Questions tagged [radare2]

Opensource reverse engineering framework to disassemble, debug, analyze, manipulate binary files and more.

Filter by
Sorted by
Tagged with
0
votes
0answers
30 views

r2 impractical? [closed]

At what point does r2 become subjectively impractical to most non-humans? I've found it practical for even larger programs.
0
votes
1answer
39 views

Golang program reversing with Radare2

I'm trying to understand how to reverse golang programs with radare2. In order to practice, i create a minimal program in Go: package main import "fmt" func main() { fmt.Println("...
0
votes
1answer
70 views

How do I use vi keybindings at the command line in Radare2?

The Radare2 command line (I believe it's called "interactive mode"?) allows bringing back history and editing it with the arrow keys. However, I prefer to use vi/vim keybindings for this. How do I ...
1
vote
1answer
800 views

Renaming variables radare2

I have a variable called var_14h in disassemble code. I want to rename this variable. I try to rename the variable by using the following afvn var_14h i However, radare complains and returns an ...
1
vote
1answer
755 views

how to use core file in radare2?

In gdb i can backtrace with core file and executable file. It seems radare2 can read core file. like this $ r2 core Setting up coredump: asm.arch <-> x86 and asm.bits <-> 64 Setting up ...
0
votes
0answers
16 views

radare2 can't see error/signal messages

I'm in visual mode on the debug screen. I'm stepping through some function code with the 'F7' shortcut key, when I hit a part of the code that yields an error or some kind of message, the message text ...
0
votes
1answer
106 views

radare2 memory changing in debug mode

I have tiny program: 0x08048080 66a1a0900408 mov ax, word loc.name 0x08048086 66bbafbe mov bx, 0xbeaf 0x0804808a 66891da09004. mov word loc.name,...
0
votes
0answers
29 views

Control flow graph of entire binary file

Is it possible to get the control flow graph of the entire binary file using any disassembler? IDA Pro generates the CFG for each function. Can we use it to get the CFG of the entire program?
0
votes
1answer
294 views

Symbolic simplifications in radare2

Let's have a look to this assembly code in radare2: xxxxxxx mov rax,rbx xxxxxxx add rax,rax xxxxxxx add rax,rbx xxxxxxx shl rax,2 yyyyyyy nop Is there a way to ask radare2 to evaluate rax value ...
2
votes
1answer
51 views

Can't modify string in radare2 (.rodata section)

I was following the response to this question to change the string of an elf executable. No matter how many times I try, I just can't modify the string. I notice that probably the issue lies in the ...
0
votes
1answer
92 views

main function not found in GCC compiled code

I'm trying to learn reverse engineering using Radare2. For this I compiled a hello world program with GCC on Ubuntu (version: gcc (Ubuntu 9.3.0-17ubuntu1~20.04) 9.3.0). #include <stdio.h> int ...
2
votes
1answer
68 views

How i can do several input via rarun2?

How can i do several input via rarun2, if my program requares two input? I try this:
0
votes
0answers
23 views

“rabin2 -E” and “afll” no output for an exe file

$ rabin2 -I test.exe arch x86 baddr 0x400000 binsz 3229424 bintype pe bits 32 canary false retguard false class PE32 cmp.csum 0x0031d950 ...
-1
votes
1answer
333 views

Practicing what SHOULD be a simple crackme. Program calls strlen() but never returns

I'm trying out a crackme from the "LSE CTF" called "Blue Box" worth only 10 points. I've attempted this inside GDB and radare2... It is very simple, takes one argument and first checks to make sure ...
4
votes
1answer
151 views

Ghidra + IDA cant detect a string but Radare2 can

Im new to reverse engineering, and ive trying Ghidra, IDA (Freeware) and Radare2 with a simple CrackMe, the problem is, both Ghidra and IDA couldnt detect a string while Radare2 (Using Cutter GUI) ...
0
votes
1answer
45 views

Getting memory address of particular bytes in radare2

in pwnlib there is a possibility to search for particular bytes, e.g. as follows for 0x66 byte: print(next(p.elf.search(b'f'))) which in turn results in the following output: 4195268 Having this ...
0
votes
1answer
115 views

Crackme assistance - change input of a function

Just as a preface, this is a crackme from https://hack.ainfosec.com/. I know you can submit these as part of a job app, I have no intentions of doing that. Very happy to have a job in a related, but ...
1
vote
1answer
98 views

How to set search scope in radare2

Iam wondering how to change search scope in radare2. I`ve made some research and set variables search.from and search.to, according to Radare2 Book, but it doesn't work at all! Could you help me ...
2
votes
1answer
125 views

What is actually loaded here and different hexdump outputs on util-linux hexdump and on cutter and ghidra's hexdump

I was trying to understand what segment of file gets loaded by fourth LOAD header on phdr array. First 6 headers are shown below from readelf Program Headers: Type Offset ...
3
votes
1answer
267 views

Understanding output of rabin2

I am wondering what the crypto, linenum, pcalign, relocs and va values mean in the output of rabin2. I took a look in the source code of radare2 and it seems for ELF va is always true, I assume it ...
0
votes
1answer
113 views

Reference address by name in Radare2/Cutter

I have some experience with IDA and now I'm trying to use Radare2/Cutter the same way. I disassemble a DOS MZ file. I have the following: ;-- section.seg_000: 12: entry0 (); 0000:0000 push ds ...
0
votes
1answer
62 views

How to change local_184h to skip past jump commands with Radare2?

I am trying to solve a CTF challenge but I am very much out of my depth and nothing online is helping me very much. This is what I'm working with currently | 0x55b3fd508a41 4889e5 ...
0
votes
0answers
31 views

Bypassing debugger detection in radar2

I'm currently doing a reversee engineering challenge. I disassembled the ELF binary in radare2, however the binary checks whether its attached to a debugger. How can i bypass this detection ? Thanks ...
0
votes
0answers
33 views

radare2: disassemble functions of an executable compiled with gcc

I'm studying binary exploitation from CTF challenges. When I download a binary I don't have any problem to disassemble a function using the pdf command in radare2. However, If I compile a C program ...
1
vote
0answers
44 views

What do you think is the optimum environment for reverse engineering dynamically-linked aarch64 Golang binaries developed in Alpine Linux?

Direct quote from Golang's website: "GDB does not understand Go programs well. The stack management, threading, and runtime contain aspects that differ enough from the execution model GDB expects ...
0
votes
0answers
28 views

how do I use Remote Binary Protocol in cutter

how do I use Remote Binary Protocol I tried to connect to gdbserver through the normal method but it would just hang and not connect. I let it go like that for 1 hour
0
votes
0answers
46 views

How to debug a shared library with radare2?

I am currently trying to pick up radare2 but I am struggling on a little hurdle.. I am given a shared library, let's call it shared.so. I managed to perform some static analysis using $ r2 shared.so ...
1
vote
1answer
106 views

How to find DOS Header and PE Header with an entry point in Radare2?

I am currently doing byte extraction from PE files using Radare2. I know how to find the byte sequence for Dos Header and PE Header when there is no entry point and the start is defaulted to 0x0. But ...
4
votes
3answers
3k views

Writing a file with radare2 `w`?

Radare2 supports a w which writes a string. w foobar write string 'foobar' However, it doesn't seem to work for me, $ touch foo $ radare2 ./foo w foobar The file foo remains empty. Am ...
1
vote
1answer
143 views

Getting radare2 to load z80 binaries properly

I'm trying to disassemble some Sega Master System roms. In order to do so, I've checked for the extra 512 bytes from old roms and once I was sure they weren't there, I proceeded to run radare2 on one ...
4
votes
3answers
169 views

Get certain instruction count for multi-architecture binaries

I need to get an ELF binary's total count of Function call instruction conditional jump (branch) instruction The binary could be any CPU architecture, like x64, ARM, MIPS, Motorola 68K, etc. It ...
0
votes
0answers
28 views

Check indirect call function in Radare2

I'm working on a tool to construct control flow graph (CFG) from binary code (x86). For comparison purpose, I need to compare our tool with radare2. How could we determine if an indirect call function ...
1
vote
1answer
105 views

ARM binary dissasembly, Hopper works, Ghidra and Radare2 don't for some functions

I'm disassembling a large ARM binary and I see that for some functions both Ghidra and Radare2 appear to fail to disassemble certain functions whereas Hopper works for those same functions In Ghidra - ...
1
vote
1answer
167 views

The Graph view in Cutter is empty

Following this question, I'm trying to figure out how cscript.exe parses the .wsh Windows Script Host control files. First I tried WinDbg, but Radare2-Cutter seems like a much nicer software TBH. What ...
5
votes
2answers
2k views

How to add a function symbol to a stripped executable with radare2?

I am struggling with a stripped binary, and I would like to visualize the main() function with the VVV command (ascii-art CFG representation). Usually, the steps are the following: #> r2 ./...
1
vote
0answers
32 views

How can I rename location in radare2?

In radare2 I would like to be able to rename a node in the graph view. I though setting a flag to the entry of the graph node would also change its title, but the address of the nodes still shows ...
1
vote
1answer
69 views

radare2 - radare2 doesn't display string value

I have some rare cases with radare2. when I try to display all string using "iz" it does the job. but when I do "pdf" or "pd" I can't see actual value of string: I see ...
0
votes
0answers
32 views

Radare2: Running executable from a specific point

I am using radare2 to reverse engineer a standard crackme executable. I have obtained the password, but now I need use the program to read & print a restricted file to which the executable has ...
0
votes
1answer
47 views

How does radare2 create its memory layout?

Firstly Hello, this is my first post on this forum even though im reading alot here. Im trying to get into reversing and Low-Level stuff in general lately, and im a bit stuck right here. I did read ...
12
votes
2answers
26k views

Find reference to string in radare2

In this crackme solution first the strings are found: $ rabin2 -z crackserial_linux addr=0x00000aa0 off=0x00000aa0 ordinal=000 sz=7 len=7 section=.rodata type=A string=User: addr=0x00000aa7 off=...
0
votes
0answers
25 views

How can I have an interactive r2pipe session?

I am trying to make an interactive tutorial. It uses radare2 with r2pipe as its reverse engineering toolkit. I want my users to be able to use the visual mode through r2pipe. In order for the visual ...
0
votes
1answer
29 views

Running radare command on each line of the output of another command

Say, I have a command in radare which produces multiple input, say afl. I can run it and extract many addresses: [0x5579ca2e2196]> afl~[0] 0x5579ca2e2060 0x5579ca2e4fe0 0x5579ca2e2090 ...
0
votes
0answers
34 views

No instruction in main function when debugging with winedbg

I'v try to debugging windows PE file under Linux. winedbg --gdb --no-start a.exe ─╯ 00bc:00c0: create process 'Z:\home\coolder\a.exe'/0x1106b8 @...
1
vote
1answer
50 views

Using angr/radare2 to estimate values given chunks of assembly

I'm currently using radare2 in order to construct a simple CFG, each block/node in that graph is composed of one or more assembly instructions, I wish to estimate the value of specific register or ...
1
vote
1answer
65 views

Finding mapped memory page flags in Radare2

I have a memory dump of notepad.exe. Radare's iS to print sections gives me the mapped files (executable and it's dll's) as well as the many sections simply marked 'Memory_Section', which from what I ...
3
votes
1answer
123 views

Radare2 - what does dot mean in disassembly

I've just started using radare2 and I've noticed a dot when I tried to disassamble one on my programs. The output is: 0x00000000 48b841000000. movabs rax, 0x41 I understand that 0x48 is the REX ...
1
vote
2answers
4k views

Editing memory in radare2

It sounds like a stupid question but I honestly can't find the answer... I've looked at https://radare.gitbooks.io/radare2book/content/ and googled for hours but it still eludes me. How do I modify ...
0
votes
2answers
2k views

How can i start the RE process in radare2?(make changes to the registers) [closed]

I'm an absolute newbie to reverse engineering. I have a 32bit lsb arm binary which I would like to reverse engineer using radare2. How should I begin ?
3
votes
1answer
460 views

Radare2 - How to debug Android native code (dynamic analysis)?

I'm using Termux(root) on LineageOS 16 (Android 9) with radare2 (v3.6.0 linux-arm32). When i attach to a process with 'r2 -d pid' the app freezes properly but doesn't continue with 'dc'. I'm not sure ...
1
vote
1answer
48 views

Results of radare2 are not correct

I am using radare2 to analyze libpng_amd64.so.1.6.34, commands are as follows: r2 = r2pipe.open(binary_file) r2.cmd('aaa') funcs = r2.cmdj('aflj') len(funcs) is 461, but the number of functions got ...

1
2 3 4 5
7