Questions tagged [radare2]

Opensource reverse engineering framework to disassemble, debug, analyze, manipulate binary files and more.

61 questions with no upvoted or accepted answers
Filter by
Sorted by
Tagged with
6
votes
0answers
360 views

Radare2 - How to save/restore metadata in debug session (BPs, flag, comments..)?

How can i save/reuse/preserve Radare2 metadata (BPs, comments, flags..) of a debug session for a new debug session? I restart the debugger alot and preserving environment would be very helpful. I ...
5
votes
0answers
152 views

Radare2 8051 code bank switching

Some of 8051 chips use bank switching to extend accessible code memory. Good example is Silabs C8051F12x. Another example is here. Code area in range 0x0000..0x7ffff is common always accessible code ...
4
votes
0answers
429 views

Radare2 project opening

When I open a project r2 -p mypoject I get a bunch of errors with some numbers: 0 0 Cannot add reference to non-function Cannot add reference to non-function 1482 I use latest version of radare2 ...
3
votes
1answer
267 views

Understanding output of rabin2

I am wondering what the crypto, linenum, pcalign, relocs and va values mean in the output of rabin2. I took a look in the source code of radare2 and it seems for ELF va is always true, I assume it ...
3
votes
0answers
1k views

How to save Radare2 Analysis?

How do I save a radare2 session after I did "aa"? I know there is a command for saving a project, but this isn't working out for some reason (Ps PROJECTNAME). So I am looking for a way to save my ...
3
votes
0answers
162 views

radare2 difference between function offset and minbound

I am trying to understand the difference between a function's offset and its minbound in radare2. Consider this function in radare2 (output of aflj): { "offset": 4549740, "name": "...
3
votes
0answers
188 views

Comparing two UEFI applications?

I have two x86-64 UEFI applications original.efi and patched.efi. I want to find out what have been changed in patched.efi and what these changes do. I have tried to use the Radare2 framework to ...
3
votes
1answer
489 views

Cannot open '/proc/…/maps': No such file or directory in radare2 debug mode

When I try to load a program to radare2 debug mode, most of the time I get the following error: $sudo r2 -d a.out Hello world!= attach 2851 2851 Cannot open '/proc/2851/maps': No such file or ...
2
votes
1answer
68 views

How i can do several input via rarun2?

How can i do several input via rarun2, if my program requares two input? I try this:
2
votes
1answer
125 views

What is actually loaded here and different hexdump outputs on util-linux hexdump and on cutter and ghidra's hexdump

I was trying to understand what segment of file gets loaded by fourth LOAD header on phdr array. First 6 headers are shown below from readelf Program Headers: Type Offset ...
2
votes
0answers
63 views

radare2 wrong output

I saw rasm2 giving different output each time for x64 Take a look at this: C:\WINDOWS\system32>rasm2 -a x86 -b 64 -d "41f6c7FF" test r15b, 0xff C:\WINDOWS\system32>rasm2 -a x86 -b 64 "test ...
2
votes
0answers
108 views

Understanding ESIL

I cross-compiled a simple program with the aarch-linux-gnu-gcc compiler for ARM. So the machine is "ARM aarch64". I want to understand a single instruction and it's realization in ESIL. The opcode of ...
2
votes
0answers
98 views

radare2 specifying bitfield or enum width

I'm using radare2 to deconstruct a binary blob. When defining bit-field value there seems to be no syntax to specify the width of the field that contains the enum. For instance with a C structure as ...
2
votes
0answers
172 views

Radare2 - recursive traversal visual mode

I know that both pdf @ func and pdr @ func disassemble the function, the first using linear and the second recursive traversal disassembly. VV @ func shows the disassembled function in visual mode, ...
1
vote
0answers
44 views

What do you think is the optimum environment for reverse engineering dynamically-linked aarch64 Golang binaries developed in Alpine Linux?

Direct quote from Golang's website: "GDB does not understand Go programs well. The stack management, threading, and runtime contain aspects that differ enough from the execution model GDB expects ...
1
vote
0answers
32 views

How can I rename location in radare2?

In radare2 I would like to be able to rename a node in the graph view. I though setting a flag to the entry of the graph node would also change its title, but the address of the nodes still shows ...
1
vote
1answer
106 views

How to find DOS Header and PE Header with an entry point in Radare2?

I am currently doing byte extraction from PE files using Radare2. I know how to find the byte sequence for Dos Header and PE Header when there is no entry point and the start is defaulted to 0x0. But ...
1
vote
0answers
46 views

radare2 stop on lazy loaded library (gdb's stop-on-solib-events)

I am running an application and would like to set a breakpoint, as soon as a relevant shared library is loaded. On gdb I can achieve it via set stop-on-solib-events 1 I've been unable to find ...
1
vote
0answers
61 views

Add indirect branch target reference manually (xref, crossreference) in Cutter (radare2)?

How can I create a reference for an indirect branch instruction blx r0 so that the call to the address stored in r0 shows up in the graph? I've tried flagging the target (function), but that does ...
1
vote
1answer
800 views

Renaming variables radare2

I have a variable called var_14h in disassemble code. I want to rename this variable. I try to rename the variable by using the following afvn var_14h i However, radare complains and returns an ...
1
vote
0answers
208 views

Some obstacles in reversing a JNI Native library

I deleted my last question (it was not still answered and none's effort was wasted) as I got back and thought to re-read JNI documentation, to find I misinterpreted some bits. Things are now clearer ...
1
vote
1answer
98 views

How to set search scope in radare2

Iam wondering how to change search scope in radare2. I`ve made some research and set variables search.from and search.to, according to Radare2 Book, but it doesn't work at all! Could you help me ...
1
vote
0answers
285 views

write radare2 output to a file

I am trying to write all the write logs of a binary program into a file for further analysis. I am using radare2 for it. I don't know what's the issue, I am not able to write the 'dte' output to a ...
1
vote
0answers
399 views

Illegal instruction fault in stack based buffer overflow

I wrote this short C program to practice buffer overflow exploits: #include <stdio.h> #include <string.h> #include <stddef.h> #include <inttypes.h> char *decode(char *s){ ...
1
vote
0answers
186 views

Password is right, but still wrong?

i am trying to find the password of a binary with radare2 - a crackme again :-) I already thought I've found the password ('pass'), but this seems to be not the right one. Or there is a trick I didn'...
1
vote
0answers
107 views

Techniques for reversing (basic) hash function

Hi I'm relatively new to RE, and I'm using GDB and Radare2. As part of a crackme I'm trying to reverse a weak hash function that's a little too complicated for me to undo by hand. I've been trying to ...
1
vote
0answers
172 views

Radare2: pd command ignores cfg.bigendian setting

I am currently using radare2 to disassemble a raw ARM binary (bootloader) in little endian format. I used the command e cfg.bigendian = false to set the endianness, but the pd command seems to ignore ...
1
vote
0answers
85 views

Can Radare2 emulate null pointer exceptions and others?

I'm wondering if anyone has had any luck with Radare2's configuration variables, esil.exectrap, esil.iotrap, and esil.nonull while emulating? xor eax, eax mov eax, dword [eax] <- From what I can ...
1
vote
0answers
802 views

radare2 not showing function names

I'm using radare2 and I've noticed that it simply prints function offsets rather than function names. I've done some tests and I've discovered that on Kali it prints offsets and on debian it prints ...
1
vote
1answer
105 views

ARM binary dissasembly, Hopper works, Ghidra and Radare2 don't for some functions

I'm disassembling a large ARM binary and I see that for some functions both Ghidra and Radare2 appear to fail to disassemble certain functions whereas Hopper works for those same functions In Ghidra - ...
0
votes
1answer
39 views

Golang program reversing with Radare2

I'm trying to understand how to reverse golang programs with radare2. In order to practice, i create a minimal program in Go: package main import "fmt" func main() { fmt.Println("...
0
votes
0answers
16 views

radare2 can't see error/signal messages

I'm in visual mode on the debug screen. I'm stepping through some function code with the 'F7' shortcut key, when I hit a part of the code that yields an error or some kind of message, the message text ...
0
votes
0answers
29 views

Control flow graph of entire binary file

Is it possible to get the control flow graph of the entire binary file using any disassembler? IDA Pro generates the CFG for each function. Can we use it to get the CFG of the entire program?
0
votes
0answers
23 views

“rabin2 -E” and “afll” no output for an exe file

$ rabin2 -I test.exe arch x86 baddr 0x400000 binsz 3229424 bintype pe bits 32 canary false retguard false class PE32 cmp.csum 0x0031d950 ...
0
votes
0answers
31 views

Bypassing debugger detection in radar2

I'm currently doing a reversee engineering challenge. I disassembled the ELF binary in radare2, however the binary checks whether its attached to a debugger. How can i bypass this detection ? Thanks ...
0
votes
0answers
33 views

radare2: disassemble functions of an executable compiled with gcc

I'm studying binary exploitation from CTF challenges. When I download a binary I don't have any problem to disassemble a function using the pdf command in radare2. However, If I compile a C program ...
0
votes
1answer
45 views

Getting memory address of particular bytes in radare2

in pwnlib there is a possibility to search for particular bytes, e.g. as follows for 0x66 byte: print(next(p.elf.search(b'f'))) which in turn results in the following output: 4195268 Having this ...
0
votes
1answer
115 views

Crackme assistance - change input of a function

Just as a preface, this is a crackme from https://hack.ainfosec.com/. I know you can submit these as part of a job app, I have no intentions of doing that. Very happy to have a job in a related, but ...
0
votes
0answers
28 views

how do I use Remote Binary Protocol in cutter

how do I use Remote Binary Protocol I tried to connect to gdbserver through the normal method but it would just hang and not connect. I let it go like that for 1 hour
0
votes
0answers
46 views

How to debug a shared library with radare2?

I am currently trying to pick up radare2 but I am struggling on a little hurdle.. I am given a shared library, let's call it shared.so. I managed to perform some static analysis using $ r2 shared.so ...
0
votes
1answer
62 views

How to change local_184h to skip past jump commands with Radare2?

I am trying to solve a CTF challenge but I am very much out of my depth and nothing online is helping me very much. This is what I'm working with currently | 0x55b3fd508a41 4889e5 ...
0
votes
0answers
28 views

Check indirect call function in Radare2

I'm working on a tool to construct control flow graph (CFG) from binary code (x86). For comparison purpose, I need to compare our tool with radare2. How could we determine if an indirect call function ...
0
votes
0answers
32 views

Radare2: Running executable from a specific point

I am using radare2 to reverse engineer a standard crackme executable. I have obtained the password, but now I need use the program to read & print a restricted file to which the executable has ...
0
votes
0answers
25 views

How can I have an interactive r2pipe session?

I am trying to make an interactive tutorial. It uses radare2 with r2pipe as its reverse engineering toolkit. I want my users to be able to use the visual mode through r2pipe. In order for the visual ...
0
votes
0answers
34 views

No instruction in main function when debugging with winedbg

I'v try to debugging windows PE file under Linux. winedbg --gdb --no-start a.exe ─╯ 00bc:00c0: create process 'Z:\home\coolder\a.exe'/0x1106b8 @...
0
votes
0answers
16 views

Why does `omb` sometimes not work in Radare2

I'm a little confused about the behaviour of the omb command in Radare2. Sometimes when I give it what I believe is a valid segment number and offset, it doesn't change it. (This is usually after I ...
0
votes
1answer
70 views

How do I use vi keybindings at the command line in Radare2?

The Radare2 command line (I believe it's called "interactive mode"?) allows bringing back history and editing it with the arrow keys. However, I prefer to use vi/vim keybindings for this. How do I ...
0
votes
0answers
55 views

How can I define an int array in Radare2?

I'm disassembling a C written binary using radare2: The block of code im looking into corresponds to this one int num[5]; int sum; num[0] = 200; num[1] = 150;...
0
votes
0answers
50 views

radare2 set data type at address

I've been using Ghidra a lot recently and have developed a nice workflow, but I'm trying to get back into r2. I'm wondering if there's a way to set the data type at a given address. For example, when ...
0
votes
0answers
102 views

Anti-re tactics or radare problem while debugging

Here's the target application: https://www.sa-mp.com/download.php While live debugging, the Windows application is starting a few threads, and Cutter auto breaks after entrypoint for a reason I'm not ...