Questions tagged [radare2]

Opensource reverse engineering framework to disassemble, debug, analyze, manipulate binary files and more.

Filter by
Sorted by
Tagged with
4
votes
1answer
472 views

How do I find out what section variables and strings are defined in?

Given a simple program like this, void main (int argc, char * argv[] ) { char * arr[] = {"foo", "bar", "baz"}; *(arr[0]) = 'F'; printf( "%s", arr[0] ); } How do I find out what section ...
10
votes
1answer
807 views

How to write [sp+local_variable] in radare2

Hello I'm playing with my native android library, everything was going smoothly till now. I have problem with opcodes, i don't know how to tell radare2 to write str opcode with specifc registry, and ...
6
votes
1answer
528 views

Viewing Radare keybindings for Visual Pane mode (Function hotkeys)?

Is there a way to view the keybinidngs inside of Radare? Such that I can see which function keys do things like Step Over and Step Into in Debug mode? e~key doesn't list any of the debug keys, key.S ...
4
votes
1answer
528 views

Is there a way to explicitly connect r2pipe to an existing radare2 session that I have open?

I understand that I can execute my script within a session using [0x401000]> . server.py and the pipe will be connected to it when I call r2pipe.open() with no arguments. Ideally I would like to ...
1
vote
1answer
575 views

r2pipe won't prompt for user input like the binary does in r2 debugger mode

Have a functioning r2pipe script, but there's a need for hitting crtl-c to continue near the breakpoint(not a major issue,) however the script does not pause for input when the crackme asks for user ...
5
votes
1answer
443 views

Why do many imported functions jump to addresses that do not contain instructions?

I am learning to analyze binaries using radare2 and have been confused about what occurs within imported functions. In the binary below, titled Lab2B, I statically disassembled the binary and then ...
0
votes
1answer
861 views

Reverse mips binary with radare2

when I try to reverse my mips binary in radare2, I take some instruction invalid. sudo r2 -a mips -b 32 -d 2700 start my binary: sudo chroot . ./qemu-mips-static bin/resident Sorry for this ...
0
votes
1answer
773 views

Radare2 cannot debug on windows 7

I downloaded radare 2.5 for windows. I am trying to debug a binary on windows with radare and have tried the following: radare2 -d a.exe fork_and_ptraceme/CreateProcess: The request is not supported. ...
7
votes
2answers
1k views

Radare2 Find command line arguments and location in stack

This might have a simple solution but I can't find it anywhere. $> ./be1 11 AAAAA With gdb, finding argv[] and argc is simple: (gdb) print argv[0]@argc $7 = {0xbffff872 "be1", 0xbffff89a "11", ...
3
votes
2answers
3k views

What does XREF mean?

I have been learning about the x86 assembly language by analyzing a binary using radare2 that is stored on a Intel 80386 machine. When I have been analyzing functions on the binary, I noticed that "...
1
vote
1answer
1k views

How to list breakpoints in radare2?

in gdb to list active breakpoints is info b how to do the same in radare2? is there any similar command in radare2 or something else?
7
votes
1answer
893 views

Radare2- How to see stdout in Visual Mode

How can I display any standard write in visual mode. For example if I run dc command it runs the program normally and displays all the text normally. But if I enter visual mode with V< enter > ...
0
votes
2answers
534 views

RFLAGS info and Radare?

Stepping through instructions I can see the result of rflags change, rflags C1PSI rflags 1PZI Is there anything that expands this into the appropriate flags. I know Z is Zero-flag, and P is Parity, ...
4
votes
1answer
161 views

rasm2 giving different output each time for x64

Disassembling is great but when trying to re-assemble to opcode it gives different results each time. Example: C:\>rasm2 -a x86 -b 64 -d "48898D80FEFFFF" mov qword [rbp - 0x180], rcx C:\>...
1
vote
2answers
397 views

Printing bytecode in bytes given a string of assembly for Radare to disassemble?

Megabeets determined in this answer that depending on asm.bits Radare may show either lea edx, [0x80490c8] (asm.bits=32) lea edx, [rip + 0x80490c8] (asm.bits=64) If I want to see what the ...
6
votes
2answers
4k views

Disassembly shows `LEA` with RIP?

When I disassemble this instruction using pad on Radare I get an LEA with rip [0x00000000]> pad 8d 15 c8 90 04 08 lea edx, [rip + 0x80490c8] I got this instruction from this post here I'm ...
3
votes
2answers
569 views

Can I provide bytes to Radare to be disassembled?

Let's say I want to check this guys work. He says that he is getting 8d 15 c8 90 04 08 lea 0x80490c8,%edx ba c8 90 04 08 mov $0x80490c8,%edx Is there an easy way with Radare to ...
2
votes
1answer
2k views

How does r2dec compare to pdc?

Radare has a command pdc pdc pseudo disassembler output in C-like syntax I'm curious to know how the plugin r2dec-js compares to pdc it seems like they do the same thing.
1
vote
1answer
1k views

How can I call a function in radare2 debug session?

In gdb I can easily do the following: (gdb) call function(arg) what is the equivalent in r2? There is no call function in debug session so this doesn't work: [0x08048795] call sym.func Inject ...
1
vote
1answer
208 views

radare2- Unable to use wopO command

I am new to radare2. I am trying out radare2 with exercise from Protostar stack0 I generate raw De Bruijn Patterns with below command $ ragg2 -P 500 -r ...
2
votes
1answer
468 views

Radare2 create section

Radare2 has S* commands, that can show, delete, modify sections. Is it possible to create new section in executable file and save it?
2
votes
3answers
1k views

Radare produces a bunch of `add byte [rax], al`, but why?

What does a bunch of add byte [rax], al mean? I see a lot of memory addressing point to specific parts of the shared library (.dll) that have for instance, this... 0x10064faf8 0000 ...
2
votes
1answer
3k views

Commands to step into and step over, outside of visual pane mode

The Radare book says Use F7 or s to step into and F8 or S to step over current instruction. But, I don't see it telling you how to do this with the d command. When I run d? I see ds[?] ...
2
votes
2answers
274 views

Radare using `pd` without the call graph lines?

If I run pd I get something like this, [0x00400540]> pd @ main + 4 0x0040064a 4883ec20 sub rsp, 0x20 0x0040064e 897dec mov dword [rbp - 0x14], edi ...
3
votes
2answers
3k views

How do you use the Radare debugger with command line arguments (parameters)?

If I want to debug ls I can run, radare -d /bin/ls But, how do I provide an argument or parameter to ls? Like I would do if I wanted to run radare -d /bin/ls -1. I've tried it like that without ...
1
vote
1answer
701 views

How to change a string in a arm 32bit lsb executable binary using radare2?

I have a arm 32bit lsb executable which prints "hello world" to the screen. How do I change the string to "Good bye" using radare2. I believe this will teach me the basics of RE and radare2. Thank ...
0
votes
2answers
2k views

How can i start the RE process in radare2?(make changes to the registers) [closed]

I'm an absolute newbie to reverse engineering. I have a 32bit lsb arm binary which I would like to reverse engineer using radare2. How should I begin ?
2
votes
1answer
803 views

No apparent entry point for stripped, PIE binary using radare2

I am running on 64-bit Windows 7 and am using radare2 to attempt both static and dynamic analysis of a binary executable. The issue is that I cannot seem to find the entry point of where the program ...
1
vote
2answers
467 views

Is there a way to get the headers with the Radare output?

When I use a command like fs, I get output like 0 0 * strings 1 6 * symbols 2 14 * sections 3 0 * relocs It's clear to me on the left is an incrementing number that represents the ...
0
votes
1answer
568 views

Radare can't seek to _start symbol

When I run is to show the symbols, I see [Symbols] 004 0x000000f0 0x006000f0 LOCAL NOTYPE 0 text1 005 0x000000cb 0x004000cb LOCAL NOTYPE 0 _print 006 0x000000d1 0x004000d1 LOCAL NOTYPE 0 ...
-1
votes
2answers
592 views

extract opcodes using radare

When we have many binaries, there is a python base solution for disassemble and extract opcodes from binaries in IDA program. Is there any or similar solution to disassemble binaries for Radare2?
2
votes
1answer
662 views

PDB file vs SDB file?

Radare has a format called a sdb. I asked a question here, What is an SDB file? The answer I got was, These sdbfiles contain function names (DLL's exports) and their equivalent ordinals for each ...
3
votes
3answers
239 views

Running just one function from an compiled executable or shared object?

Radare lets me view the assembly and pseudo-C code of a function. Can I run those instructions though outside of the process? Perhaps setting the register myself? If so, how would I go about doing ...
1
vote
3answers
248 views

What is the difference between a GLOBAL symbol and NONE?

I'm playing with a pe32 file. With is, Some of my symbols say GLOBAL others say NONE, 006 0x00027514 0x100428114 GLOBAL FUNC 0 k.exe_asdf .... 002 0x0002a808 0x10042c008 NONE FUNC 0 imp....
-2
votes
1answer
920 views

What does it mean when radare2 says “invalid”?

Just wondering what it means when in the visual display it shows invalid? Is that just a way of saying there is nothing at that address? 0x0003ce0c ff invalid 0x0003ce0d ff ...
3
votes
1answer
627 views

What is an SDB file?

In the abstract, I'm just wondering what an SDB file does and what role it plays. I see Radare2 is using them.. Here are some of the SDB files I have under ./libr/bin/d/dll/, what do these do? ./libr/...
-1
votes
1answer
203 views

What is a “goodboy/badboy” [closed]

I'm confused and I'm trying to follow the Radare 2 Crackme Challanges. In it, they say, This seems to be a goodboy/badboy. Is a "goodboy/badboy" lingo for a specific thing, and if so what?
4
votes
1answer
579 views

Difference between 'readelf' and 'radare2' addresses

I have an MIPS binary file that I want to analyze. I am having a little trouble understanding the way elfread and r2 interpret the adressing scheme from a binary. For example, r2 finds a function ...
3
votes
1answer
430 views

Disassemble CC2541 firmware (TI SensorTag)

I'm digging into a BLE product based on a CC2541 MCU (similar to the Texas Instruments SensorTag). So for experimenting we can use an official firmware: http://processors.wiki.ti.com/images/1/10/...
2
votes
1answer
1k views

Reverse Engineering BIOS (AMI A0.57)

Recently I got really interested in BIOS RE and I used chipsec to dump the content of SPI Flash ROM of my HP Omen Desktop PC to start my journey. But unlike older BIOSes, the binary file was pretty ...
2
votes
1answer
2k views

Radare2 set local variable

Is it possible to change the value of a local var within Radare2? I'm practicing with ESIL feature and now I want to set the value of local variable userInput: [0x080484e6]> afvd var userInput = ...
3
votes
2answers
175 views

Avatao R3v3rs3 2

I found this platform and its course path into Reverse Engineering. Although very easy (at first) I'm kinda stuck in this binary n.2. Binary looks pretty easy and straightforward, but I can't figure ...
7
votes
1answer
2k views

Radare2: inspecting renamed variables

I'm practicing with Radare2, latest commit. radare2 2.3.0-git 16814 @ linux-x86-64 git.2.2.0-5-g61a903315 During my sessions, I need to rename local variables to a more understandable name, e.g. ...
2
votes
1answer
2k views

Using stdin when debugging with r2pipe

I was using radare2 (2.2.0) with r2pipe (0.9.5) for python3 to debug the code generated by: #include <stdio.h> int main(){ char entrada[14]; gets(entrada); puts(entrada); ...
3
votes
2answers
2k views

How To Print Addresses in Radare2

I'm switching over to Radare2 from GDB mixed with peda. One of the things I love about GDB, is the p command. For example, p system prints out the address of system. As well, peda's searchmem function ...
9
votes
1answer
6k views

How to get a nice stack view in radare2?

This is the stack view that I'm getting in radare2 after entering the visual panel mode: This is the view from immunity debugger: How can I get a view similar to immunity debugger in radare2?
4
votes
2answers
866 views

radare2 get API library and name from address

When I disassemble a jmp I get: [0x004073d4]> pd 1 0x004073d4 ff2584804000 jmp dword [sym.imp.kernel32.dll_GetModuleHandleA] ; 0x408084 ; "j\x85" Is there a command I can get ...
6
votes
2answers
2k views

what is radare2's equivalent to GDB's 'find &system,+9999999,“/bin/sh”'

What is radare2's equivalent to GDB's find &system,+9999999,"/bin/sh"?
3
votes
2answers
1k views

Disassembling at a memory address

I started to use radare2 to debug a PE file because it stops working as soon as I run it. When I attach my debugger and continue execution to the point where the exception is thrown I get a memory ...
9
votes
1answer
1k views

Split view radare2 print heap

I recently start to use radare2 and I have a question How can I print info about the heap with dmhb dmhf etc. while debugging ? I would like to have the heap informations on the right and the ...