Questions tagged [radare2]

Opensource reverse engineering framework to disassemble, debug, analyze, manipulate binary files and more.

Filter by
Sorted by
Tagged with
5
votes
2answers
2k views

How to add a function symbol to a stripped executable with radare2?

I am struggling with a stripped binary, and I would like to visualize the main() function with the VVV command (ascii-art CFG representation). Usually, the steps are the following: #> r2 ./...
0
votes
1answer
626 views

how to use core file in radare2?

In gdb i can backtrace with core file and executable file. It seems radare2 can read core file. like this $ r2 core Setting up coredump: asm.arch <-> x86 and asm.bits <-> 64 Setting up ...
1
vote
0answers
21 views

How can I rename location in radare2?

In radare2 I would like to be able to rename a node in the graph view. I though setting a flag to the entry of the graph node would also change its title, but the address of the nodes still shows ...
1
vote
1answer
59 views

radare2 - radare2 doesn't display string value

I have some rare cases with radare2. when I try to display all string using "iz" it does the job. but when I do "pdf" or "pd" I can't see actual value of string: I see ...
0
votes
1answer
85 views

radare2 memory changing in debug mode

I have tiny program: 0x08048080 66a1a0900408 mov ax, word loc.name 0x08048086 66bbafbe mov bx, 0xbeaf 0x0804808a 66891da09004. mov word loc.name,...
0
votes
0answers
27 views

Radare2: Running executable from a specific point

I am using radare2 to reverse engineer a standard crackme executable. I have obtained the password, but now I need use the program to read & print a restricted file to which the executable has ...
0
votes
1answer
33 views

How does radare2 create its memory layout?

Firstly Hello, this is my first post on this forum even though im reading alot here. Im trying to get into reversing and Low-Level stuff in general lately, and im a bit stuck right here. I did read ...
0
votes
1answer
252 views

Symbolic simplifications in radare2

Let's have a look to this assembly code in radare2: xxxxxxx mov rax,rbx xxxxxxx add rax,rax xxxxxxx add rax,rbx xxxxxxx shl rax,2 yyyyyyy nop Is there a way to ask radare2 to evaluate rax value ...
12
votes
2answers
25k views

Find reference to string in radare2

In this crackme solution first the strings are found: $ rabin2 -z crackserial_linux addr=0x00000aa0 off=0x00000aa0 ordinal=000 sz=7 len=7 section=.rodata type=A string=User: addr=0x00000aa7 off=...
2
votes
1answer
54 views

How i can do several input via rarun2?

How can i do several input via rarun2, if my program requares two input? I try this:
0
votes
0answers
16 views

How can I have an interactive r2pipe session?

I am trying to make an interactive tutorial. It uses radare2 with r2pipe as its reverse engineering toolkit. I want my users to be able to use the visual mode through r2pipe. In order for the visual ...
0
votes
1answer
27 views

Running radare command on each line of the output of another command

Say, I have a command in radare which produces multiple input, say afl. I can run it and extract many addresses: [0x5579ca2e2196]> afl~[0] 0x5579ca2e2060 0x5579ca2e4fe0 0x5579ca2e2090 ...
0
votes
0answers
24 views

No instruction in main function when debugging with winedbg

I'v try to debugging windows PE file under Linux. winedbg --gdb --no-start a.exe ─╯ 00bc:00c0: create process 'Z:\home\coolder\a.exe'/0x1106b8 @...
1
vote
1answer
83 views

How to set search scope in radare2

Iam wondering how to change search scope in radare2. I`ve made some research and set variables search.from and search.to, according to Radare2 Book, but it doesn't work at all! Could you help me ...
2
votes
1answer
109 views

What is actually loaded here and different hexdump outputs on util-linux hexdump and on cutter and ghidra's hexdump

I was trying to understand what segment of file gets loaded by fourth LOAD header on phdr array. First 6 headers are shown below from readelf Program Headers: Type Offset ...
1
vote
1answer
39 views

Using angr/radare2 to estimate values given chunks of assembly

I'm currently using radare2 in order to construct a simple CFG, each block/node in that graph is composed of one or more assembly instructions, I wish to estimate the value of specific register or ...
0
votes
1answer
78 views

Reference address by name in Radare2/Cutter

I have some experience with IDA and now I'm trying to use Radare2/Cutter the same way. I disassemble a DOS MZ file. I have the following: ;-- section.seg_000: 12: entry0 (); 0000:0000 push ds ...
1
vote
1answer
48 views

Finding mapped memory page flags in Radare2

I have a memory dump of notepad.exe. Radare's iS to print sections gives me the mapped files (executable and it's dll's) as well as the many sections simply marked 'Memory_Section', which from what I ...
3
votes
1answer
116 views

Radare2 - what does dot mean in disassembly

I've just started using radare2 and I've noticed a dot when I tried to disassamble one on my programs. The output is: 0x00000000 48b841000000. movabs rax, 0x41 I understand that 0x48 is the REX ...
1
vote
1answer
68 views

How to find DOS Header and PE Header with an entry point in Radare2?

I am currently doing byte extraction from PE files using Radare2. I know how to find the byte sequence for Dos Header and PE Header when there is no entry point and the start is defaulted to 0x0. But ...
0
votes
1answer
111 views

Getting radare2 to load z80 binaries properly

I'm trying to disassemble some Sega Master System roms. In order to do so, I've checked for the extra 512 bytes from old roms and once I was sure they weren't there, I proceeded to run radare2 on one ...
1
vote
2answers
4k views

Editing memory in radare2

It sounds like a stupid question but I honestly can't find the answer... I've looked at https://radare.gitbooks.io/radare2book/content/ and googled for hours but it still eludes me. How do I modify ...
3
votes
2answers
124 views

Get certain instruction count for multi-architecture binaries

I need to get an ELF binary's total count of Function call instruction conditional jump (branch) instruction The binary could be any CPU architecture, like x64, ARM, MIPS, Motorola 68K, etc. It ...
0
votes
1answer
34 views

How do I use vi keybindings at the command line in Radare2?

The Radare2 command line (I believe it's called "interactive mode"?) allows bringing back history and editing it with the arrow keys. However, I prefer to use vi/vim keybindings for this. How do I ...
1
vote
1answer
498 views

Renaming variables radare2

I have a variable called var_14h in disassemble code. I want to rename this variable. I try to rename the variable by using the following afvn var_14h i However, radare complains and returns an ...
0
votes
2answers
2k views

How can i start the RE process in radare2?(make changes to the registers) [closed]

I'm an absolute newbie to reverse engineering. I have a 32bit lsb arm binary which I would like to reverse engineer using radare2. How should I begin ?
3
votes
1answer
366 views

Radare2 - How to debug Android native code (dynamic analysis)?

I'm using Termux(root) on LineageOS 16 (Android 9) with radare2 (v3.6.0 linux-arm32). When i attach to a process with 'r2 -d pid' the app freezes properly but doesn't continue with 'dc'. I'm not sure ...
1
vote
1answer
45 views

Results of radare2 are not correct

I am using radare2 to analyze libpng_amd64.so.1.6.34, commands are as follows: r2 = r2pipe.open(binary_file) r2.cmd('aaa') funcs = r2.cmdj('aflj') len(funcs) is 461, but the number of functions got ...
1
vote
1answer
230 views

Way to get all the function prototype using Ghidra

I have been trying to extract the function prototypes from a binary file using Ghidra. Up till now what I have done was to use Ghidra's included "Decompile" script and filtered out the function ...
5
votes
0answers
131 views

Radare2 8051 code bank switching

Some of 8051 chips use bank switching to extend accessible code memory. Good example is Silabs C8051F12x. Another example is here. Code area in range 0x0000..0x7ffff is common always accessible code ...
0
votes
0answers
15 views

Why does `omb` sometimes not work in Radare2

I'm a little confused about the behaviour of the omb command in Radare2. Sometimes when I give it what I believe is a valid segment number and offset, it doesn't change it. (This is usually after I ...
1
vote
2answers
46 views

How can I change the default input radix to hexadecimal in Radare2?

Frequently when I use Radare2 I work mostly in hexadecimal. This means I'm constantly having to remember to type 0x in front of addresses, which is different from the machine-language monitors I'm ...
0
votes
1answer
70 views

Why there are only 8 hexa memory digits while my RAM is 16G

I'm totally new to reverse engineering, when I start debugging my c program with radare2, and start showing assembly, I found that addresses are only 8 hexa digits, which means 16^8 = 4294967296 ...
2
votes
1answer
78 views

Modify value to pass jump and print a message with Radare2

I have a problem with understanding, why after modifying variable var_4h and passing positively through jne at 0x000006c3 I still cannot see the message. I use radare2 In debug mode, just before cmp ...
0
votes
2answers
117 views

asm snippet to pseudo-code

I'm looking into a way to generate pseudo-code from snippet of assembly, let's assume I have this ASM push rbp mov rbp, rsp mov DWORD PTR [rbp-4], edi mov DWORD PTR [...
1
vote
1answer
45 views

text_mn in Radare2 --> Meaning?

I compiled some source code and extracted functions with Radare2 (afj). Often I get a function with "sym..text_mn" function name/ symbol. The other functions are named correctly. What does this ...
1
vote
0answers
38 views

radare2 stop on lazy loaded library (gdb's stop-on-solib-events)

I am running an application and would like to set a breakpoint, as soon as a relevant shared library is loaded. On gdb I can achieve it via set stop-on-solib-events 1 I've been unable to find ...
3
votes
2answers
257 views

Function prototypes given by Ghidra is not consistent

This is a follow up question to the question I posted over here. According to the answer, I was able to get all the function prototypes from the binary. However, the problem I am having is most of the ...
1
vote
1answer
91 views

Is `movq rax, xmm0` buggy in Radare2?

Why doesn't rax get loaded from xmm0 here? radare2 bug? GitHub issue `movq rax, xmm0` doesn't work in native debugger filed. [0x0003b0e0]> drr role reg value ref ―――――――――――――――――――...
0
votes
1answer
50 views

How to detect which shared libraries a binary is actually using?

I have a stripped-down Linux-based embedded system where a closed-source program(32-bit ELF binary for MIPS) depends on several shared libraries. Two of those libraries are actually the same libcurl ...
0
votes
0answers
44 views

How can I define an int array in Radare2?

I'm disassembling a C written binary using radare2: The block of code im looking into corresponds to this one int num[5]; int sum; num[0] = 200; num[1] = 150;...
0
votes
0answers
37 views

radare2 set data type at address

I've been using Ghidra a lot recently and have developed a nice workflow, but I'm trying to get back into r2. I'm wondering if there's a way to set the data type at a given address. For example, when ...
0
votes
1answer
69 views

Replace string in hexa with a longer one in .bin without destroying the structure (in .data)

I would like to replace some hard-coded strings in a compiled exe (in .data) which is in chinese (with no possibility to put it in other languages). I managed to replace strings in hexadecimal with ...
-1
votes
1answer
59 views

What does std::string::oprator__unsigned_long do?

I am new to reverse c++ program. I met this code from r2 decompilation. pcVar6 = (char *)sym.imp.std::string::operator___unsigned_long (&...
0
votes
0answers
87 views

Anti-re tactics or radare problem while debugging

Here's the target application: https://www.sa-mp.com/download.php While live debugging, the Windows application is starting a few threads, and Cutter auto breaks after entrypoint for a reason I'm not ...
0
votes
0answers
50 views

exploiting a binary using ret2libc

I ran into this binary at a CTF : https://github.com/auehc/AUCTF-2020/tree/master/Pwn/House%20of%20Madness I first tried to exploit it and get a shell using ret2libc technique, however I didn't ...
0
votes
3answers
317 views

Reverse engineer .so file from android app with radare2

I have a .so file from an android app, and I know how to list all functions in IDA Pro. How can I do this with radare2?
0
votes
0answers
44 views

Decompile in Radare for use in AVR studio, byte addressing vs word addressing

Hoping this has a simple answer... I'm trying to use Radare2 to generate assembly code that later can be compiled in Avr studio 7. What I notice is that Radare (running pD) generates assembly code ...
1
vote
1answer
35 views

Command “f?flagname” doesn't work as expected in radare2

PS C:\_> r2 -v radare2 4.3.1 6 @ windows-x86-64 git.4.3.1 commit: 54ac837b5503f10f91e2069ac357791f7a3e635a build: Fri 03/06/2020__15:52:24.93 PS C:\_> r2 -- -- 99 bugs, take one down pass it ...
0
votes
1answer
40 views

Start radare2 with pre-set visual mode configuration

This is the way I like to RE with radare visual mode. But I have to configure it everytime I start r2. How can I make it so r2 starts with this visual everytime I enter visual mode?

1
2 3 4 5 6