Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [radare2]

Opensource reverse engineering framework to disassemble, debug, analyze, manipulate binary files and more.

14
votes
1answer
2k views

Debugging with radare2 using two terminals

I have been trying to figure this out for quite some time now, and would really need some help. Firstly, some intro: I am running the newest version of radare2 from Github on a 64bit Ubuntu 16.04 and ...
11
votes
2answers
2k views

Encrypted Mach-o binary cannot be disassembled/traced with GDB

I'm trying to analyze an encrypted Mach-O binary (non-iPhone one), and I am observing the following strange behaviors: when I load this binary into GDB and try to disassemble the code at the address ...
10
votes
1answer
2k views

What are the main features of radare2?

Radare2 is a framework for reverse-engineering gathering several tools (see this Phrack article about radare1 to know a bit more about the framework). I would like to know if someone could point out ...
10
votes
2answers
17k views

Find reference to string in radare2

In this crackme solution first the strings are found: $ rabin2 -z crackserial_linux addr=0x00000aa0 off=0x00000aa0 ordinal=000 sz=7 len=7 section=.rodata type=A string=User: addr=0x00000aa7 off=...
10
votes
1answer
452 views

How to write [sp+local_variable] in radare2

Hello I'm playing with my native android library, everything was going smoothly till now. I have problem with opcodes, i don't know how to tell radare2 to write str opcode with specifc registry, and ...
9
votes
2answers
7k views

How do you can you disassemble and dump an entire binary?

It's easy to seek to a particular function and dump it's contents as Assembly language. However, I cannot find an obvious way to immediately disassemble and dump an entire binary. I want to use it ...
9
votes
1answer
755 views

Split view radare2 print heap

I recently start to use radare2 and I have a question How can I print info about the heap with dmhb dmhf etc. while debugging ? I would like to have the heap informations on the right and the ...
8
votes
1answer
907 views

Radare2: inspecting renamed variables

I'm practicing with Radare2, latest commit. radare2 2.3.0-git 16814 @ linux-x86-64 git.2.2.0-5-g61a903315 During my sessions, I need to rename local variables to a more understandable name, e.g. ...
7
votes
2answers
1k views

what is radare2's equivalent to GDB's 'find &system,+9999999,“/bin/sh”'

What is radare2's equivalent to GDB's find &system,+9999999,"/bin/sh"?
7
votes
4answers
5k views

Radare2 (noob question) can't set breakpoint?

I was following this video: https://www.youtube.com/watch?v=3NTXFUxcKPc at the end it show how to do basic stuff with Radare2. When i try to set a break point with: db 0x004005bd where '0x004005bd' ...
7
votes
2answers
766 views

Radare2 Find command line arguments and location in stack

This might have a simple solution but I can't find it anywhere. $> ./be1 11 AAAAA With gdb, finding argv[] and argc is simple: (gdb) print argv[0]@argc $7 = {0xbffff872 "be1", 0xbffff89a "11", ...
7
votes
1answer
4k views

How to get a nice stack view in radare2?

This is the stack view that I'm getting in radare2 after entering the visual panel mode: This is the view from immunity debugger: How can I get a view similar to immunity debugger in radare2?
7
votes
1answer
5k views

Recursive traversal disassembling with Radare2?

I am trying the recursive traversal disassembler of the radare2 tool. But, I cannot use it properly. First, according to the radare2 manual, we can use recursive traversal disassembler by using the ...
7
votes
1answer
132 views

Radare2 Call $+5 and register-based cross-references not found

I have a library of ~65MB which uses this "technique" as a kind of PIC. First, it gets some kind of base address (it is always the same): 0x00708497 e800000000 call 0x70849c 0x0070849c ...
6
votes
1answer
2k views

How to make radare2 work for a large binary?

I compiled cpython with debugging headers and I want to perform the following analysis using radare2. The problem I encounter is that it takes forever (at least 27 hours) to perform the aaa (...
6
votes
1answer
4k views

How to find a symbol in a binary using radare2?

I want to find an address of a symbol (e.g strcpy) inside a binary using radare2. I tried to use the f command to list all flags which are recognized by r2 but the list is enormous and it's not ...
6
votes
1answer
631 views

What is the info displayed by radare2's afl?

I can't figure out what afl actually outputs. The docs are surprisingly uninformative. So, I've got address on the first column and symbol on the last. What is on the 2nd, 3rd and 4th columns? ...
6
votes
1answer
349 views

Viewing Radare keybindings for Visual Pane mode (Function hotkeys)?

Is there a way to view the keybinidngs inside of Radare? Such that I can see which function keys do things like Step Over and Step Into in Debug mode? e~key doesn't list any of the debug keys, key.S ...
6
votes
1answer
2k views

radare2 ascii graph to image?

After analysing a function and pressing VV to go into graph mode, is it somehow possible to export/render the whole graph to an image? I have some huge main functions and it would be nice to have it ...
5
votes
2answers
882 views

Writing ELF headers in Radare?

Reading Keith Makan's, "Introduction to the ELF Format : The ELF Header", he modifies e_entry, The e_entry field lists the offset in the file where the program should start executing.Normally it ...
5
votes
2answers
7k views

Radare2 C output

I made a simple hello world program, and put it in radare2. I then ran the pc command, which displayed C output. The output was this: #define _BUFFER_SIZE 256 const uint8_t buffer[256] = { 0x55, ...
5
votes
3answers
708 views

Any documentation available for r2 other than official book

I am interested in learning and using radare2 as a toolset for reverse engineering. But I want ANY other resource for learning this tools other than radare2 book, preferably a video series. What I am ...
5
votes
2answers
2k views

Method disassembly of Objective C Mach-O with Radare 2

Is is possible to retrieve the dissassembly of Objective-C methods declared in Mach-O files using Radare 2 ?
5
votes
1answer
489 views

Import symbols containing strange characters

I am analyzing a macOS app with radare2, and the app depends on a number of Qt frameworks. When I printed out the import symbols of the app's main executable, the names of the frameworks' functions ...
5
votes
2answers
2k views

Disassembly shows `LEA` with RIP?

When I disassemble this instruction using pad on Radare I get an LEA with rip [0x00000000]> pad 8d 15 c8 90 04 08 lea edx, [rip + 0x80490c8] I got this instruction from this post here I'm ...
5
votes
1answer
15k views

How to debug (like gdb) with radare2?

I am new to radare2 and Linux. I got problem with r2. As the title states it, many tutorials, articles, videos about r2 are just about disassembling programs, and read assembly codes. But, I want ...
5
votes
1answer
2k views

Radare2 forwarding input to scanf from a file

I'm debugging a file with radare2 and when I come to scanf function I want to forward input from a .txt file. In gdb I would do this by typing r < text.txt. Is something like that possible in ...
5
votes
2answers
226 views

Understanding branch delay slots for reversing MIPS

I am statically reversing some software compiled for an Atheros AR7161 using radare2. This processor implements MIPS, and I do recall that MIPS has a branch delay slot. This is indeed noticeable in ...
5
votes
1answer
6k views

Visual View in radare2 while debugging

I am using radare2 in debugging mode (r2 -d ./program). I set up a breakpoint at a certain address (db 0x12341234) And next I have entered Visual View using: V! Following some tutorials, I saw them ...
5
votes
1answer
909 views

How to add a function symbol to a stripped executable with radare2?

I am struggling with a stripped binary, and I would like to visualize the main() function with the VVV command (ascii-art CFG representation). Usually, the steps are the following: #> r2 ./...
5
votes
1answer
3k views

Disassembling an unknown DOS MZ executable using radare2

How do I specify to radare2 that what I'm disassembling when I know it is a DOS MZ executable? As it does not auto-detect this for me.
5
votes
1answer
384 views

Why do many imported functions jump to addresses that do not contain instructions?

I am learning to analyze binaries using radare2 and have been confused about what occurs within imported functions. In the binary below, titled Lab2B, I statically disassembled the binary and then ...
5
votes
1answer
163 views

How do I find out what section variables and strings are defined in?

Given a simple program like this, void main (int argc, char * argv[] ) { char * arr[] = {"foo", "bar", "baz"}; *(arr[0]) = 'F'; printf( "%s", arr[0] ); } How do I find out what section ...
5
votes
1answer
348 views

Difference between 'readelf' and 'radare2' addresses

I have an MIPS binary file that I want to analyze. I am having a little trouble understanding the way elfread and r2 interpret the adressing scheme from a binary. For example, r2 finds a function ...
5
votes
1answer
787 views

Radare2 doesn't display the whole function

I am using radare2, I have disassembled the function: sym.loop, it contains a switch witch has 4 cases that calls different functions. After any of the function call, the program exits the loop ...
4
votes
2answers
9k views

How to use radare2 to disassemble an executable file?

I have a cgywin executable file (shall be in PE format) and would like to disassemble it to get the assembly code on the text section using radare2, most of the examples disassemble per instruction ...
4
votes
1answer
3k views

Getting to the entry point using radare2

How do I get to the entry point of a .exe file using radare2? I tried using aa then pdf@sym.main, but a prompt showed saying "Cannot find function at 0x00000000"
4
votes
2answers
2k views

Debugging forked child in an anti-debug protected crackme

I am interested in the anti-debugging method implemented in the crackme called trace-p. A child process is forked, which communicates with the parent using int3 instructions. I would like to debug the ...
4
votes
1answer
3k views

How to reverse CGI file for MIPS?

I'm trying to load a CGI file to IDA in order to disassemble it and understand it's behaviour but I can't do it. According to the strings command I can see some interesting words like system, sprintf,...
4
votes
1answer
200 views

Heap Chunk Structure Does Not Contain Previous Section Info

I'm reading Shellcoder's Handbook to learn more about exploitation and overflows. I reached the chapter on Heap Overflows. The book mentions that a heap is split into chunks where each chunk contains ...
4
votes
3answers
174 views

Running just one function from an compiled executable or shared object?

Radare lets me view the assembly and pseudo-C code of a function. Can I run those instructions though outside of the process? Perhaps setting the register myself? If so, how would I go about doing ...
4
votes
2answers
648 views

radare2 get API library and name from address

When I disassemble a jmp I get: [0x004073d4]> pd 1 0x004073d4 ff2584804000 jmp dword [sym.imp.kernel32.dll_GetModuleHandleA] ; 0x408084 ; "j\x85" Is there a command I can get ...
4
votes
2answers
633 views

Disassembling at a memory address

I started to use radare2 to debug a PE file because it stops working as soon as I run it. When I attach my debugger and continue execution to the point where the exception is thrown I get a memory ...
4
votes
1answer
272 views

Is there a way to explicitly connect r2pipe to an existing radare2 session that I have open?

I understand that I can execute my script within a session using [0x401000]> . server.py and the pipe will be connected to it when I call r2pipe.open() with no arguments. Ideally I would like to ...
4
votes
2answers
151 views

Avatao R3v3rs3 2

I found this platform and its course path into Reverse Engineering. Although very easy (at first) I'm kinda stuck in this binary n.2. Binary looks pretty easy and straightforward, but I can't figure ...
4
votes
1answer
676 views

Changing code to data in radare2

I really like radare2 and I am trying to follow a tutorial in which some code is changed to data. The tutorial uses IDA, I have tryed this with radare2. I entered visual mode by pressing V and cursor ...
4
votes
1answer
41 views

How do I type in hex input into radare2 debug mode?

#include<stdio.h> #include<stdlib.h> int main() { puts("Enter input: "); char buf[100]; fgets(buf, 100, stdin); printf("%s", buf); } Suppose I am debugging a program, such ...
4
votes
1answer
333 views

What is an SDB file?

In the abstract, I'm just wondering what an SDB file does and what role it plays. I see Radare2 is using them.. Here are some of the SDB files I have under ./libr/bin/d/dll/, what do these do? ./libr/...
4
votes
1answer
386 views

Radare2 and Boomerang

I found this post stating that Radare can work with Boomerang. However when I try do exactly as they say, I get the following error: sh: 1: rsc: not found. From what I can see, rsc is an extra ...
4
votes
1answer
389 views

Radare2- How to see stdout in Visual Mode

I'm new to radare2 and reverse engineering, and I can't see to see to figure out how to display any standard write in display mode. For example if I run 'dc' command it runs the program normally and ...