Questions tagged [radare2]
Opensource reverse engineering framework to disassemble, debug, analyze, manipulate binary files and more.
53
questions with no upvoted or accepted answers
6
votes
0
answers
554
views
Radare2 - How to save/restore metadata in debug session (BPs, flag, comments..)?
How can i save/reuse/preserve Radare2 metadata (BPs, comments, flags..) of a debug session for a new debug session? I restart the debugger alot and preserving environment would be very helpful.
I ...
- 173
5
votes
0
answers
302
views
Radare2 8051 code bank switching
Some of 8051 chips use bank switching to extend accessible code memory.
Good example is Silabs C8051F12x. Another example is here.
Code area in range 0x0000..0x7ffff is common always accessible code ...
- 159
4
votes
0
answers
2k
views
How to save Radare2 Analysis?
How do I save a radare2 session after I did "aa"?
I know there is a command for saving a project, but this isn't working out for some reason (Ps PROJECTNAME). So I am looking for a way to save my ...
4
votes
0
answers
521
views
Radare2 project opening
When I open a project r2 -p mypoject I get a bunch of errors with some numbers:
0
0
Cannot add reference to non-function
Cannot add reference to non-function
1482
I use latest version of radare2 ...
- 41
3
votes
0
answers
49
views
plugin/script for radare2 similar to mona for immunity debugger
I would like to use radare2 for windows exploit-development, however I could not find a way to emulate the functionality of using Immunity-Debugger + mona.py when checking for badchars. Is there a ...
- 31
3
votes
0
answers
70
views
Using output of a command as argument in radare2
I'm trying to use the output of a command as argument for my program that i'm trying to debug.
I created the following profile, similar to using a command output for stdin
$ cat profile.rr2
#!/usr/bin/...
- 131
3
votes
0
answers
67
views
Cutter console does not show printf result
I'm using last version (2.0.5) of Cutter. I am not able to find a way to display std in/out in Cutter Console. In the picture I cleared the console before starting debugging and you can see it after ...
- 31
3
votes
0
answers
303
views
radare2 difference between function offset and minbound
I am trying to understand the difference between a function's offset and its minbound in radare2. Consider this function in radare2 (output of aflj):
{
"offset": 4549740,
"name": "...
- 31
3
votes
0
answers
229
views
Comparing two UEFI applications?
I have two x86-64 UEFI applications original.efi and patched.efi. I want to find out what have been changed in patched.efi and what these changes do.
I have tried to use the Radare2 framework to ...
- 39
3
votes
1
answer
1k
views
Cannot open '/proc/.../maps': No such file or directory in radare2 debug mode
When I try to load a program to radare2 debug mode, most of the time I get the following error:
$sudo r2 -d a.out
Hello world!= attach 2851 2851
Cannot open '/proc/2851/maps': No such file or ...
- 153
2
votes
0
answers
80
views
Specifying multiple input files in radare2
If I want to pass several inputs, I know that I can write this with rarun2:
#!/usr/bin/rarun2
stdin="first\nsecond\n"
But what if I want to pass the input from a file file1 at the first ...
- 21
2
votes
0
answers
987
views
Radare2 cannot open bin for writing
Im on Kali and im using Radare2 but it says
r2 -d bin
Killing child process 16151 due to an error
Killing child process 16152 due to an error
[w] Cannot open 'dbg://./bin' for writing.
I tried chmod +...
- 21
2
votes
0
answers
139
views
What do you think is the optimum environment for reverse engineering dynamically-linked aarch64 Golang binaries developed in Alpine Linux?
Direct quote from Golang's website: "GDB does not understand Go programs well. The stack management, threading, and runtime contain aspects that differ enough from the execution model GDB expects ...
- 277
2
votes
0
answers
75
views
radare2 wrong output
I saw rasm2 giving different output each time for x64
Take a look at this:
C:\WINDOWS\system32>rasm2 -a x86 -b 64 -d "41f6c7FF"
test r15b, 0xff
C:\WINDOWS\system32>rasm2 -a x86 -b 64 "test ...
- 21
2
votes
0
answers
150
views
Understanding ESIL
I cross-compiled a simple program with the aarch-linux-gnu-gcc compiler for ARM. So the machine is "ARM aarch64". I want to understand a single instruction and it's realization in ESIL. The opcode of ...
- 49
2
votes
0
answers
122
views
radare2 specifying bitfield or enum width
I'm using radare2 to deconstruct a binary blob. When defining bit-field value there seems to be no syntax to specify the width of the field that contains the enum. For instance with a C structure as ...
- 121
2
votes
0
answers
183
views
Radare2 - recursive traversal visual mode
I know that both pdf @ func and pdr @ func disassemble the function, the first using linear and the second recursive traversal disassembly. VV @ func shows the disassembled function in visual mode, ...
- 877
1
vote
0
answers
60
views
How to quickly exit radare2 from debug mode?
Normally in CLI apps you can use Ctrl + c / Ctrl + d to terminate/exit, but they don't seem to do anything in r2 - at least not in debugger's v (visual) mode, which is how I use it. To exit, I press q,...
- 111
1
vote
0
answers
135
views
Cyber Talent Basic Malware Reverse Engineering
I'm an absolutely beginner in the reverse engineering field. I have an exe program and I am to find:
I have tried with Ghidra but i keep getting wrong submissions for the challenge.
Here is the exe ...
- 11
1
vote
0
answers
42
views
Radare2: How to Create a Custom Scripted Panel?
TLDR: How do I get a panel in radare2 to correctly show the output of a radare2 command piped to an external script?
e.g. afvd | python var_displayer.py
This is my current view. Multiple panels, ...
- 11
1
vote
0
answers
16
views
Why rarun2 is not behave like it is described?
colleagues.
Simplest question. As many articles in the Net (example https://r2wiki.readthedocs.io/en/latest/tools/rarun2/) and here on forum are describing, i have a rarun2 profile named "...
- 11
1
vote
0
answers
38
views
View v0, d0 registers in Cutter (ARM64)
When reversing an ARM64 binary in Cutter 2.1, I wanted to emulate certain instructions and view the values that were computed. Cutter's emulation showed the x0-x31 registers but how do I view the v0....
- 193
1
vote
0
answers
165
views
radare2: How to load a DLL along with the application?
I am reverse engineering a Windows application for which there is no PDB file available.
When loading it in r2, I get the following imports (They are correct):
nth vaddr bind type lib ...
- 11
1
vote
0
answers
95
views
radare2 Loop over literal strings for search
In radare2, I can search and grep e.g. / needle ~:0 2>/dev/null. How I can I do that in a loop for multiple needles? E.g. something like for n in needle1 needle2 needle3; do / $n ~:0 2>/dev/...
- 187
1
vote
0
answers
117
views
Radare2 Load file from stdin fails
Radare2 supports loading a file from stdin via =. However, my attempts to use it don't work:
$ r2 /bin/ls
Warning: run r2 with -e bin.cache=true to fix relocations in disassembly
[0x00006810]> q
$ ...
- 187
1
vote
0
answers
93
views
Function Arguments/Name on Radare and IDA
I am starting with reverse engineering and Radare and I'm facing the following problem, on IDA Free I see the following code:
mov ecx, 11h
lea edi, [esp+1208h+StartupInfo]
rep stosd
lea ...
- 11
1
vote
0
answers
64
views
Change return value of a boolean function in arm library
I have an android library (arm cpu) that have a function named GetEisLinkWithDfr() that have a single line that returns boolean value of "true", and I want it to return a value of "...
- 11
1
vote
0
answers
156
views
How can I rename location in radare2?
In radare2 I would like to be able to rename a node in the graph view. I though setting a flag to the entry of the graph node would also change its title, but the address of the nodes still shows ...
- 11
1
vote
0
answers
109
views
radare2 stop on lazy loaded library (gdb's stop-on-solib-events)
I am running an application and would like to set a breakpoint, as soon as a relevant shared library is loaded. On gdb I can achieve it via
set stop-on-solib-events 1
I've been unable to find ...
- 11
1
vote
0
answers
114
views
Add indirect branch target reference manually (xref, crossreference) in Cutter (radare2)?
How can I create a reference for an indirect branch instruction
blx r0
so that the call to the address stored in r0 shows up in the graph?
I've tried flagging the target (function), but that does ...
- 111
1
vote
0
answers
683
views
Some obstacles in reversing a JNI Native library
I deleted my last question (it was not still answered and none's effort was wasted) as I got back and thought to re-read JNI documentation, to find I misinterpreted some bits. Things are now clearer
...
- 11
1
vote
0
answers
639
views
write radare2 output to a file
I am trying to write all the write logs of a binary program into a file for further analysis. I am using radare2 for it. I don't know what's the issue, I am not able to write the 'dte' output to a ...
- 111
1
vote
0
answers
760
views
Illegal instruction fault in stack based buffer overflow
I wrote this short C program to practice buffer overflow exploits:
#include <stdio.h>
#include <string.h>
#include <stddef.h>
#include <inttypes.h>
char *decode(char *s){
...
- 143
1
vote
0
answers
259
views
Password is right, but still wrong?
i am trying to find the password of a binary with radare2 - a crackme again :-)
I already thought I've found the password ('pass'), but this seems to be not the right one. Or there is a trick I didn'...
- 23
1
vote
0
answers
145
views
Techniques for reversing (basic) hash function
Hi I'm relatively new to RE, and I'm using GDB and Radare2. As part of a crackme I'm trying to reverse a weak hash function that's a little too complicated for me to undo by hand. I've been trying to ...
- 131
1
vote
0
answers
382
views
Radare2: pd command ignores cfg.bigendian setting
I am currently using radare2 to disassemble a raw ARM binary (bootloader) in little endian format. I used the command e cfg.bigendian = false to set the endianness, but the pd command seems to ignore ...
- 11
1
vote
0
answers
94
views
Can Radare2 emulate null pointer exceptions and others?
I'm wondering if anyone has had any luck with Radare2's configuration variables, esil.exectrap, esil.iotrap, and esil.nonull while emulating?
xor eax, eax
mov eax, dword [eax] <-
From what I can ...
- 133
1
vote
0
answers
1k
views
radare2 not showing function names
I'm using radare2 and I've noticed that it simply prints function offsets rather than function names.
I've done some tests and I've discovered that on Kali it prints offsets and on debian it prints ...
- 111
1
vote
1
answer
1k
views
ARM binary dissasembly, Hopper works, Ghidra and Radare2 don't for some functions
I'm disassembling a large ARM binary and I see that for some functions both Ghidra and Radare2 appear to fail to disassemble certain functions whereas Hopper works for those same functions
In Ghidra - ...
- 11
0
votes
0
answers
19
views
Searching for signal calls in a Mach-O multiarch binary
I'm searching for signals call in a Mach-O mutliarch using radare2. This is what I start with:
file sample
/tmp/sample (for architecture x86_64): Mach-O 64-bit executable x86_64
/tmp/sample (for ...
- 101
0
votes
0
answers
28
views
Is there any way to create alias/variable for memory-related value in Radare 2?
I wonder if it is possible in r2 to make alias for the value that repeats itself many times.
For instance:
I want to have an alias for rbp + rax - 0x1020 to be named as cwd[i].
Can it be done?
I ...
- 101
0
votes
0
answers
81
views
Radare2 is showing weird disassembly as compared to disassembly of gcc
Today i was playing around with c code in r2.
I compiled a file which had the following code.
#include <stdio.h>
int main(){
int a=9;
float b=1.1;
int sum;
sum = ...
- 45
0
votes
0
answers
160
views
Why won't Radare2 display main's paramethers of a 32bit ELF on a 64 bit machine?
I am new to reversing and currently trying to follow this tutorial, in which the binary provided was compiled on a 32 bit machine hence the file is a "ELF 32-bit LSB executable". It runs ...
- 103
0
votes
0
answers
64
views
"rabin2 -E" and "afll" no output for an exe file
$ rabin2 -I test.exe
arch x86
baddr 0x400000
binsz 3229424
bintype pe
bits 32
canary false
retguard false
class PE32
cmp.csum 0x0031d950
...
- 101
0
votes
0
answers
82
views
how do I use Remote Binary Protocol in cutter
how do I use Remote Binary Protocol I tried to connect to gdbserver through the normal method but it would just hang and not connect. I let it go like that for 1 hour
- 1
0
votes
0
answers
74
views
Radare2: Running executable from a specific point
I am using radare2 to reverse engineer a standard crackme executable. I have obtained the password, but now I need use the program to read & print a restricted file to which the executable has ...
0
votes
0
answers
102
views
No instruction in main function when debugging with winedbg
I'v try to debugging windows PE file under Linux.
winedbg --gdb --no-start a.exe ─╯
00bc:00c0: create process 'Z:\home\coolder\a.exe'/0x1106b8 @...
- 1
0
votes
0
answers
169
views
Anti-re tactics or radare problem while debugging
Here's the target application: https://www.sa-mp.com/download.php
While live debugging, the Windows application is starting a few threads, and Cutter auto breaks after entrypoint for a reason I'm not ...
- 101
0
votes
0
answers
306
views
exploiting a binary using ret2libc
I ran into this binary at a CTF :
https://github.com/auehc/AUCTF-2020/tree/master/Pwn/House%20of%20Madness
I first tried to exploit it and get a shell using ret2libc technique, however I didn't ...
- 1
0
votes
0
answers
182
views
Decompile in Radare for use in AVR studio, byte addressing vs word addressing
Hoping this has a simple answer...
I'm trying to use Radare2 to generate assembly code that later can be compiled in Avr studio 7. What I notice is that Radare (running pD) generates assembly code ...
- 1