree/master/selfdrive/visiond I have tried radare2 but it throws out ...
-1
votes
2answers
4k views

edit instructions directly in visual mode

I know we can edit opcodes in radare2's visual mode using i. But is there any way to edit instructions directly in visual mode? In my case, instruction is jae 0x8048450, and i want change it to jnbe ...
1
vote
2answers
3k views

Binary patching using radare2 in debug mode

Im a newbe in radare and while I tried to patch a crackme binary, I opened it the first time in debug mode (-d), while debugging I used oo+ to reopen it with write mode, when I modify an instruction ...
-3
votes
2answers
336 views

What means sym prefix before functions name in radare2

What means sym prefix in disassembly? For examle, sym.main?
2
votes
1answer
1k views

Not in a function. Type 'df' to define it here

I'm trying to disassemble main of programs function in Visual Mode and i want to see Disassembly Graph, but radare2 show me this message: Not in a function. Type 'df' to define it here googling result ...
4
votes
0answers
142 views

Comparing two UEFI applications?

I have two x86-64 UEFI applications original.efi and patched.efi. I want to find out what have been changed in patched.efi and what these changes do. I have tried to use the Radare2 framework to ...
1
vote
1answer
262 views

Radare2: how to change operand from integer value to (flag + offset) in disassembly output?

this is Easy_ELF from Reversing.Kr Right now R2 displays absolute address for a character inside of a string: [0x08048454]> pdf ... 0x08048454 0fb60521a004. movzx eax, byte [0x804a021]...
7
votes
4answers
5k views

Radare2 (noob question) can't set breakpoint?

I was following this video: https://www.youtube.com/watch?v=3NTXFUxcKPc at the end it show how to do basic stuff with Radare2. When i try to set a break point with: db 0x004005bd where '0x004005bd' ...
1
vote
1answer
269 views

Why 0xc(%ebp) becomes dword [ebp+arg_3]?

I'm reversing an x86 binary and I have an instruction that using the at&t syntax is movl 0xc(%ebp), %eax while using the intel syntax is mov eax, dword [ebp+arg_3] I'm using radare2, and at ...
2
votes
2answers
963 views

Radare2 to show code hints like IDA Pro?

I am trying to disassemble a binary with radare2, as a free alternative to IDA. Here is how the IDA disassembly of that section looks like : Here is what I am doing with Radare2 (with an additional ...
0
votes
1answer
217 views

How to DUMP the full hexa of each function extracted by analysis of binary file?

I used a script python from radare2-bindings to write a code analysing a binary file, i extracted the name , the start address and the size of each function , but i can't dump the hexa of each ...
2
votes
1answer
95 views

My Radare2 Installation Not Working As Expected

So I am trying to learn radare2 by following an on-line guide, but from what I have seen there and on other sites, my r2 behavior is wacky. The author's disassembly looks like this, with neat little ...
1
vote
0answers
400 views

To write a Python file to return a JSON represented list [closed]

I need to write a script that uses the r2pipe API to call the radare2 instance, analyze notepad.exe, and have it return a JSON-represented list of each function in the binary along with its virtual ...
1
vote
1answer
105 views

radare2 search first occurrence before

Is it possible to use radare2 to perform a search like the following: first occurence of ldr r1 before address 0x000048b4 In the following example it should return: 0x000048b2 ldr r1, [pc, 0x20] ...
2
votes
1answer
428 views

radare2 not resolve XREF

I'm trying analyze study example. Some article illustrates radar2 work, and there radar2 resolve string by XREF: 0x00400ee4 be00244000 mov esi, str....
2
votes
1answer
2k views

Radare2 find xrefs to a function in the import table

What is the Radare2 equivalent of going to the import table in ida, hitting enter on a function and then pressing ctrl+x? When I use axt, it can only find xrefs to strings.
-1
votes
2answers
150 views

rasm2 output differs from radare2

radare2 disassembles an instruction in the following way (binary here): 0x0040425f 0f847b020000 je 0x4044e0 Why is giving rasm2 different result? rasm2 -a x86 -b 64 -d '0f847b020000' je 0x281
-1
votes
2answers
189 views

Radare2 Flare-on 2015, Why results different?

Learning how to use radare2 while getting the feel for crackmes. Following the steps for Flare-on 2015 Challenge One on hxxp://solidsec.blogspot.com/2015/10/ctf-fire-eye-flareon-2015-challenges-1-3....
3
votes
2answers
1k views

Dumping binary with radare2

I have found the command r2 -c 'pi $s' to dump a binary with radare2. I have tried this redirecting the output to a file: r2 -c 'pi $s' binary > dump.txt. The dump is created but radare2 gets ...
2
votes
2answers
2k views

Static analysis of Windows executable from a Linux platform

I am trying to do some static analysis on crackmes written for Windows on a Linux platform. I am using radare2. My problem is that most of the time I am unable to find the "real" code, for example the ...
1
vote
1answer
505 views

Interpreting variable names in radare2

I am reversing an ELF executable, and got the following: 0x080480ab b880800408 movl $entry0, %eax ; eip 0x080480b0 bb23810408 movl $section_end.LOAD0, %ebx ; section_end....
0
votes
1answer
762 views

radare2 does not show reference to memory address

I am debugging Challenge 6 from the 2014 FlareOn challenges. For incorrect imput it displays the "bad" message. Running /i bad returns 0x004f3bf2 hit0_0 "bad". ps @ 0x004f3bf2 returns bad as expected. ...
4
votes
1answer
2k views

Radare2 forwarding input to scanf from a file

I'm debugging a file with radare2 and when I come to scanf function I want to forward input from a .txt file. In gdb I would do this by typing r < text.txt. Is something like that possible in ...
3
votes
1answer
356 views

Examining memory in radare2 using registers

I can inspect esp in radar2 using dr esp. In order to inspect 0x15(%esp) I do the following: dr esp 0xff966c60 ? 0xff966c60 + 0x15 0xff966c75 px 4 @ 0xff966c75 Is there an easier way to ...
1
vote
2answers
4k views

How to print from pointers in radare2 in debug session

when I am using the radare2 debugger, it happens that I have sometimes to examine variables and memory. Consider the following instruction 0x08048498 8b4508 mov eax, dword [ebp+arg2] ...
4
votes
1answer
614 views

Changing code to data in radare2

I really like radare2 and I am trying to follow a tutorial in which some code is changed to data. The tutorial uses IDA, I have tryed this with radare2. I entered visual mode by pressing V and cursor ...
4
votes
1answer
374 views

Radare2 and Boomerang

I found this post stating that Radare can work with Boomerang. However when I try do exactly as they say, I get the following error: sh: 1: rsc: not found. From what I can see, rsc is an extra ...
5
votes
2answers
2k views

Method disassembly of Objective C Mach-O with Radare 2

Is is possible to retrieve the dissassembly of Objective-C methods declared in Mach-O files using Radare 2 ?
4
votes
2answers
2k views

Debugging forked child in an anti-debug protected crackme

I am interested in the anti-debugging method implemented in the crackme called trace-p. A child process is forked, which communicates with the parent using int3 instructions. I would like to debug the ...
2
votes
2answers
1k views

Help with IOLI crackme0x02

I am studying IOLI crackme0x02. It is clear to me that rewriting the jump at 0x8048451 with no instructions the crackme can be patched. However, I want to understand better what the code does. My ...
10
votes
2answers
15k views

Find reference to string in radare2

In this crackme solution first the strings are found: $ rabin2 -z crackserial_linux addr=0x00000aa0 off=0x00000aa0 ordinal=000 sz=7 len=7 section=.rodata type=A string=User: addr=0x00000aa7 off=...
3
votes
1answer
2k views

Demangle c++ functions in radare2

I am learning radare2. Is there a way to demangle c++ functions during disassembling? For example in gdb set print asm-demangle changes callq 0x400a30 <_ZNSo3putEc@plt> to callq 0x400a30 &...
1
vote
2answers
5k views

Examining memory in radare2

How can I examine a memory address in radare2 using registers? I would like to achive what this command does in gdb: x/s $ebp+0x4
0
votes
1answer
2k views

How to debug with remote binaries radare2?

i am reading differents documentation about radare2 but i don't read nothing about how can i debug a binary in remote machine. Actually i am a security research and i need execute binaries in other ...
5
votes
1answer
14k views

How to debug (like gdb) with radare2?

im new at radare2 and linux. I got problem with r2. As title, many tutorials, articles, videos about r2 is just disassemble the program, and read asm code. But i wanna debug my program. I search ...
2
votes
1answer
190 views

Disassembling output of searches radare2

[0x00402079]> / valid Searching 5 bytes from 0x00401000 to 0x0040561e: 76 61 6c 69 64 # 3 [0x401000-0x40561e] hits: 5 0x00401695 hit6_0 "valid" 0x00401fca hit6_1 "valid" 0x00402095 hit6_2 "valid" ...
5
votes
3answers
704 views

Any documentation available for r2 other than official book

I am interested in learning and using radare2 as a toolset for reverse engineering. But I want ANY other resource for learning this tools other than radare2 book, preferably a video series. What I am ...
1
vote
1answer
139 views

Radare2 windows unwanted lines during debugging

I'm learning how to work with radare2 tool. While I am stepping through the program (on windows7) radare2 prints some lines which can be seen on the picture. It seems to me as if the tracing is ...
1
vote
1answer
678 views

AT&T XOR argument at radare2

Recently I faced with strange (in my opinion) behavior of radare2. I have been reading the Artificial truth blog post about Hacking bits with this crackme. In an article Julien used Intel syntax, ...
9
votes
2answers
6k views

How do you can you disassemble and dump an entire binary?

It's easy to seek to a particular function and dump it's contents as Assembly language. However, I cannot find an obvious way to immediately disassemble and dump an entire binary. I want to use it ...
7
votes
1answer
5k views

Recursive traversal disassembling with Radare2?

I am trying the recursive traversal disassembler of the radare2 tool. But, I cannot use it properly. First, according to the radare2 manual, we can use recursive traversal disassembler by using the ...
5
votes
1answer
3k views

Disassembling an unknown DOS MZ executable using radare2

How do I specify to radare2 that what I'm disassembling when I know it is a DOS MZ executable? As it does not auto-detect this for me.
4
votes
1answer
3k views

Getting to the entry point using radare2

How do I get to the entry point of a .exe file using radare2? I tried using aa then pdf@sym.main, but a prompt showed saying "Cannot find function at 0x00000000"
4
votes
1answer
3k views

How to reverse CGI file for MIPS?

I'm trying to load a CGI file to IDA in order to disassemble it and understand it's behaviour but I can't do it. According to the strings command I can see some interesting words like system, sprintf,...
11
votes
2answers
2k views

Encrypted Mach-o binary cannot be disassembled/traced with GDB

I'm trying to analyze an encrypted Mach-O binary (non-iPhone one), and I am observing the following strange behaviors: when I load this binary into GDB and try to disassemble the code at the address ...