Questions tagged [radare2]

Opensource reverse engineering framework to disassemble, debug, analyze, manipulate binary files and more.

60 questions with no upvoted or accepted answers
Filter by
Sorted by
Tagged with
6
votes
0answers
418 views

Radare2 - How to save/restore metadata in debug session (BPs, flag, comments..)?

How can i save/reuse/preserve Radare2 metadata (BPs, comments, flags..) of a debug session for a new debug session? I restart the debugger alot and preserving environment would be very helpful. I ...
5
votes
0answers
187 views

Radare2 8051 code bank switching

Some of 8051 chips use bank switching to extend accessible code memory. Good example is Silabs C8051F12x. Another example is here. Code area in range 0x0000..0x7ffff is common always accessible code ...
4
votes
0answers
456 views

Radare2 project opening

When I open a project r2 -p mypoject I get a bunch of errors with some numbers: 0 0 Cannot add reference to non-function Cannot add reference to non-function 1482 I use latest version of radare2 ...
3
votes
0answers
2k views

How to save Radare2 Analysis?

How do I save a radare2 session after I did "aa"? I know there is a command for saving a project, but this isn't working out for some reason (Ps PROJECTNAME). So I am looking for a way to save my ...
3
votes
0answers
197 views

radare2 difference between function offset and minbound

I am trying to understand the difference between a function's offset and its minbound in radare2. Consider this function in radare2 (output of aflj): { "offset": 4549740, "name": "...
3
votes
0answers
188 views

Comparing two UEFI applications?

I have two x86-64 UEFI applications original.efi and patched.efi. I want to find out what have been changed in patched.efi and what these changes do. I have tried to use the Radare2 framework to ...
3
votes
1answer
687 views

Cannot open '/proc/.../maps': No such file or directory in radare2 debug mode

When I try to load a program to radare2 debug mode, most of the time I get the following error: $sudo r2 -d a.out Hello world!= attach 2851 2851 Cannot open '/proc/2851/maps': No such file or ...
2
votes
1answer
107 views

How i can do several input via rarun2?

How can i do several input via rarun2, if my program requares two input? I try this:
2
votes
1answer
146 views

What is actually loaded here and different hexdump outputs on util-linux hexdump and on cutter and ghidra's hexdump

I was trying to understand what segment of file gets loaded by fourth LOAD header on phdr array. First 6 headers are shown below from readelf Program Headers: Type Offset ...
2
votes
0answers
64 views

radare2 wrong output

I saw rasm2 giving different output each time for x64 Take a look at this: C:\WINDOWS\system32>rasm2 -a x86 -b 64 -d "41f6c7FF" test r15b, 0xff C:\WINDOWS\system32>rasm2 -a x86 -b 64 "test ...
2
votes
0answers
121 views

Understanding ESIL

I cross-compiled a simple program with the aarch-linux-gnu-gcc compiler for ARM. So the machine is "ARM aarch64". I want to understand a single instruction and it's realization in ESIL. The opcode of ...
2
votes
0answers
107 views

radare2 specifying bitfield or enum width

I'm using radare2 to deconstruct a binary blob. When defining bit-field value there seems to be no syntax to specify the width of the field that contains the enum. For instance with a C structure as ...
2
votes
0answers
173 views

Radare2 - recursive traversal visual mode

I know that both pdf @ func and pdr @ func disassemble the function, the first using linear and the second recursive traversal disassembly. VV @ func shows the disassembled function in visual mode, ...
1
vote
0answers
53 views

Radare2 cannot open bin for writing

Im on Kali and im using Radare2 but it says r2 -d bin Killing child process 16151 due to an error Killing child process 16152 due to an error [w] Cannot open 'dbg://./bin' for writing. I tried chmod +...
1
vote
0answers
29 views

Function Arguments/Name on Radare and IDA

I am starting with reverse engineering and Radare and I'm facing the following problem, on IDA Free I see the following code: mov ecx, 11h lea edi, [esp+1208h+StartupInfo] rep stosd lea ...
1
vote
0answers
152 views

radare2 unable to run a binary file

I've been trying to debug a binary file in radare2 but it throws me this error. $ r2 -d bin Killing child process 1688 due to an error Killing child process 1689 due to an error [...
1
vote
0answers
30 views

Change return value of a boolean function in arm library

I have an android library (arm cpu) that have a function named GetEisLinkWithDfr() that have a single line that returns boolean value of "true", and I want it to return a value of "...
1
vote
0answers
77 views

What do you think is the optimum environment for reverse engineering dynamically-linked aarch64 Golang binaries developed in Alpine Linux?

Direct quote from Golang's website: "GDB does not understand Go programs well. The stack management, threading, and runtime contain aspects that differ enough from the execution model GDB expects ...
1
vote
0answers
65 views

How can I rename location in radare2?

In radare2 I would like to be able to rename a node in the graph view. I though setting a flag to the entry of the graph node would also change its title, but the address of the nodes still shows ...
1
vote
0answers
66 views

radare2 stop on lazy loaded library (gdb's stop-on-solib-events)

I am running an application and would like to set a breakpoint, as soon as a relevant shared library is loaded. On gdb I can achieve it via set stop-on-solib-events 1 I've been unable to find ...
1
vote
0answers
77 views

Add indirect branch target reference manually (xref, crossreference) in Cutter (radare2)?

How can I create a reference for an indirect branch instruction blx r0 so that the call to the address stored in r0 shows up in the graph? I've tried flagging the target (function), but that does ...
1
vote
0answers
332 views

Some obstacles in reversing a JNI Native library

I deleted my last question (it was not still answered and none's effort was wasted) as I got back and thought to re-read JNI documentation, to find I misinterpreted some bits. Things are now clearer ...
1
vote
0answers
404 views

write radare2 output to a file

I am trying to write all the write logs of a binary program into a file for further analysis. I am using radare2 for it. I don't know what's the issue, I am not able to write the 'dte' output to a ...
1
vote
0answers
493 views

Illegal instruction fault in stack based buffer overflow

I wrote this short C program to practice buffer overflow exploits: #include <stdio.h> #include <string.h> #include <stddef.h> #include <inttypes.h> char *decode(char *s){ ...
1
vote
0answers
215 views

Password is right, but still wrong?

i am trying to find the password of a binary with radare2 - a crackme again :-) I already thought I've found the password ('pass'), but this seems to be not the right one. Or there is a trick I didn'...
1
vote
0answers
115 views

Techniques for reversing (basic) hash function

Hi I'm relatively new to RE, and I'm using GDB and Radare2. As part of a crackme I'm trying to reverse a weak hash function that's a little too complicated for me to undo by hand. I've been trying to ...
1
vote
0answers
234 views

Radare2: pd command ignores cfg.bigendian setting

I am currently using radare2 to disassemble a raw ARM binary (bootloader) in little endian format. I used the command e cfg.bigendian = false to set the endianness, but the pd command seems to ignore ...
1
vote
0answers
86 views

Can Radare2 emulate null pointer exceptions and others?

I'm wondering if anyone has had any luck with Radare2's configuration variables, esil.exectrap, esil.iotrap, and esil.nonull while emulating? xor eax, eax mov eax, dword [eax] <- From what I can ...
1
vote
0answers
934 views

radare2 not showing function names

I'm using radare2 and I've noticed that it simply prints function offsets rather than function names. I've done some tests and I've discovered that on Kali it prints offsets and on debian it prints ...
1
vote
1answer
372 views

ARM binary dissasembly, Hopper works, Ghidra and Radare2 don't for some functions

I'm disassembling a large ARM binary and I see that for some functions both Ghidra and Radare2 appear to fail to disassemble certain functions whereas Hopper works for those same functions In Ghidra - ...
0
votes
0answers
49 views

Is it possible to detect that a function has been called from a loop? - Radare-2

is it possible to detect a function is calling from inside a loop in Radare-2. for (i = 0; i<n; i++) foo() foo() ==> 0x00402f90 // starting address Thanks
0
votes
0answers
40 views

Radare2 give same assembly code with two different file.apk

I want to use the reverse engineering of radare2 (run on Kali Linux 2020) in order to get the assembly code of file.apk. But I do not know why two different file.apk give the same code. I checked many ...
0
votes
1answer
39 views

print format in radare2 cannot output all my string

I was doing a CTF challenge and I need to see the value of RAX register in radare2. I first dumped all of printable ascii characters as input, one of the function encoded the input and spit out the ...
0
votes
0answers
66 views

radare2: Print strings in function for 32-bit binaries

I want to see the strings that are printed by the puts() function in the output of radare2's pdf, but it doesn't work. I have a similar problem as mentioned here, but I think it's somehow related to ...
0
votes
0answers
63 views

What are "covrage and "codesz" in radare2?

[0x00009124]> a fcns 0 xrefs 0 calls 0 strings 126 symbols 74 imports 27 covrage 347 codesz 27543 percent 8% Sorry, this is a newbie question, but what are covrage and codesz? How can I ...
0
votes
0answers
41 views

Function name from Ordinal number in Radare2

When disassembling dll or exe files in radare2, I sometimes encounter function calls via ordinals (call sub. mfc140u.dll_Ordinal_2246). As I understand it, the problem is that there is no pdb file for ...
0
votes
0answers
29 views

Can I find out what methods are being swizzled in runtime?

I have an obfuscated dylib injecting into a process in macOS to swizzle objc methods. Obviously I can decompile it to check what it is hooking, but its heavily obfuscated. Hence, can I find out what ...
0
votes
0answers
29 views

Saving a breakpoint in radare2 loses the format string

Good day to you all. I'm new to radare2 and reverse engineering in general. Debugging a small crackme. I want to save breakpoints. Initially, everything is fine: db* > bps and load breakpoints: ...
0
votes
0answers
42 views

How to reverse engineer structs in radare2?

Is there any way to indentify structs in radare2? when i tried to look them, they look like normal variables, i seen people using td and tl command but I don't know how to use them. If you know please ...
0
votes
0answers
57 views

Radare2 is showing weird disassembly as compared to disassembly of gcc

Today i was playing around with c code in r2. I compiled a file which had the following code. #include <stdio.h> int main(){ int a=9; float b=1.1; int sum; sum = ...
0
votes
0answers
78 views

Why won't Radare2 display main's paramethers of a 32bit ELF on a 64 bit machine?

I am new to reversing and currently trying to follow this tutorial, in which the binary provided was compiled on a 32 bit machine hence the file is a "ELF 32-bit LSB executable". It runs ...
0
votes
0answers
20 views

radare2 can't see error/signal messages

I'm in visual mode on the debug screen. I'm stepping through some function code with the 'F7' shortcut key, when I hit a part of the code that yields an error or some kind of message, the message text ...
0
votes
0answers
98 views

Control flow graph of entire binary file

Is it possible to get the control flow graph of the entire binary file using any disassembler? IDA Pro generates the CFG for each function. Can we use it to get the CFG of the entire program?
0
votes
0answers
28 views

"rabin2 -E" and "afll" no output for an exe file

$ rabin2 -I test.exe arch x86 baddr 0x400000 binsz 3229424 bintype pe bits 32 canary false retguard false class PE32 cmp.csum 0x0031d950 ...
0
votes
0answers
44 views

Bypassing debugger detection in radar2

I'm currently doing a reversee engineering challenge. I disassembled the ELF binary in radare2, however the binary checks whether its attached to a debugger. How can i bypass this detection ? Thanks ...
0
votes
0answers
84 views

radare2: disassemble functions of an executable compiled with gcc

I'm studying binary exploitation from CTF challenges. When I download a binary I don't have any problem to disassemble a function using the pdf command in radare2. However, If I compile a C program ...
0
votes
1answer
185 views

Crackme assistance - change input of a function

Just as a preface, this is a crackme from https://hack.ainfosec.com/. I know you can submit these as part of a job app, I have no intentions of doing that. Very happy to have a job in a related, but ...
0
votes
0answers
31 views

how do I use Remote Binary Protocol in cutter

how do I use Remote Binary Protocol I tried to connect to gdbserver through the normal method but it would just hang and not connect. I let it go like that for 1 hour
0
votes
0answers
104 views

How to debug a shared library with radare2?

I am currently trying to pick up radare2 but I am struggling on a little hurdle.. I am given a shared library, let's call it shared.so. I managed to perform some static analysis using $ r2 shared.so ...
0
votes
0answers
58 views

Check indirect call function in Radare2

I'm working on a tool to construct control flow graph (CFG) from binary code (x86). For comparison purpose, I need to compare our tool with radare2. How could we determine if an indirect call function ...