Skip to main content
28 votes
Accepted

Debugging with radare2 using two terminals

It is actually very simple and works for me just fine as you can see in the following gif: First you need to figure out the tty of the terminal you want to redirect the STDIO to (a.k.a Terminal 2, T2)...
Megabeets's user avatar
  • 8,999
24 votes
Accepted

How to make radare2 work for a large binary?

It is not a good practice to run full analysis of your binary at the startup and it also isn't encourged by radare. Running aaa by default is a heavy action and absolutely not recommended or needed in ...
Megabeets's user avatar
  • 8,999
20 votes

Radare2 C output

The pc command will output n bytes from the current seek (s) as a C array, where n is the Block size (b) or the length mentioned in the command. The output is then can be used to, for example, ...
Megabeets's user avatar
  • 8,999
16 votes
Accepted

How to find a symbol in a binary using radare2?

The f command is used to list all the flags from the selected flagspace. By default all the available flagspaces are selected. In order to select the 'symbols' flagspace and list only the flags inside ...
Megabeets's user avatar
  • 8,999
15 votes

How to use radare2 to disassemble an executable file?

First, you have to understand that the pdf command is used to disassemble functions, so you first have to look for function starting points (I think that they are using symbols and some others ...
perror's user avatar
  • 19.1k
15 votes
Accepted

Writing ELF headers in Radare?

Yes, obviously you can. radare2 has built-in features to handle binary headers. This including reading, parsing and modifying the headers of the binary. And this is not different for elf or pe files, ...
Megabeets's user avatar
  • 8,999
13 votes
Accepted

How to get a nice stack view in radare2?

You have several ways to print the stack. The specific way that you're searching for is called Stack Telescoping and you can print it like this: pxr @ esp Use sp, esp, and rsp according to your ...
Megabeets's user avatar
  • 8,999
11 votes
Accepted

Method disassembly of Objective C Mach-O with Radare 2

Essentially, it's the following workflow: r2 -A /path/to/binary // load the binary and perform initial analysis afl // print function symbols pdf @sym.of.interest // ...
ikaerom's user avatar
  • 261
11 votes
Accepted

Visual View in radare2 while debugging

First of all, make sure you run the latest version of radare2 from git repository: $ git clone https://github.com/radare/radare2.git $ cd radare2 $ ./sys/install.sh If you don’t want to install the ...
Megabeets's user avatar
  • 8,999
11 votes
Accepted

How to print the value of register with Radare 2

Printing the registry values in radare2 is quite simple. All registers You can print all the General Purpose registers using dr: [0x55bea3305070]> dr rax = 0x55bea3305070 rbx = 0x00000000 rcx = ...
Megabeets's user avatar
  • 8,999
10 votes
Accepted

Split view radare2 print heap

You can use | or = in Visual Mode to split horizontally and vertically respectively. Open your file in debug mode and go to Visual Mode by pressing V, then press p until you reach the assembly view: ...
Megabeets's user avatar
  • 8,999
10 votes
Accepted

Import symbols containing strange characters

These "weird" names are produced by the compiler and are called Name Mangling or Name Decoration. These names are shown by radare2 but are not produced or generated by it. To quote from MSDN: ...
Megabeets's user avatar
  • 8,999
9 votes
Accepted

How to add a function symbol to a stripped executable with radare2?

I know it's been over a year since you've asked this question, but I thought in the interest of anyone else who may have come across this question like me, I would field an answer. There are a few ...
Ian Kerr's user avatar
  • 206
9 votes
Accepted

radare2 ascii graph to image?

The ag command and subcommands can help you to output the visual graph into Graphviz format. [0x00000000]> ag? Usage: ag<graphtype><format> [addr] Graph commands: | aga[format] ...
Megabeets's user avatar
  • 8,999
9 votes
Accepted

What does XREF mean?

Cross References (or simply XREFs) is a feature of disassemblers to show you where certain functions and objects were called from or which functions and objects are used by a specific function. We can ...
Megabeets's user avatar
  • 8,999
9 votes
Accepted

What is the info displayed by radare2's afl?

First, I'll answer your question straightly: 2nd column: The number of basic blocks in the function 3rd column: The size of the function (in bytes) 4th column: The function's name You might have ...
Megabeets's user avatar
  • 8,999
9 votes
Accepted

Heap Chunk Structure Does Not Contain Previous Section Info

The diagram you linked to seems to be wrong. The size of the previous chunk is stored in the current chunk iff, the previous chunk is free. This image is more appropriate of what an allocated heap ...
0xec's user avatar
  • 6,090
8 votes

Radare2 (noob question) can't set breakpoint?

Run radare2 in debug mode. r2 -d
Weeruhputt Supsohmboon's user avatar
8 votes
Accepted

what is radare2's equivalent to GDB's 'find &system,+9999999,"/bin/sh"'

First and foremost we should open the binary in debug mode with radare2 $ r2 -d file The string /bin/sh resides in the system function of libc so the library should first be loaded to the memory in ...
Megabeets's user avatar
  • 8,999
8 votes
Accepted

Disassembly shows `LEA` with RIP?

It is simply a matter of bits. In the example shown, the hexpairs are disassembled using 64bit assembly, and you probably want to change it to a 32bit assembly. Just tell radare that you are working ...
Megabeets's user avatar
  • 8,999
8 votes
Accepted

Viewing Radare keybindings for Visual Pane mode (Function hotkeys)?

Those are probably used if you remap the default ones. And those are visible when you press ? in Visual mode, but not in Visual Pane mode (V!). Scrolling down will show the keys for debugging: ...
Paweł Łukasik's user avatar
8 votes
Accepted

Radare2 Debugging: How do I pipe a program's output to another's input?

This is a great question, and lucky you - radare2 provides several ways to achieve this. Let's go over the more basic and straightforward options. Setting up First things first, make sure to have ...
Megabeets's user avatar
  • 8,999
8 votes
Accepted

Way to get basic blocks of a binary using Ghidra

You can obtain the list of all defined basic blocks using BasicBlockModel Example from ghidra.program.model.block import BasicBlockModel from ghidra.util.task import TaskMonitor bbm = ...
0xec's user avatar
  • 6,090
8 votes
Accepted

Ghidra + IDA cant detect a string but Radare2 can

I don't know the exact length of string. But, few things to note here are as follows: Ghidra and IDA has a minimum bound on size of string to recover correct type (ghidra has a limit - or lower bound ...
R4444's user avatar
  • 1,807
7 votes
Accepted

reversing stripped & statically linked binary with radare2

Seems like lscan is written to work with IDA. However, lscan is based on FLIRT signature files which can be also read by radare2 (See the Zignatures section of this answer). There are several things ...
Megabeets's user avatar
  • 8,999
7 votes
Accepted

Radare2 Find command line arguments and location in stack

radare2 currently doesn't flags argv and argc. Yet, it shouldn't be something complicated to implement. Although these arguments are not flagged by radare2, they can be easily be visible to us by ...
Megabeets's user avatar
  • 8,999
7 votes
Accepted

Is there a way to explicitly connect r2pipe to an existing radare2 session that I have open?

I'm not sure I fully understood you, but I'll give it a try anyway. The following instructions will explain how to achieve something like this:| radare2 comes with its own webserver. Although at ...
Megabeets's user avatar
  • 8,999
7 votes
Accepted

How to write [sp+local_variable] in radare2

So to make an order from the comments - you can do it by using two approaches. Use the original opcodes and write them using wx which stands for "write hex": wx e10b00f9 If you still want to use wa ...
Megabeets's user avatar
  • 8,999
7 votes
Accepted

Understanding branch delay slots for reversing MIPS

The instruction in the branch delay slot is evaluated after the branch (or jump) instruction. The execution of the instruction in the branch delay slot does not impact the evaluation of the branch ...
ChrisG's user avatar
  • 86
7 votes
Accepted

Writing a file with radare2 `w`?

TLDR radare2 opens a file in read-only mode by default. (see the manual r2 -h for further information.) to allow writing to a file, start radare2 in write mode (r2 -w file). when in a read-only ...
Megabeets's user avatar
  • 8,999

Only top scored, non community-wiki answers of a minimum length are eligible