Questions tagged [radare2]
Opensource reverse engineering framework to disassemble, debug, analyze, manipulate binary files and more.
303
questions
17
votes
1answer
4k views
Debugging with radare2 using two terminals
I have been trying to figure this out for quite some time now, and would really need some help. Firstly, some intro:
I am running the newest version of radare2 from Github on a 64bit Ubuntu 16.04 and ...
12
votes
2answers
26k views
Find reference to string in radare2
In this crackme solution first the strings are found:
$ rabin2 -z crackserial_linux
addr=0x00000aa0 off=0x00000aa0 ordinal=000 sz=7 len=7 section=.rodata type=A string=User:
addr=0x00000aa7 off=...
11
votes
2answers
2k views
Encrypted Mach-o binary cannot be disassembled/traced with GDB
I'm trying to analyze an encrypted Mach-O binary (non-iPhone one), and I am observing the following strange behaviors:
when I load this binary into GDB and try to disassemble the code at the address ...
11
votes
1answer
8k views
How to find a symbol in a binary using radare2?
I want to find an address of a symbol (e.g strcpy) inside a binary using radare2. I tried to use the f command to list all flags which are recognized by r2 but the list is enormous and it's not ...
10
votes
1answer
3k views
What are the main features of radare2?
Radare2 is a framework for reverse-engineering gathering several tools (see this Phrack article about radare1 to know a bit more about the framework).
I would like to know if someone could point out ...
10
votes
1answer
933 views
How to write [sp+local_variable] in radare2
Hello I'm playing with my native android library, everything was going smoothly till now. I have problem with opcodes, i don't know how to tell radare2 to write str opcode with specifc registry, and ...
9
votes
2answers
10k views
How do you can you disassemble and dump an entire binary?
It's easy to seek to a particular function and dump it's contents as Assembly language. However, I cannot find an obvious way to immediately disassemble and dump an entire binary. I want to use it ...
9
votes
6answers
11k views
Radare2 (noob question) can't set breakpoint?
I was following this video: https://www.youtube.com/watch?v=3NTXFUxcKPc at the end it show how to do basic stuff with Radare2.
When i try to set a break point with:
db 0x004005bd
where '0x004005bd' ...
9
votes
1answer
1k views
Split view radare2 print heap
I recently start to use radare2 and I have a question
How can I print info about the heap with dmhb dmhf etc. while debugging ?
I would like to have the heap informations on the right and the ...
9
votes
1answer
8k views
How to get a nice stack view in radare2?
This is the stack view that I'm getting in radare2 after entering the visual panel mode:
This is the view from immunity debugger:
How can I get a view similar to immunity debugger in radare2?
8
votes
1answer
3k views
radare2 ascii graph to image?
After analysing a function and pressing VV to go into graph mode, is it somehow possible to export/render the whole graph to an image?
I have some huge main functions and it would be nice to have it ...
8
votes
1answer
180 views
Radare2 Call $+5 and register-based cross-references not found
I have a library of ~65MB which uses this "technique" as a kind of PIC.
First, it gets some kind of base address (it is always the same):
0x00708497 e800000000 call 0x70849c
0x0070849c ...
7
votes
2answers
20k views
How to use radare2 to disassemble an executable file?
I have a cgywin executable file (shall be in PE format) and would like to disassemble it to get the assembly code on the text section using radare2, most of the examples disassemble per instruction ...
7
votes
1answer
9k views
Visual View in radare2 while debugging
I am using radare2 in debugging mode (r2 -d ./program).
I set up a breakpoint at a certain address (db 0x12341234)
And next I have entered Visual View using: V!
Following some tutorials, I saw them ...
7
votes
1answer
2k views
What is the info displayed by radare2's afl?
I can't figure out what afl actually outputs. The docs are surprisingly uninformative.
So, I've got address on the first column and symbol on the last. What is on the 2nd, 3rd and 4th columns?
...
7
votes
2answers
1k views
Radare2 Find command line arguments and location in stack
This might have a simple solution but I can't find it anywhere.
$> ./be1 11 AAAAA
With gdb, finding argv[] and argc is simple:
(gdb) print argv[0]@argc
$7 = {0xbffff872 "be1", 0xbffff89a "11", ...
7
votes
1answer
5k views
Recursive traversal disassembling with Radare2?
I am trying the recursive traversal disassembler of the radare2 tool. But, I cannot use it properly.
First, according to the radare2 manual, we can use recursive traversal disassembler by using the ...
7
votes
1answer
2k views
Radare2: inspecting renamed variables
I'm practicing with Radare2, latest commit.
radare2 2.3.0-git 16814 @ linux-x86-64 git.2.2.0-5-g61a903315
During my sessions, I need to rename local variables to a more understandable name, e.g.
...
7
votes
1answer
1k views
Radare2- How to see stdout in Visual Mode
How can I display any standard write in visual mode.
For example if I run dc command it runs the program normally and displays all the text normally. But if I enter visual mode with V< enter > ...
6
votes
2answers
2k views
Writing ELF headers in Radare?
Reading Keith Makan's, "Introduction to the ELF Format : The ELF Header", he modifies e_entry,
The e_entry field lists the offset in the file where the program should start executing.Normally it ...
6
votes
1answer
4k views
How to make radare2 work for a large binary?
I compiled cpython with debugging headers and I want to perform the following analysis using radare2.
The problem I encounter is that it takes forever (at least 27 hours) to perform the aaa (...
6
votes
2answers
16k views
Radare2 C output
I made a simple hello world program, and put it in radare2. I then ran the pc command, which displayed C output. The output was this:
#define _BUFFER_SIZE 256
const uint8_t buffer[256] = {
0x55, ...
6
votes
2answers
5k views
Disassembly shows `LEA` with RIP?
When I disassemble this instruction using pad on Radare I get an LEA with rip
[0x00000000]> pad 8d 15 c8 90 04 08
lea edx, [rip + 0x80490c8]
I got this instruction from this post here I'm ...
6
votes
2answers
2k views
what is radare2's equivalent to GDB's 'find &system,+9999999,“/bin/sh”'
What is radare2's equivalent to GDB's find &system,+9999999,"/bin/sh"?
6
votes
1answer
23k views
How to debug (like gdb) with radare2?
I am new to radare2 and Linux. I got problem with r2.
As the title states it, many tutorials, articles, videos about r2 are just about disassembling programs, and read assembly codes. But, I want ...
6
votes
1answer
623 views
Viewing Radare keybindings for Visual Pane mode (Function hotkeys)?
Is there a way to view the keybinidngs inside of Radare? Such that I can see which function keys do things like Step Over and Step Into in Debug mode?
e~key doesn't list any of the debug keys,
key.S ...
6
votes
3answers
3k views
Debugging forked child in an anti-debug protected crackme
I am interested in the anti-debugging method implemented in the crackme called trace-p. A child process is forked, which communicates with the parent using int3 instructions. I would like to debug the ...
6
votes
1answer
4k views
Disassembling an unknown DOS MZ executable using radare2
How do I specify to radare2 that what I'm disassembling when I know it is a DOS MZ executable?
As it does not auto-detect this for me.
6
votes
1answer
996 views
Is there any way to display the standard input and output of a program to Cutter's console while debugging?
So it's easy to transfer the standard input and output in radare2 to a new terminal using rarun2, here's how:
Debugging with radare2 using two terminals
i was wondering if i can use rarun2 with ...
6
votes
0answers
360 views
Radare2 - How to save/restore metadata in debug session (BPs, flag, comments..)?
How can i save/reuse/preserve Radare2 metadata (BPs, comments, flags..) of a debug session for a new debug session? I restart the debugger alot and preserving environment would be very helpful.
I ...
5
votes
3answers
762 views
Any documentation available for r2 other than official book
I am interested in learning and using radare2 as a toolset for reverse engineering. But I want ANY other resource for learning this tools other than radare2 book, preferably a video series. What I am ...
5
votes
2answers
3k views
Method disassembly of Objective C Mach-O with Radare 2
Is is possible to retrieve the dissassembly of Objective-C methods declared in Mach-O files using Radare 2 ?
5
votes
1answer
608 views
Import symbols containing strange characters
I am analyzing a macOS app with radare2, and the app depends on a number of Qt frameworks. When I printed out the import symbols of the app's main executable, the names of the frameworks' functions ...
5
votes
2answers
3k views
Radare2 forwarding input to scanf from a file
I'm debugging a file with radare2 and when I come to scanf function I want to forward input from a .txt file. In gdb I would do this by typing r < text.txt.
Is something like that possible in ...
5
votes
2answers
1k views
Understanding branch delay slots for reversing MIPS
I am statically reversing some software compiled for an Atheros AR7161 using radare2. This processor implements MIPS, and I do recall that MIPS has a branch delay slot. This is indeed noticeable in ...
5
votes
2answers
2k views
How to add a function symbol to a stripped executable with radare2?
I am struggling with a stripped binary, and I would like to visualize the main() function with the VVV command (ascii-art CFG representation).
Usually, the steps are the following:
#> r2 ./...
5
votes
1answer
616 views
Is there a way to explicitly connect r2pipe to an existing radare2 session that I have open?
I understand that I can execute my script within a session using [0x401000]> . server.py and the pipe will be connected to it when I call r2pipe.open() with no arguments.
Ideally I would like to ...
5
votes
3answers
10k views
Examining memory in radare2
How can I examine a memory address in radare2 using registers? I would like to achive what this command does in gdb: x/s $ebp+0x4
5
votes
1answer
516 views
Why do many imported functions jump to addresses that do not contain instructions?
I am learning to analyze binaries using radare2 and have been confused about what occurs within imported functions. In the binary below, titled Lab2B, I statically disassembled the binary and then ...
5
votes
1answer
663 views
Difference between 'readelf' and 'radare2' addresses
I have an MIPS binary file that I want to analyze. I am having a little trouble understanding the way elfread and r2 interpret the adressing scheme from a binary.
For example, r2 finds a function ...
5
votes
1answer
1k views
How to do debug a running java process in linux?
TLDR I want to do live debugging of a java program on a linux machine, and don't how/what debugger to attach to the JVM to get this done.
I expect that this is a well-solved problem, but I lack the ...
5
votes
1answer
524 views
function call trace with radare2 or break on all function call
I want to script with python using r2pipe. Is there a way that when debugging I can break on each call function, thus I can get the parameter? What's more, I won't jump into system library.
Or is ...
5
votes
1answer
1k views
Radare2 doesn't display the whole function
I am using radare2, I have disassembled the function: sym.loop, it contains a switch witch has 4 cases that calls different functions. After any of the function call, the program exits the loop ...
5
votes
0answers
152 views
Radare2 8051 code bank switching
Some of 8051 chips use bank switching to extend accessible code memory.
Good example is Silabs C8051F12x. Another example is here.
Code area in range 0x0000..0x7ffff is common always accessible code ...
4
votes
1answer
746 views
Heap Chunk Structure Does Not Contain Previous Section Info
I'm reading Shellcoder's Handbook to learn more about exploitation and overflows. I reached the chapter on Heap Overflows. The book mentions that a heap is split into chunks where each chunk contains ...
4
votes
1answer
5k views
Getting to the entry point using radare2
How do I get to the entry point of a .exe file using radare2?
I tried using aa then pdf@sym.main, but a prompt showed saying "Cannot find function at 0x00000000"
4
votes
2answers
493 views
Function prototypes given by Ghidra is not consistent
This is a follow up question to the question I posted over here. According to the answer, I was able to get all the function prototypes from the binary. However, the problem I am having is most of the ...
4
votes
1answer
4k views
How to reverse CGI file for MIPS?
I'm trying to load a CGI file to IDA in order to disassemble it and understand it's behaviour but I can't do it.
According to the strings command I can see some interesting words like system, sprintf,...
4
votes
1answer
151 views
Ghidra + IDA cant detect a string but Radare2 can
Im new to reverse engineering, and ive trying Ghidra, IDA (Freeware) and Radare2 with a simple CrackMe, the problem is, both Ghidra and IDA couldnt detect a string while Radare2 (Using Cutter GUI) ...
4
votes
1answer
435 views
How do I permanently change the disassembly syntax in Radare2?
As the title says, I am trying to change the default disassembly syntax in Radare2 from Intel to AT&T. Looking up documentation, I found the following.
[0x00405e1c]> e asm.syntax=att
However, ...
