Megabeets
  • Member for 5 years
  • Last seen more than a month ago
Creating a struct in IDA which contains a cString?
1 votes

IDA introduced "Variable Length Structures" and describe the usage of it with a very straight forward tutorial. In short, you need to make sure the "flexible" item is the last item ...

View answer
Reverse engineer .so file from android app with radare2
4 votes

There are several ways to show the different functions of a binary file in radare2. Start by opening the binary file and analyze it. $ r2 -A libdbm64.so Command: afl The simplest way to list the ...

View answer
Radare2 Debugging: How do I pipe a program's output to another's input?
Accepted answer
7 votes

This is a great question, and lucky you - radare2 provides several ways to achieve this. Let's go over the more basic and straightforward options. Setting up First things first, make sure to have ...

View answer
Radare2 produces null bytes on write
2 votes

This was probably a bug which I can't reproduce this now. My guess is that the VA is moved and now this address doesn't contain anything. If this bug still happens, please open an issue describing it ...

View answer
Is there any way to display the standard input and output of a program to Cutter's console while debugging?
Accepted answer
5 votes

Good news! In Cutter v1.10 (December 20, 2019) the team introduced native and remote debugger support. By default, the STDIO of the debuggee is redirected to the Console Widget inside Cutter. ...

View answer
Meaning of Flags in ELF Section header?
Accepted answer
4 votes

The flag abbreviation of the letter "I" stands for SHF_INFO_LINK. Since readelf is open-source you can access its code to verify this. This will also show you the full list of Flag possibilities: ......

View answer
How to print the value of register with Radare 2
Accepted answer
8 votes

Printing the registry values in radare2 is quite simple. All registers You can print all the General Purpose registers using dr: [0x55bea3305070]> dr rax = 0x55bea3305070 rbx = 0x00000000 rcx = ...

View answer
radare2 how to interpret ascii-art color bars?
Accepted answer
2 votes

This chart describes the different Sections and Memory Segments in your binary. Each row in the chart is a different section where its name is in the rightest column. From the left, you can see its ...

View answer
Radare2 Disassembler How Do You Organize Visual Panels (V!)?
6 votes

Use TAB to move between the windows, use e to change name and command of a specific panel you are on. Use w to enter the window mode. "Window mode" allows you to control how the panels look like. In ...

View answer
Function names syntax returned by radare2's afl?
Accepted answer
5 votes

I will start by answering your specific three questions, and then will shed more light about the naming structure of functions in radare2. What is the meaning of the hexadecimal number after the ...

View answer
How to make Radare2 automatically disassemble next instruction after each `ds` debug single-step?
Accepted answer
2 votes

If you want to execute another command after doing ds you can simply use ; to add a new command. So for example, the command ds; pd 1 @ rip will step one instruction and disassemble the instruction at ...

View answer
How to identify different memory regions of an elf binary in radare2?
Accepted answer
2 votes

It is possible to list the sections and segments of a program using radare2. Sections Use iS to list the program's Sections: [0x00001c50]> iS [Sections] Nm Paddr Size Vaddr Memsz Perms ...

View answer
Writing ELF headers in Radare?
Accepted answer
16 votes

Yes, obviously you can. radare2 has built-in features to handle binary headers. This including reading, parsing and modifying the headers of the binary. And this is not different for elf or pe files, ...

View answer
Make r2 -i <script> use python3 rather than python2
Accepted answer
3 votes

OP did not mention their OS, thus I assume the OS is Linux. radare2 is using the default python version on your machine. That means that, probably, /usr/bin/python on your machine points to /usr/bin/...

View answer
Learning fine grained analysis in Radare with `a`?
2 votes

Binary analysis is not a simple thing and it is structured from a lot of different tasks that together might create a heavy and slow task. In order to get the best results, you need to understand what ...

View answer
Radare's `aaaa` and -AA what does it do, exactly?
Accepted answer
2 votes

When you execute the aaa command, radare is showing you what are the steps it takes. Each step has the command responsible for it inside parentheses. [0x00000000]> aaa [x] Analyze all flags ...

View answer
Writing a file with radare2 `w`?
Accepted answer
6 votes

TLDR radare2 opens a file in read-only mode by default. (see the manual r2 -h for further information.) to allow writing to a file, start radare2 in write mode (r2 -w file). when in a read-only ...

View answer
Does the Radare Debugger support STABS?
1 votes

radare2 is not a source level debugger, thus there is no support for STABS. That said, you can always use gdb as a backend for radare2 either by connecting radare2 to a running gdb session or by using ...

View answer
What does paddr, baddr, laddr, haddr, and hvaddr refer to?
Accepted answer
5 votes

Most of the time, you would not need any of these except the vaddr and the paddr. Since thoroughly explaining each of these names would take too much time, I'll share here the short meaning of each of ...

View answer
What is the right way to pack a payload with Python3's pwntools
Accepted answer
2 votes

Actually, this is a programming question and not an RE question. Anyway, you simply need to tell python to treat your payload as bytes by adding the bytes-literal b before the 'A'*140. >>> ...

View answer
`dmi libc puts~GLOBAL` does not show puts, just putspent?
Accepted answer
2 votes

This is right, and it was caused by using the wrong grep (the ~ character) in the article. This was due the fact that the output of dmi libc is different on different machines and also, the syntax of ...

View answer
What does the `$r` do in `pd $r`?
Accepted answer
4 votes

$r is one of the variables available in radare2. More specifically, $r is a variable which holds the height of the console. This command is shown on Visual Disassembly mode (Vp) and usually is not ...

View answer
How do I view the registers as signed intergers?
2 votes

Although radare2 provides a rich amount of commands to handle registers (see dr?), it is quite tricky to view the values of the registers in decimal mode. That said, I will show you two simple ...

View answer
How can you get the symbol visibility with radare?
Accepted answer
5 votes

afaik, Symbol Visibility is not available in radare2. The closest to this you can get are the symbol bindings and types. You can do this with the is command which is responsible for showing symbols. $...

View answer
Working with 16bit offsets and segments in Radare2
Accepted answer
3 votes

You can use -m 0x100 to load the binary at a specific address, as can be seen in r2 -h output: -m [addr] map file at given address (loadaddr) So you can do something like this: $ r2 -m 0x100 -...

View answer
radare2 labels are not displayed in jmp instructions
Accepted answer
5 votes

You should use a flag name which is separated by a dot. This is intended since registers and other stuff are also flags and to avoid overriding and confusion. For example, instead of this: [...

View answer
rasm2 giving different output each time for x64
2 votes

This was a bug, and the issue that was opened by OP is now fixed on radare2 Master and on the latest releases. $ rasm2 -a x86 -b 64 -d "48898D80FEFFFF" mov qword [rbp - 0x180], rcx $ rasm2 -a x86 -...

View answer
Radare2 debugging - How to get into lazy imported functions?
Accepted answer
4 votes

The sym.imp.* symbols are pointing to the plt and this is intended. In order to locate a specific function of a loaded module/library, you need to use the dmi command and its subcommands. To follow ...

View answer
Import symbols containing strange characters
Accepted answer
10 votes

These "weird" names are produced by the compiler and are called Name Mangling or Name Decoration. These names are shown by radare2 but are not produced or generated by it. To quote from MSDN: ...

View answer
How do you print fixed width strings with radare's print format `pf`?
Accepted answer
4 votes

To understand how to use pf the way you want, we should go over it step-by-step. I opened an empty memory for a radare2 playground: $ r2 malloc://200 [0x00000000]> Next, I wrote date to this ...

View answer
1
2 3 4 5