Skip to main content

Questions tagged [radare2]

Opensource reverse engineering framework to disassemble, debug, analyze, manipulate binary files and more.

57 questions with no upvoted or accepted answers
Filter by
Sorted by
Tagged with
6 votes
1 answer
608 views

Radare2 - How to save/restore metadata in debug session (BPs, flag, comments..)?

How can i save/reuse/preserve Radare2 metadata (BPs, comments, flags..) of a debug session for a new debug session? I restart the debugger alot and preserving environment would be very helpful. I ...
Maniaxx's user avatar
  • 185
5 votes
0 answers
342 views

Radare2 8051 code bank switching

Some of 8051 chips use bank switching to extend accessible code memory. Good example is Silabs C8051F12x. Another example is here. Code area in range 0x0000..0x7ffff is common always accessible code ...
kimstik's user avatar
  • 159
4 votes
0 answers
3k views

How to save Radare2 Analysis?

How do I save a radare2 session after I did "aa"? I know there is a command for saving a project, but this isn't working out for some reason (Ps PROJECTNAME). So I am looking for a way to save my ...
q7v6rhgfzc8tnj3d's user avatar
4 votes
0 answers
540 views

Radare2 project opening

When I open a project r2 -p mypoject I get a bunch of errors with some numbers: 0 0 Cannot add reference to non-function Cannot add reference to non-function 1482 I use latest version of radare2 ...
aod572's user avatar
  • 41
3 votes
0 answers
60 views

plugin/script for radare2 similar to mona for immunity debugger

I would like to use radare2 for windows exploit-development, however I could not find a way to emulate the functionality of using Immunity-Debugger + mona.py when checking for badchars. Is there a ...
s1gsegv's user avatar
  • 31
3 votes
0 answers
97 views

Using output of a command as argument in radare2

I'm trying to use the output of a command as argument for my program that i'm trying to debug. I created the following profile, similar to using a command output for stdin $ cat profile.rr2 #!/usr/bin/...
Mime's user avatar
  • 131
3 votes
0 answers
73 views

Cutter console does not show printf result

I'm using last version (2.0.5) of Cutter. I am not able to find a way to display std in/out in Cutter Console. In the picture I cleared the console before starting debugging and you can see it after ...
Luigi 's user avatar
  • 31
3 votes
0 answers
321 views

radare2 difference between function offset and minbound

I am trying to understand the difference between a function's offset and its minbound in radare2. Consider this function in radare2 (output of aflj): { "offset": 4549740, "name": "...
quadriat's user avatar
3 votes
0 answers
254 views

Comparing two UEFI applications?

I have two x86-64 UEFI applications original.efi and patched.efi. I want to find out what have been changed in patched.efi and what these changes do. I have tried to use the Radare2 framework to ...
NSwroy's user avatar
  • 39
3 votes
1 answer
1k views

Cannot open '/proc/.../maps': No such file or directory in radare2 debug mode

When I try to load a program to radare2 debug mode, most of the time I get the following error: $sudo r2 -d a.out Hello world!= attach 2851 2851 Cannot open '/proc/2851/maps': No such file or ...
Rafael's user avatar
  • 153
2 votes
0 answers
207 views

How to quickly exit radare2 from debug mode?

Normally in CLI apps you can use Ctrl + c / Ctrl + d to terminate/exit, but they don't seem to do anything in r2 - at least not in debugger's v (visual) mode, which is how I use it. To exit, I press q,...
Mihai Rotaru's user avatar
2 votes
0 answers
69 views

Radare2: How to Create a Custom Scripted Panel?

TLDR: How do I get a panel in radare2 to correctly show the output of a radare2 command piped to an external script? e.g. afvd | python var_displayer.py This is my current view. Multiple panels, ...
Khalid's user avatar
  • 21
2 votes
0 answers
99 views

Specifying multiple input files in radare2

If I want to pass several inputs, I know that I can write this with rarun2: #!/usr/bin/rarun2 stdin="first\nsecond\n" But what if I want to pass the input from a file file1 at the first ...
Aramya's user avatar
  • 21
2 votes
0 answers
1k views

Radare2 cannot open bin for writing

Im on Kali and im using Radare2 but it says r2 -d bin Killing child process 16151 due to an error Killing child process 16152 due to an error [w] Cannot open 'dbg://./bin' for writing. I tried chmod +...
JyanJohn's user avatar
2 votes
0 answers
155 views

What do you think is the optimum environment for reverse engineering dynamically-linked aarch64 Golang binaries developed in Alpine Linux?

Direct quote from Golang's website: "GDB does not understand Go programs well. The stack management, threading, and runtime contain aspects that differ enough from the execution model GDB expects ...
Newbie's user avatar
  • 277
2 votes
0 answers
78 views

radare2 wrong output

I saw rasm2 giving different output each time for x64 Take a look at this: C:\WINDOWS\system32>rasm2 -a x86 -b 64 -d "41f6c7FF" test r15b, 0xff C:\WINDOWS\system32>rasm2 -a x86 -b 64 "test ...
potatosalad's user avatar
2 votes
0 answers
173 views

Understanding ESIL

I cross-compiled a simple program with the aarch-linux-gnu-gcc compiler for ARM. So the machine is "ARM aarch64". I want to understand a single instruction and it's realization in ESIL. The opcode of ...
AndiYo's user avatar
  • 49
2 votes
0 answers
131 views

radare2 specifying bitfield or enum width

I'm using radare2 to deconstruct a binary blob. When defining bit-field value there seems to be no syntax to specify the width of the field that contains the enum. For instance with a C structure as ...
Toluene's user avatar
  • 121
2 votes
0 answers
183 views

Radare2 - recursive traversal visual mode

I know that both pdf @ func and pdr @ func disassemble the function, the first using linear and the second recursive traversal disassembly. VV @ func shows the disassembled function in visual mode, ...
robert's user avatar
  • 897
1 vote
0 answers
47 views

How can I create a radare2 type for a variable-length struct?

I'm trying to parse a binary file and it has a structure similar to this, struct foo { int64_t count_things; int64_t offset_to_thing[count]; int8_t bytes[]; int64_t other fields; } ...
Evan Carroll's user avatar
  • 1,789
1 vote
0 answers
159 views

Cyber Talent Basic Malware Reverse Engineering

I'm an absolutely beginner in the reverse engineering field. I have an exe program and I am to find: I have tried with Ghidra but i keep getting wrong submissions for the challenge. Here is the exe ...
Sheddymax's user avatar
1 vote
0 answers
21 views

Why rarun2 is not behave like it is described?

colleagues. Simplest question. As many articles in the Net (example https://r2wiki.readthedocs.io/en/latest/tools/rarun2/) and here on forum are describing, i have a rarun2 profile named "...
Roman's user avatar
  • 11
1 vote
0 answers
48 views

View v0, d0 registers in Cutter (ARM64)

When reversing an ARM64 binary in Cutter 2.1, I wanted to emulate certain instructions and view the values that were computed. Cutter's emulation showed the x0-x31 registers but how do I view the v0....
localacct's user avatar
  • 193
1 vote
0 answers
280 views

radare2: How to load a DLL along with the application?

I am reverse engineering a Windows application for which there is no PDB file available. When loading it in r2, I get the following imports (They are correct): nth vaddr bind type lib ...
movzxb's user avatar
  • 11
1 vote
0 answers
119 views

radare2 Loop over literal strings for search

In radare2, I can search and grep e.g. / needle ~:0 2>/dev/null. How I can I do that in a loop for multiple needles? E.g. something like for n in needle1 needle2 needle3; do / $n ~:0 2>/dev/...
SRobertJames's user avatar
1 vote
0 answers
154 views

Radare2 Load file from stdin fails

Radare2 supports loading a file from stdin via =. However, my attempts to use it don't work: $ r2 /bin/ls Warning: run r2 with -e bin.cache=true to fix relocations in disassembly [0x00006810]> q $ ...
SRobertJames's user avatar
1 vote
0 answers
107 views

Function Arguments/Name on Radare and IDA

I am starting with reverse engineering and Radare and I'm facing the following problem, on IDA Free I see the following code: mov ecx, 11h lea edi, [esp+1208h+StartupInfo] rep stosd lea ...
secjav's user avatar
  • 11
1 vote
0 answers
67 views

Change return value of a boolean function in arm library

I have an android library (arm cpu) that have a function named GetEisLinkWithDfr() that have a single line that returns boolean value of "true", and I want it to return a value of "...
Bilux's user avatar
  • 11
1 vote
0 answers
169 views

How can I rename location in radare2?

In radare2 I would like to be able to rename a node in the graph view. I though setting a flag to the entry of the graph node would also change its title, but the address of the nodes still shows ...
Erran's user avatar
  • 11
1 vote
0 answers
130 views

radare2 stop on lazy loaded library (gdb's stop-on-solib-events)

I am running an application and would like to set a breakpoint, as soon as a relevant shared library is loaded. On gdb I can achieve it via set stop-on-solib-events 1 I've been unable to find ...
Simon's user avatar
  • 11
1 vote
0 answers
123 views

Add indirect branch target reference manually (xref, crossreference) in Cutter (radare2)?

How can I create a reference for an indirect branch instruction blx r0 so that the call to the address stored in r0 shows up in the graph? I've tried flagging the target (function), but that does ...
handle's user avatar
  • 111
1 vote
0 answers
786 views

Some obstacles in reversing a JNI Native library

I deleted my last question (it was not still answered and none's effort was wasted) as I got back and thought to re-read JNI documentation, to find I misinterpreted some bits. Things are now clearer ...
CortexAuth's user avatar
1 vote
0 answers
680 views

write radare2 output to a file

I am trying to write all the write logs of a binary program into a file for further analysis. I am using radare2 for it. I don't know what's the issue, I am not able to write the 'dte' output to a ...
tarun14110's user avatar
1 vote
0 answers
833 views

Illegal instruction fault in stack based buffer overflow

I wrote this short C program to practice buffer overflow exploits: #include <stdio.h> #include <string.h> #include <stddef.h> #include <inttypes.h> char *decode(char *s){ ...
corporateWhore's user avatar
1 vote
0 answers
283 views

Password is right, but still wrong?

i am trying to find the password of a binary with radare2 - a crackme again :-) I already thought I've found the password ('pass'), but this seems to be not the right one. Or there is a trick I didn'...
Mofro's user avatar
  • 23
1 vote
0 answers
149 views

Techniques for reversing (basic) hash function

Hi I'm relatively new to RE, and I'm using GDB and Radare2. As part of a crackme I'm trying to reverse a weak hash function that's a little too complicated for me to undo by hand. I've been trying to ...
Chase Kanipe's user avatar
1 vote
0 answers
432 views

Radare2: pd command ignores cfg.bigendian setting

I am currently using radare2 to disassemble a raw ARM binary (bootloader) in little endian format. I used the command e cfg.bigendian = false to set the endianness, but the pd command seems to ignore ...
Sleik's user avatar
  • 11
1 vote
0 answers
94 views

Can Radare2 emulate null pointer exceptions and others?

I'm wondering if anyone has had any luck with Radare2's configuration variables, esil.exectrap, esil.iotrap, and esil.nonull while emulating? xor eax, eax mov eax, dword [eax] <- From what I can ...
Nux's user avatar
  • 133
1 vote
0 answers
1k views

radare2 not showing function names

I'm using radare2 and I've noticed that it simply prints function offsets rather than function names. I've done some tests and I've discovered that on Kali it prints offsets and on debian it prints ...
Razvi's user avatar
  • 121
1 vote
1 answer
1k views

ARM binary dissasembly, Hopper works, Ghidra and Radare2 don't for some functions

I'm disassembling a large ARM binary and I see that for some functions both Ghidra and Radare2 appear to fail to disassemble certain functions whereas Hopper works for those same functions In Ghidra - ...
user1247196's user avatar
0 votes
0 answers
45 views

Unknown Mitsubishi automotive MCUs - are these using unknown architecture?

Please help ientify the architecture (ISA) of MH8200F and MH8110F which is found almost exclusively on Mazda ECUs with L3CK, L587, L5E8, LFAR, LFFR, LFJP firmwares I've revealed that the MH8501F is ...
Andy's user avatar
  • 1
0 votes
0 answers
43 views

radare2 on an architecture with custom instructions

I am exploring RISC-V binaries that contain custom instructions. Is there a way to add them to the disassembler?
confusedandsad's user avatar
0 votes
0 answers
31 views

Why can't I resolve the 'system' dynamic addresss in ret_2_libc exploit?

First and foremost, I am a noob pwner. The problem at hand is from TryHackMe.com > pwn101 > pwn109. A simple ret_2_libc in which you exploit a simple buffer overflow, leak the addresses of gets()...
Christian Sanchez's user avatar
0 votes
1 answer
101 views

Cracking cryptographic function with radare2

I want to reverse engineer an android game, found a method public static byte[] MNNOPKMJMFP(byte[] AFFEPNLBIIC, byte[] OENOGNMAMPO, byte[] GLLEHJKGIBK) { } Names are obfuscated, i know that this is a ...
Gold Moon's user avatar
0 votes
0 answers
31 views

Searching for signal calls in a Mach-O multiarch binary

I'm searching for signals call in a Mach-O mutliarch using radare2. This is what I start with: file sample /tmp/sample (for architecture x86_64): Mach-O 64-bit executable x86_64 /tmp/sample (for ...
Plup's user avatar
  • 101
0 votes
0 answers
92 views

Radare2 is showing weird disassembly as compared to disassembly of gcc

Today i was playing around with c code in r2. I compiled a file which had the following code. #include <stdio.h> int main(){ int a=9; float b=1.1; int sum; sum = ...
Mr. rc's user avatar
  • 45
0 votes
0 answers
184 views

Why won't Radare2 display main's paramethers of a 32bit ELF on a 64 bit machine?

I am new to reversing and currently trying to follow this tutorial, in which the binary provided was compiled on a 32 bit machine hence the file is a "ELF 32-bit LSB executable". It runs ...
Yuran Pereira's user avatar
0 votes
0 answers
78 views

"rabin2 -E" and "afll" no output for an exe file

$ rabin2 -I test.exe arch x86 baddr 0x400000 binsz 3229424 bintype pe bits 32 canary false retguard false class PE32 cmp.csum 0x0031d950 ...
XPDIN's user avatar
  • 101
0 votes
0 answers
103 views

how do I use Remote Binary Protocol in cutter

how do I use Remote Binary Protocol I tried to connect to gdbserver through the normal method but it would just hang and not connect. I let it go like that for 1 hour
batboy's user avatar
  • 1
0 votes
0 answers
93 views

Radare2: Running executable from a specific point

I am using radare2 to reverse engineer a standard crackme executable. I have obtained the password, but now I need use the program to read & print a restricted file to which the executable has ...
Gabriel Saul's user avatar