Paweł Łukasik
  • Member for 5 years, 1 month
  • Last seen this week
2 answers
0 votes
863 views
How does this command modify the condition?
Accepted answer
0 votes

What does the 3 columns in the radare2 visual mode represent? The first one is an address of the instruction, then opcodes followed by mnemonic. On the far left you have also some arrows indicating ...

View answer
1 answers
3 votes
160 views
Debug point not hit with radare2
Accepted answer
3 votes

Your breakpoint doesn't work as it is put in the part of the code that is not executed with the pass your provided. I'll try not to give too much hint so that you can still solve it by yourself. You ...

View answer
1 answers
2 votes
174 views
Why does -A (aaa) analysis show much more information, when using the -d (debug) CLI option in Radare2?
2 votes

It is probably due to the fact that you are trying to use r2 - a native disassembler/debugger to a .NET assembly which written in managed language and executed under CLR - Common Language Runtime. ...

View answer
2 answers
2 votes
367 views
Radare2 doesn't update current address, when single-step debugging using `ds`?
0 votes

What you can do is to use pd with the temporary seek operator @ passing rip register so that pd will work from that address. So instead of pd just use pd@rip and you should be fine with that. [...

View answer
1 answers
0 votes
388 views
Linux Assembly Syscall
Accepted answer
1 votes

It only uses the stack to pass the correct values to registers. If you analyse this shell code closely you will identify that all the stack operations are in the end results in some value being put in ...

View answer
2 answers
4 votes
4k views
How to disassemble a packed .NET executable?
1 votes

After you press 'Pause' you will end you in the message loop - that's ok. Go to the call-stack window and you should see your binary in on of the previous frames. Double click on one of them and dnSpy ...

View answer
3 answers
4 votes
4k views
Writing a file with radare2 `w`?
0 votes

Just to update @Megabeets answer. When you start with an empty file (created by touch), the w command will not work by default even if the r2 will be started in write mode. The missing information ...

View answer
1 answers
1 votes
49 views
How do I read the "ascii-art bar of metadata in file boundaries"?
Accepted answer
2 votes

You could get that by looking at the source code here. Each caracter represent a different things that a block can contain. They are checked in order (so that it doesn't mean only one thing can be in ...

View answer
1 answers
2 votes
4k views
What does this assembly language program output?
Accepted answer
8 votes

This is such a small program so this could be followed without converting it back to C. Let's break it down what happens when it's being called with asm(0xb6, 0xc6). push ebp mov ebp, esp ...

View answer
2 answers
1 votes
156 views
What is a "trit"?
3 votes

It's simply the value of the expression shown in the base of 3. [0x100001200]> ? 3 hex 0x3 octal 03 unit 3 segment 0000:0003 int32 3 string "\x03" binary 0b00000011 fvalue: 3.0 float: ...

View answer
2 answers
1 votes
1k views
.NET assembly IDA PRO, using LDSTR IL op code, how to patch a string?
1 votes

The opcode contains a number that is called mdToken. User-defined strings are located in Storage Stream that is called #US. You can find those while inspecting the file sections. There's a great ...

View answer
4 answers
4 votes
5k views
Calculation of jmp address through subtraction
3 votes

E9 is a relative jump and since it was supposed to be inserted at the beginning of the function then sub-tracting the two addresses is the way to go for calculating the difference in bytes. Why ...

View answer
1 answers
1 votes
105 views
Addresses displayed in radare2
4 votes

The difference is that the first address, 0x00602090 is the location from where the value will be loaded into the rax register. The second one, 0x400c60 is what is located in that memory location. r2 ...

View answer
2 answers
1 votes
3k views
Get function from memory address with radare2
2 votes

You need to go the address by using the s addr command but after that, you can just use a shorthand to going to the beginning of the function you are in. Just type: sf. to get to the beginning. ...

View answer
2 answers
6 votes
4k views
What are the difference syscall and int 0x2E instructions?
4 votes

int 2Eh is used on 32bit OS to enter the kernel mode. On 64-bit, the same is obtained by using syscall. The check done on memory address 0x7ffe0300 is one of the ways to detect the bitness.

View answer
2 answers
2 votes
89 views
Headers for `iz` and such in key=value format?
Accepted answer
2 votes

Not sure what version was used by Megabeets for this article but this output format output was changed in this commit. You can change this #if 0 locally and rebuild or you can use json format to get ...

View answer
1 answers
1 votes
135 views
OD mode change from kernel to normal
1 votes

If I get you question correctly, you want to change where OllyDbg breaks first when the executable is loaded. You can change that by going to: Options -> Option.... And then selecting the Startup and ...

View answer
1 answers
-3 votes
680 views
Change value of an IF condition found in IDA
Accepted answer
0 votes

The way how those IFs are constructed in the assembly is a bit different than what you see in high-level overview in IDA code. Apart from the first one, ifs are represented with subtraction (sub &...

View answer
2 answers
1 votes
2k views
Resource Hacker and IDA PRO
1 votes

Those are placed in resources and by default IDA doesn't load this data. To change that, tick the checkbox on the 'Load a new file' dialog. Next you can go the this segment by pressing CTRL+S and ...

View answer
3 answers
4 votes
299 views
Obfuscated code analysis - can unused variables be ignored?
Accepted answer
5 votes

This might be true that those variables are added only to confuse analysis but remember that in Javascript there are so many ways to access the variable that I would take such info from an automated ...

View answer
1 answers
1 votes
328 views
IDA PRO does miss calls when tracing
Accepted answer
1 votes

TranslateMessage & DispatchgMessage are the standard windows functions when you are dealing with WinAPI and messages loops. When a DispatchMessage is called, the message stored in esi is ...

View answer
2 answers
1 votes
6k views
Comparison between orginal and modified DLL files with x64dbg
2 votes

You shouldn't use a debugger to search for differences. You should use a diff tool. Of course, most diff tools works on text, but there are some that deal with the binary files. Some examples: ...

View answer
2 answers
3 votes
366 views
Win32 SEH address
Accepted answer
1 votes

Well the comment: "Install new handler" is a bit misleading. What you are installing is EXCEPTION_REGISTRATION_RECORD and if you would check how this structure looks like it would be more obvious that ...

View answer
2 answers
3 votes
2k views
How do I find all references to an address with a memory segment?
1 votes

By looking how this function is implemented, it looks like there's no option for this (but go ask on r2's on Telegram). It just takes a string that's being converted to a number and that's all. If you ...

View answer
1 answers
0 votes
57 views
What is the difference between xrefs and stack trace?
2 votes

x-refs is just a static cross-reference in the binary that can be identified during static-analysis. So if you main call funcA you could tell that by looking at x-refs on funcA. But you can't be ...

View answer
4 answers
11 votes
8k views
How can breakpoint be set using offset in ELF file, not virtual address?
4 votes

You can't do this in vanilla gdb but if you are using pwndbg you can. The command is called breakrva or brva for short. You can use it like this: brva 0x520 but the program has to run.

View answer
2 answers
1 votes
921 views
How do I tell OllyDbg where my source code is?
0 votes

OllDbg is a Windows tool and thus using a windows library dbghelp.dll to do the debugging work. You can tell that by listing Olly's dlls: And dbghelp.dll uses symbol files to link the binary ...

View answer
1 answers
3 votes
1k views
grep -E with Radare2
Accepted answer
6 votes

Radare's grep is done by using the ~ character. ~?<br> |Usage: [command]~[modifier][word,word][endmodifier][[column]][:line] So to have the output you want just run: iI~bits,pic,stripped [...

View answer
2 answers
3 votes
317 views
Why doesn't this retn instruction return from the function?
7 votes

The address of sub_1313cba4 is moved to PC/IP but not directly, as this cannot be done. It is done by pushing the address to the stack and relying on the fact that retn will get what's on the top of ...

View answer
2 answers
4 votes
922 views
Radare2 - How to scale panel height in visual panels mode?
3 votes

I'm not sure if there is an option for that. What you could do is to close Registers and some other frames that you do not use at the moment thus creating more space for the registers. To close the ...

View answer