Questions tagged [radare2]

Opensource reverse engineering framework to disassemble, debug, analyze, manipulate binary files and more.

38 questions with no upvoted or accepted answers
Filter by
Sorted by
Tagged with
7
votes
1answer
157 views

Radare2 Call $+5 and register-based cross-references not found

I have a library of ~65MB which uses this "technique" as a kind of PIC. First, it gets some kind of base address (it is always the same): 0x00708497 e800000000 call 0x70849c 0x0070849c ...
4
votes
0answers
219 views

Radare2 - How to save/restore metadata in debug session (BPs, flag, comments..)?

How can i save/reuse/preserve Radare2 metadata (BPs, comments, flags..) of a debug session for a new debug session? I restart the debugger alot and preserving environment would be very helpful. I ...
4
votes
0answers
280 views

Radare2 project opening

When I open a project r2 -p mypoject I get a bunch of errors with some numbers: 0 0 Cannot add reference to non-function Cannot add reference to non-function 1482 I use latest version of radare2 ...
3
votes
2answers
71 views

Get certain instruction count for multi-architecture binaries

I need to get an ELF binary's total count of Function call instruction conditional jump (branch) instruction The binary could be any CPU architecture, like x64, ARM, MIPS, Motorola 68K, etc. It ...
3
votes
0answers
125 views

How to do debug a running java process in linux?

TLDR I want to do live debugging of a java program on a linux machine, and don't how/what debugger to attach to the JVM to get this done. I expect that this is a well-solved problem, but I lack the ...
3
votes
1answer
140 views

function call trace with radare2 or break on all function call

I want to script with python using r2pipe. Is there a way that when debugging I can break on each call function, thus I can get the parameter? What's more, I won't jump into system library. Or is ...
3
votes
0answers
106 views

radare2 difference between function offset and minbound

I am trying to understand the difference between a function's offset and its minbound in radare2. Consider this function in radare2 (output of aflj): { "offset": 4549740, "name": "...
3
votes
0answers
167 views

Comparing two UEFI applications?

I have two x86-64 UEFI applications original.efi and patched.efi. I want to find out what have been changed in patched.efi and what these changes do. I have tried to use the Radare2 framework to ...
2
votes
0answers
26 views

How i can do several input via rarun2?

How can i do several input via rarun2, if my program requares two input? I try this:
2
votes
0answers
59 views

Radare2 - How to debug Android native code (dynamic analysis)?

I'm using Termux(root) on LineageOS 16 (Android 9) with radare2 (v3.6.0 linux-arm32). When i attach to a process with 'r2 -d pid' the app freezes properly but doesn't continue with 'dc'. I'm not sure ...
2
votes
1answer
54 views

What is actually loaded here and different hexdump outputs on util-linux hexdump and on cutter and ghidra's hexdump

I was trying to understand what segment of file gets loaded by fourth LOAD header on phdr array. First 6 headers are shown below from readelf Program Headers: Type Offset ...
2
votes
0answers
59 views

radare2 wrong output

I saw rasm2 giving different output each time for x64 Take a look at this: C:\WINDOWS\system32>rasm2 -a x86 -b 64 -d "41f6c7FF" test r15b, 0xff C:\WINDOWS\system32>rasm2 -a x86 -b 64 "test ...
2
votes
2answers
144 views

Radare2 doesn't update current address, when single-step debugging using `ds`?

Radare2 doesn't update current address, when single-step debugging using ds? I'm debugging an ELF binary on Linux using single-step (ds). The problem is that the current address at the prompt doesn't ...
2
votes
0answers
481 views

How to save Radare2 Analysis?

How do I save a radare2 session after I did "aa"? I know there is a command for saving a project, but this isn't working out for some reason (Ps PROJECTNAME). So I am looking for a way to save my ...
2
votes
0answers
72 views

Understanding ESIL

I cross-compiled a simple program with the aarch-linux-gnu-gcc compiler for ARM. So the machine is "ARM aarch64". I want to understand a single instruction and it's realization in ESIL. The opcode of ...
2
votes
1answer
230 views

Cannot open '/proc/…/maps': No such file or directory in radare2 debug mode

When I try to load a program to radare2 debug mode, most of the time I get the following error: $sudo r2 -d a.out Hello world!= attach 2851 2851 Cannot open '/proc/2851/maps': No such file or ...
2
votes
0answers
82 views

radare2 specifying bitfield or enum width

I'm using radare2 to deconstruct a binary blob. When defining bit-field value there seems to be no syntax to specify the width of the field that contains the enum. For instance with a C structure as ...
2
votes
0answers
158 views

Radare2 - recursive traversal visual mode

I know that both pdf @ func and pdr @ func disassemble the function, the first using linear and the second recursive traversal disassembly. VV @ func shows the disassembled function in visual mode, ...
1
vote
1answer
33 views

How to set search scope in radare2

Iam wondering how to change search scope in radare2. I`ve made some research and set variables search.from and search.to, according to Radare2 Book, but it doesn't work at all! Could you help me ...
1
vote
0answers
62 views

write radare2 output to a file

I am trying to write all the write logs of a binary program into a file for further analysis. I am using radare2 for it. I don't know what's the issue, I am not able to write the 'dte' output to a ...
1
vote
0answers
190 views

Illegal instruction fault in stack based buffer overflow

I wrote this short C program to practice buffer overflow exploits: #include <stdio.h> #include <string.h> #include <stddef.h> #include <inttypes.h> char *decode(char *s){ ...
1
vote
1answer
110 views

How to use aaa in radare2 while in -d (debug) mode?

This might be a stupid question, but I am trying to learn by myself and I encountered a problem which I cannot solve for the life of me. I tried googling and I can't find anything relevant, so here ...
1
vote
0answers
121 views

Password is right, but still wrong?

i am trying to find the password of a binary with radare2 - a crackme again :-) I already thought I've found the password ('pass'), but this seems to be not the right one. Or there is a trick I didn'...
1
vote
1answer
135 views

Setting register names in Radare2

I am reverse-engineering an 8051 architecture program of a specific chip. The disassembly naturally doesn't contain any function names, and the register names are minimal. For example, address 0xb3 is ...
1
vote
0answers
97 views

Techniques for reversing (basic) hash function

Hi I'm relatively new to RE, and I'm using GDB and Radare2. As part of a crackme I'm trying to reverse a weak hash function that's a little too complicated for me to undo by hand. I've been trying to ...
1
vote
0answers
70 views

Radare2: pd command ignores cfg.bigendian setting

I am currently using radare2 to disassemble a raw ARM binary (bootloader) in little endian format. I used the command e cfg.bigendian = false to set the endianness, but the pd command seems to ignore ...
1
vote
0answers
72 views

Can Radare2 emulate null pointer exceptions and others?

I'm wondering if anyone has had any luck with Radare2's configuration variables, esil.exectrap, esil.iotrap, and esil.nonull while emulating? xor eax, eax mov eax, dword [eax] <- From what I can ...
1
vote
0answers
381 views

radare2 not showing function names

I'm using radare2 and I've noticed that it simply prints function offsets rather than function names. I've done some tests and I've discovered that on Kali it prints offsets and on debian it prints ...
0
votes
0answers
48 views

Radare2 not showing memory value correctly

I am debugging a bootloader running on QEMU i386. The issue is the red value of 0x6069 shown as zero. In reality the value is the same as register al (non zero value) and the following je happens. ...
0
votes
1answer
36 views

radare2 memory changing in debug mode

I have tiny program: 0x08048080 66a1a0900408 mov ax, word loc.name 0x08048086 66bbafbe mov bx, 0xbeaf 0x0804808a 66891da09004. mov word loc.name,...
0
votes
1answer
63 views

Radare complains, “fatal error: r_cons.h: No such file or directory”

When I try to run r2pm install r2-dec, I get. duktape/duk_console.c:13:10: fatal error: r_cons.h: No such file or directory #include <r_cons.h> ^~~~~~~~~~ compilation terminated.
0
votes
0answers
90 views

Differences between IDA Pro and Radare2

I am familiar with Hopper Disassembler and OllyDbg as favorite and simple tools, but I would like to try switching to IDA to work on Windows. However, I know about radare2 and that it is open source,...
0
votes
0answers
37 views

radare2 (v3.6.0) on windows(x64) not change registers values in debug mode

Whats wrong: d:\radare2\bin\radare2 -A -d d:\test.exe Spawned new process with pid 7192, tid = 8572 ... [0x014eb83c]> pd 5 ┌ (fcn) entry0 2066 │ entry0 (); │ bp: 0 (vars 0, args 0) │ sp: 0 (...
0
votes
0answers
57 views

How to debug programs that load from another one? with radare2/gdb

I'm reversing engendering a plugin. This plugin is loaded into memory by the main program. I disassemble the plugin with radare2 but I don't know how to debug it. I try with gdb but same problem. I ...
0
votes
1answer
249 views

how to use core file in radare2?

In gdb i can backtrace with core file and executable file. It seems radare2 can read core file. like this $ r2 core Setting up coredump: asm.arch <-> x86 and asm.bits <-> 64 Setting up ...
0
votes
0answers
112 views

Does Radare offer the ability to invoke the linker and disassemble a function (import or reloc)?

Sometimes I'm doing static analysis outside of the debugger, and I want to see what a function that a symbol points to will do after the linker does runtime relocation. All I see in the disassembly is ...
0
votes
0answers
49 views

Radare -Q leaking, and does it even matter?

As a follow up to a self-answered question where I discovered -q and -Q Radare -Q is documented as, -Q quiet mode (no prompt) and quit faster (quickLeak=true) man radare2 shows, -Q Same as -q, ...
-1
votes
1answer
287 views

Practicing what SHOULD be a simple crackme. Program calls strlen() but never returns

I'm trying out a crackme from the "LSE CTF" called "Blue Box" worth only 10 points. I've attempted this inside GDB and radare2... It is very simple, takes one argument and first checks to make sure ...