Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [radare2]

Opensource reverse engineering framework to disassemble, debug, analyze, manipulate binary files and more.

0
votes
2answers
116 views

Debugging a process running in a Virtual Machine with Radare2?

Is there anyway to debug a process running on a Virtual Machine (guest) with Radare2 from the host? I'm currently using VirtualBox. It provides a built in debugger. I'm not sure if it's possible for ...
7
votes
1answer
112 views

Radare2 Call $+5 and register-based cross-references not found

I have a library of ~65MB which uses this "technique" as a kind of PIC. First, it gets some kind of base address (it is always the same): 0x00708497 e800000000 call 0x70849c 0x0070849c ...
1
vote
1answer
61 views

Setting register names in Radare2

I am reverse-engineering an 8051 architecture program of a specific chip. The disassembly naturally doesn't contain any function names, and the register names are minimal. For example, address 0xb3 is ...
1
vote
1answer
47 views

Radare2 doesn't update current address, when single-step debugging using `ds`?

Radare2 doesn't update current address, when single-step debugging using ds? I'm debugging an ELF binary on Linux using single-step (ds). The problem is that the current address at the prompt doesn't ...
0
votes
1answer
35 views

how to use core file in radare2?

In gdb i can backtrace with core file and executable file. It seems radare2 can read core file. like this $ r2 core Setting up coredump: asm.arch <-> x86 and asm.bits <-> 64 Setting up ...
0
votes
1answer
153 views

ELF binary corrupted after adding instruction in non-executable section

I've been messing around a little with Radare2 trying to master binary exploitation and patching. I added a couple of assembly instructions to an x86 elf binary in a non-executable section of the file,...
-1
votes
1answer
236 views

Practicing what SHOULD be a simple crackme. Program calls strlen() but never returns

I'm trying out a crackme from the "LSE CTF" called "Blue Box" worth only 10 points. I've attempted this inside GDB and radare2... It is very simple, takes one argument and first checks to make sure ...
4
votes
0answers
142 views

Comparing two UEFI applications?

I have two x86-64 UEFI applications original.efi and patched.efi. I want to find out what have been changed in patched.efi and what these changes do. I have tried to use the Radare2 framework to ...
3
votes
0answers
46 views

radare2 difference between function offset and minbound

I am trying to understand the difference between a function's offset and its minbound in radare2. Consider this function in radare2 (output of aflj): { "offset": 4549740, "name": "...
3
votes
0answers
118 views

Radare2 - How to save/restore metadata in debug session (BPs, flag, comments..)?

How can i save/reuse/preserve Radare2 metadata (BPs, comments, flags..) of a debug session for a new debug session? I restart the debugger alot and preserving environment would be very helpful. I ...
2
votes
0answers
131 views

How to save Radare2 Analysis?

How do I save a radare2 session after I did "aa"? I know there is a command for saving a project, but this isn't working out for some reason (Ps PROJECTNAME). So I am looking for a way to save my ...
2
votes
0answers
54 views

Understanding ESIL

I cross-compiled a simple program with the aarch-linux-gnu-gcc compiler for ARM. So the machine is "ARM aarch64". I want to understand a single instruction and it's realization in ESIL. The opcode of ...
2
votes
0answers
67 views

Cannot open '/proc/…/maps': No such file or directory in radare2 debug mode

When I try to load a program to radare2 debug mode, most of the time I get the following error: $sudo r2 -d a.out Hello world!= attach 2851 2851 Cannot open '/proc/2851/maps': No such file or ...
2
votes
0answers
208 views

Radare2 project opening

When I open a project r2 -p mypoject I get a bunch of errors with some numbers: 0 0 Cannot add reference to non-function Cannot add reference to non-function 1482 I use latest version of radare2 ...
2
votes
0answers
71 views

radare2 specifying bitfield or enum width

I'm using radare2 to deconstruct a binary blob. When defining bit-field value there seems to be no syntax to specify the width of the field that contains the enum. For instance with a C structure as ...
2
votes
0answers
132 views

Radare2 - recursive traversal visual mode

I know that both pdf @ func and pdr @ func disassemble the function, the first using linear and the second recursive traversal disassembly. VV @ func shows the disassembled function in visual mode, ...
1
vote
0answers
79 views

Password is right, but still wrong?

i am trying to find the password of a binary with radare2 - a crackme again :-) I already thought I've found the password ('pass'), but this seems to be not the right one. Or there is a trick I didn'...
1
vote
0answers
68 views

Techniques for reversing (basic) hash function

Hi I'm relatively new to RE, and I'm using GDB and Radare2. As part of a crackme I'm trying to reverse a weak hash function that's a little too complicated for me to undo by hand. I've been trying to ...
1
vote
0answers
31 views

Radare2: pd command ignores cfg.bigendian setting

I am currently using radare2 to disassemble a raw ARM binary (bootloader) in little endian format. I used the command e cfg.bigendian = false to set the endianness, but the pd command seems to ignore ...
1
vote
0answers
54 views

Can Radare2 emulate null pointer exceptions and others?

I'm wondering if anyone has had any luck with Radare2's configuration variables, esil.exectrap, esil.iotrap, and esil.nonull while emulating? xor eax, eax mov eax, dword [eax] <- From what I can ...
1
vote
0answers
202 views

radare2 not showing function names

I'm using radare2 and I've noticed that it simply prints function offsets rather than function names. I've done some tests and I've discovered that on Kali it prints offsets and on debian it prints ...
0
votes
0answers
48 views

Does Radare offer the ability to invoke the linker and disassemble a function (import or reloc)?

Sometimes I'm doing static analysis outside of the debugger, and I want to see what a function that a symbol points to will do after the linker does runtime relocation. All I see in the disassembly is ...
0
votes
0answers
42 views

Radare -Q leaking, and does it even matter?

As a follow up to a self-answered question where I discovered -q and -Q Radare -Q is documented as, -Q quiet mode (no prompt) and quit faster (quickLeak=true) man radare2 shows, -Q Same as -q, ...
0
votes
0answers
74 views

Rarun2 Multiple Input Executable

After further analysis of a binary, ran into a separate issue debugging. Have an r2pipe script successfully providing 1 input (more about r2pipe in this solved question: r2pipe won't prompt for ...
-1
votes
0answers
25 views

Is the inability to run an application after the editing of a Mach O library due to improper editing or of a verification mismatch?

So there is an application (Audio Hijack specifically) that I am trying to edit after having downloaded it, and it (obviously) only includes the compiled code. This includes a Mach-O 64-bit ...
-1
votes
0answers
29 views

Try to pass an argument a no printable characters in debug mode on radare2

I have a program and I like to know if the assigment of a value is correct, but when I try to run in debug mode and with an argument it sends this error: $ r2 -d ./col "`python -c "print '\x41'*16+'\...
-1
votes
0answers
116 views

Pass Signal to debugee in Radare2

Does anybody know how to something similar to GDB's handle SIGTRAP pass to pass a signal to the process that is being debugged? The only thing I found was dko <signal> [|skip|cont] // On ...
-1
votes
0answers
836 views

Radare2 function arguments

Is there any way for radare2 to display the argument types a function accepts similarly to IDA? For example IDA displays the argument types next to the function name as a hint when there is a call ...