Questions tagged [radare2]

Opensource reverse engineering framework to disassemble, debug, analyze, manipulate binary files and more.

Filter by
Sorted by
Tagged with
2
votes
1answer
1k views

Reverse Engineering BIOS (AMI A0.57)

Recently I got really interested in BIOS RE and I used chipsec to dump the content of SPI Flash ROM of my HP Omen Desktop PC to start my journey. But unlike older BIOSes, the binary file was pretty ...
2
votes
1answer
2k views

Radare2 set local variable

Is it possible to change the value of a local var within Radare2? I'm practicing with ESIL feature and now I want to set the value of local variable userInput: [0x080484e6]> afvd var userInput = ...
3
votes
2answers
181 views

Avatao R3v3rs3 2

I found this platform and its course path into Reverse Engineering. Although very easy (at first) I'm kinda stuck in this binary n.2. Binary looks pretty easy and straightforward, but I can't figure ...
7
votes
1answer
2k views

Radare2: inspecting renamed variables

I'm practicing with Radare2, latest commit. radare2 2.3.0-git 16814 @ linux-x86-64 git.2.2.0-5-g61a903315 During my sessions, I need to rename local variables to a more understandable name, e.g. ...
2
votes
1answer
2k views

Using stdin when debugging with r2pipe

I was using radare2 (2.2.0) with r2pipe (0.9.5) for python3 to debug the code generated by: #include <stdio.h> int main(){ char entrada[14]; gets(entrada); puts(entrada); ...
3
votes
2answers
2k views

How To Print Addresses in Radare2

I'm switching over to Radare2 from GDB mixed with peda. One of the things I love about GDB, is the p command. For example, p system prints out the address of system. As well, peda's searchmem function ...
9
votes
1answer
7k views

How to get a nice stack view in radare2?

This is the stack view that I'm getting in radare2 after entering the visual panel mode: This is the view from immunity debugger: How can I get a view similar to immunity debugger in radare2?
4
votes
2answers
905 views

radare2 get API library and name from address

When I disassemble a jmp I get: [0x004073d4]> pd 1 0x004073d4 ff2584804000 jmp dword [sym.imp.kernel32.dll_GetModuleHandleA] ; 0x408084 ; "j\x85" Is there a command I can get ...
6
votes
2answers
2k views

what is radare2's equivalent to GDB's 'find &system,+9999999,“/bin/sh”'

What is radare2's equivalent to GDB's find &system,+9999999,"/bin/sh"?
3
votes
2answers
1k views

Disassembling at a memory address

I started to use radare2 to debug a PE file because it stops working as soon as I run it. When I attach my debugger and continue execution to the point where the exception is thrown I get a memory ...
9
votes
1answer
1k views

Split view radare2 print heap

I recently start to use radare2 and I have a question How can I print info about the heap with dmhb dmhf etc. while debugging ? I would like to have the heap informations on the right and the ...
2
votes
1answer
219 views

How to debug a hang application with radare2?

Could anyone tell me the basic steps and most used radare2 commands for debugging a hang x86 application to find the source of the hang? I know this question may sound a bit broad but I don't know ...
17
votes
1answer
3k views

Debugging with radare2 using two terminals

I have been trying to figure this out for quite some time now, and would really need some help. Firstly, some intro: I am running the newest version of radare2 from Github on a 64bit Ubuntu 16.04 and ...
4
votes
0answers
405 views

Radare2 project opening

When I open a project r2 -p mypoject I get a bunch of errors with some numbers: 0 0 Cannot add reference to non-function Cannot add reference to non-function 1482 I use latest version of radare2 ...
2
votes
0answers
95 views

radare2 specifying bitfield or enum width

I'm using radare2 to deconstruct a binary blob. When defining bit-field value there seems to be no syntax to specify the width of the field that contains the enum. For instance with a C structure as ...
1
vote
1answer
2k views

reversing stripped & statically linked binary with radare2

As the question says I need to reverse a stripped elf binary with radare2. This binary is also statically linked. I already reversed it in IDA by identifying statically linked libraries using lscan ...
3
votes
2answers
499 views

How to find paths from current offset to given address using radare2?

According to Radare2 documentation, this is the command to find paths: agt [addr] find paths from current offset to given address But when I try the command, after running aaaaa analysis, ...
2
votes
1answer
2k views

Disassembling MIPS 32 version 1 binary with the Radare2 Framework

I am trying to disassemble a MIPS 32 version 1 binary with the Radare2 framework. Here is the full output of the file command: ELF 32-bit LSB executable, MIPS, MIPS32 version 1 (SYSV), dynamically ...
6
votes
1answer
4k views

How to make radare2 work for a large binary?

I compiled cpython with debugging headers and I want to perform the following analysis using radare2. The problem I encounter is that it takes forever (at least 27 hours) to perform the aaa (...
5
votes
1answer
1k views

Radare2 doesn't display the whole function

I am using radare2, I have disassembled the function: sym.loop, it contains a switch witch has 4 cases that calls different functions. After any of the function call, the program exits the loop ...
2
votes
0answers
167 views

Radare2 - recursive traversal visual mode

I know that both pdf @ func and pdr @ func disassemble the function, the first using linear and the second recursive traversal disassembly. VV @ func shows the disassembled function in visual mode, ...
3
votes
1answer
3k views

How to print all functions of a binary using radare2 c/c++ API

I need to write a program (in c++), that among other things needs to know all functions of a given PE file. Basically, It's an equivalent of opening a binary with "r2 -A binary_name" and then entering ...
10
votes
1answer
7k views

How to find a symbol in a binary using radare2?

I want to find an address of a symbol (e.g strcpy) inside a binary using radare2. I tried to use the f command to list all flags which are recognized by r2 but the list is enormous and it's not ...
7
votes
1answer
9k views

Visual View in radare2 while debugging

I am using radare2 in debugging mode (r2 -d ./program). I set up a breakpoint at a certain address (db 0x12341234) And next I have entered Visual View using: V! Following some tutorials, I saw them ...
8
votes
1answer
3k views

radare2 ascii graph to image?

After analysing a function and pressing VV to go into graph mode, is it somehow possible to export/render the whole graph to an image? I have some huge main functions and it would be nice to have it ...
2
votes
1answer
250 views

Did radare2 remove support of MSIL from some version?

When I read the radare2 book here: https://radare.gitbooks.io/radare2book/content/ It said it support MSIL: " _d 16 32 64 msil PD .NET Microsoft Intermediate Language " However, when I git clone ...
-1
votes
1answer
312 views

Practicing what SHOULD be a simple crackme. Program calls strlen() but never returns

I'm trying out a crackme from the "LSE CTF" called "Blue Box" worth only 10 points. I've attempted this inside GDB and radare2... It is very simple, takes one argument and first checks to make sure ...
2
votes
2answers
172 views

Two arguments pushed on stack, callee only shows one argument

I have found myself confused while reversing some programs (specifically the IOLI Crackme challenges). I have no trouble solving them, but I have come across something that I do not understand and it ...
1
vote
4answers
5k views

reversing on windows x86_64 with radare2

I am trying to get radare2 to "run" on my windows7 64-bit system. I downloaded the radare2-1.5.0.zip file from http://radare.org, but when I unzip it and try to run any of the tools, I simply get "...
7
votes
2answers
18k views

How to use radare2 to disassemble an executable file?

I have a cgywin executable file (shall be in PE format) and would like to disassemble it to get the assembly code on the text section using radare2, most of the examples disassemble per instruction ...
6
votes
2answers
15k views

Radare2 C output

I made a simple hello world program, and put it in radare2. I then ran the pc command, which displayed C output. The output was this: #define _BUFFER_SIZE 256 const uint8_t buffer[256] = { 0x55, ...
5
votes
2answers
2k views

How to add a function symbol to a stripped executable with radare2?

I am struggling with a stripped binary, and I would like to visualize the main() function with the VVV command (ascii-art CFG representation). Usually, the steps are the following: #> r2 ./...
1
vote
1answer
1k views

Trying to identify a string in a strcmp instruction

Working to debug and analyze a piece of firmware, I've come across a bunch of cgi files which are all symlinked to a central cgi file. The first thing the main function does is run a series of string ...
2
votes
2answers
3k views

How to display .text section of a PE in radare2?

I used rabin2 -Sr myfilename to get the size of the .text section of myfilename. But, how can I dump the whole hexadecimal section of the .text onto an output file? My purpose is to read the byte ...
1
vote
2answers
4k views

Editing memory in radare2

It sounds like a stupid question but I honestly can't find the answer... I've looked at https://radare.gitbooks.io/radare2book/content/ and googled for hours but it still eludes me. How do I modify ...
1
vote
1answer
2k views

Finding hidden string location using radare2 on ELF binaries

I'm working through some reverse engineering sample programs (IOLI crackmes) crackme0x00 - crackme0x09 which are gcc compiled ELF format binaries. I was provided these by a colleague and can be ...
1
vote
2answers
1k views

How to determine architecture from firmware file

I have a .bin file from a vendors website that I want to walk through with radare2. I've determined that the device has a DRAM chip, a RTL8304 network controller and a DSPgroup dsp. Here's a link to ...
0
votes
2answers
245 views

Can Radare2 support word-oriented architectures?

I'd like to write a Radare2 plugin for a legacy 48-bit word-oriented CPU which has two 24-bit instructions per word, and, naturally, uses word addressing. I wrote a disassembler plugin which prints ...
3
votes
1answer
1k views

Radare2 console output?

I have been playing around with radare2, and i am wondering something that seems almost obvious to me but after much googling down the rabbit hole i can not find out how to view the console output of ...
0
votes
2answers
609 views

Reverse Engineering a binary file with no extension

Is it possible to reverse engineer a binary file with no extension? For example this file: https://github.com/commaai/openpilot/tree/master/selfdrive/visiond I have tried radare2 but it throws out ...
0
votes
2answers
7k views

edit instructions directly in visual mode

I know we can edit opcodes in radare2's visual mode using i. But is there any way to edit instructions directly in visual mode? In my case, instruction is jae 0x8048450, and i want change it to jnbe ...
1
vote
2answers
4k views

Binary patching using radare2 in debug mode

Im a newbe in radare and while I tried to patch a crackme binary, I opened it the first time in debug mode (-d), while debugging I used oo+ to reopen it with write mode, when I modify an instruction ...
-3
votes
2answers
1k views

What means sym prefix before functions name in radare2

What means sym prefix in disassembly? For examle, sym.main?
2
votes
1answer
2k views

Not in a function. Type 'df' to define it here

I'm trying to disassemble main of programs function in Visual Mode and i want to see Disassembly Graph, but radare2 show me this message: Not in a function. Type 'df' to define it here googling result ...
3
votes
0answers
181 views

Comparing two UEFI applications?

I have two x86-64 UEFI applications original.efi and patched.efi. I want to find out what have been changed in patched.efi and what these changes do. I have tried to use the Radare2 framework to ...
1
vote
1answer
353 views

Radare2: how to change operand from integer value to (flag + offset) in disassembly output?

this is Easy_ELF from Reversing.Kr Right now R2 displays absolute address for a character inside of a string: [0x08048454]> pdf ... 0x08048454 0fb60521a004. movzx eax, byte [0x804a021]...
9
votes
6answers
10k views

Radare2 (noob question) can't set breakpoint?

I was following this video: https://www.youtube.com/watch?v=3NTXFUxcKPc at the end it show how to do basic stuff with Radare2. When i try to set a break point with: db 0x004005bd where '0x004005bd' ...
1
vote
1answer
367 views

Why 0xc(%ebp) becomes dword [ebp+arg_3]?

I'm reversing an x86 binary and I have an instruction that using the at&t syntax is movl 0xc(%ebp), %eax while using the intel syntax is mov eax, dword [ebp+arg_3] I'm using radare2, and at ...
2
votes
2answers
1k views

Radare2 to show code hints like IDA Pro?

I am trying to disassemble a binary with radare2, as a free alternative to IDA. Here is how the IDA disassembly of that section looks like : Here is what I am doing with Radare2 (with an additional ...
0
votes
1answer
321 views

How to DUMP the full hexa of each function extracted by analysis of binary file?

I used a script python from radare2-bindings to write a code analysing a binary file, i extracted the name , the start address and the size of each function , but i can't dump the hexa of each ...