Megabeets
  • Member for 5 years
  • Last seen more than a month ago
Debugging with radare2 using two terminals
Accepted answer
27 votes

It is actually very simple and works for me just fine as you can see in the following gif: First you need to figure out the tty of the terminal you want to redirect the STDIO to (a.k.a Terminal 2, T2)...

View answer
How to make radare2 work for a large binary?
Accepted answer
21 votes

It is not a good practice to run full analysis of your binary at the startup and it also isn't encourged by radare. Running aaa by default is a heavy action and absolutely not recommended or needed in ...

View answer
How to generate the call graph of a binary file?
Accepted answer
20 votes

You can use radare2 or one of the alternatives below to generate a full call-graph in dot format. radare2 Installation First of all, install radare2 from git repository: $ git clone https://...

View answer
How do you search for unicode strings?
Accepted answer
18 votes

Enter the "strings window" by either press shift+F12 or go to View > Open Subviews > Strings in the toolbar. Then, in the strings window, press Right Click and choose "Setup...". Check "Unicode"...

View answer
Writing ELF headers in Radare?
Accepted answer
16 votes

Yes, obviously you can. radare2 has built-in features to handle binary headers. This including reading, parsing and modifying the headers of the binary. And this is not different for elf or pe files, ...

View answer
How to find a symbol in a binary using radare2?
Accepted answer
15 votes

The f command is used to list all the flags from the selected flagspace. By default all the available flagspaces are selected. In order to select the 'symbols' flagspace and list only the flags inside ...

View answer
Radare2 C output
15 votes

The pc command will output n bytes from the current seek (s) as a C array, where n is the Block size (b) or the length mentioned in the command. The output is then can be used to, for example, ...

View answer
Import table vs Import Address Table
Accepted answer
14 votes

As general, I recommend reading the PE Format documentation on MSDN regarding the PE structure. Import Table The Import Table is actually called "Import Directory Table" and contains entries for ...

View answer
What is a free & open source alternative to IDA Pro for MacOS?
Accepted answer
14 votes

I highly recommend radare2 which seems to suit you the best: radare2 is an open source framework for reverse engineering and binary analysis which implements a rich command line interface for ...

View answer
Is there any tool to visually see program stack in linux while debugging?
12 votes

You can easily view it using Visual Panels in radare2. Here's a teaser: Installation First of all, install radare2 from git repository: $ git clone https://github.com/radare/radare2.git $ cd radare2 $...

View answer
Visual View in radare2 while debugging
Accepted answer
11 votes

First of all, make sure you run the latest version of radare2 from git repository: $ git clone https://github.com/radare/radare2.git $ cd radare2 $ ./sys/install.sh If you don’t want to install the ...

View answer
Import symbols containing strange characters
Accepted answer
10 votes

These "weird" names are produced by the compiler and are called Name Mangling or Name Decoration. These names are shown by radare2 but are not produced or generated by it. To quote from MSDN: ...

View answer
Bypass IsDebuggerPresent
Accepted answer
10 votes

Let's have a look of the function's description in MSDN: Determines whether the calling process is being debugged by a user-mode debugger As you guessed, this function is commonly used as an ...

View answer
Split view radare2 print heap
Accepted answer
10 votes

You can use | or = in Visual Mode to split horizontally and vertically respectively. Open your file in debug mode and go to Visual Mode by pressing V, then press p until you reach the assembly view: ...

View answer
How tools like PEiD find out the compiler and its version.
10 votes

The signature database of many Compiler and Packer detectors, and sometimes even their source-code, is freely available and you can actually read the signatures in clear-text. Genrally, the ...

View answer
radare2 ascii graph to image?
Accepted answer
9 votes

The ag command and subcommands can help you to output the visual graph into Graphviz format. [0x00000000]> ag? Usage: ag<graphtype><format> [addr] Graph commands: | aga[format] ...

View answer
What is the info displayed by radare2's afl?
Accepted answer
9 votes

First, I'll answer your question straightly: 2nd column: The number of basic blocks in the function 3rd column: The size of the function (in bytes) 4th column: The function's name You might have ...

View answer
How to get a nice stack view in radare2?
Accepted answer
9 votes

You have several ways to print the stack. The specific way that you're searching for is called Stack Telescoping and you can print it like this: pxr @ esp Use sp, esp, and rsp according to your ...

View answer
How to print the value of register with Radare 2
Accepted answer
8 votes

Printing the registry values in radare2 is quite simple. All registers You can print all the General Purpose registers using dr: [0x55bea3305070]> dr rax = 0x55bea3305070 rbx = 0x00000000 rcx = ...

View answer
Disassembly shows `LEA` with RIP?
Accepted answer
8 votes

It is simply a matter of bits. In the example shown, the hexpairs are disassembled using 64bit assembly, and you probably want to change it to a 32bit assembly. Just tell radare that you are working ...

View answer
Finding the encryption key in a binary - IDA Pro and how an S-box might be represented in the binary
Accepted answer
8 votes

Initialization of the forward S-box As you probably saw in the source-code, the forward S-box is present several times and initialized at two different places. The first time that the forward S-box ...

View answer
what is radare2's equivalent to GDB's 'find &system,+9999999,"/bin/sh"'
Accepted answer
8 votes

First and foremost we should open the binary in debug mode with radare2 $ r2 -d file The string /bin/sh resides in the system function of libc so the library should first be loaded to the memory in ...

View answer
Detecting hardware breakpoints
Accepted answer
8 votes

This is a really good question since this topic isn't as popular as anti-debugging techniques to detect software breakpoints. Since you didn't mention the architecture we have to keep in mind that ...

View answer
How work this obfuscation, and how deobfuscate?
Accepted answer
8 votes

This obfuscated code is taking advantage of the wide possibilities to name Javascript variables. This makes a simple-obfuscated Javascript code to look much more scarier. As noted in the great ...

View answer
Radare2 Debugging: How do I pipe a program's output to another's input?
Accepted answer
7 votes

This is a great question, and lucky you - radare2 provides several ways to achieve this. Let's go over the more basic and straightforward options. Setting up First things first, make sure to have ...

View answer
How to write [sp+local_variable] in radare2
Accepted answer
7 votes

So to make an order from the comments - you can do it by using two approaches. Use the original opcodes and write them using wx which stands for "write hex": wx e10b00f9 If you still want to use wa ...

View answer
Is there a way to explicitly connect r2pipe to an existing radare2 session that I have open?
Accepted answer
7 votes

I'm not sure I fully understood you, but I'll give it a try anyway. The following instructions will explain how to achieve something like this:| radare2 comes with its own webserver. Although at ...

View answer
dnSpy - What do these symbols mean?
Accepted answer
7 votes

These are Unicode characters that are not supported by the font used by dnSpy. Usually, you'll see it when the code is obfuscated or in cases where the developer used languages as Chinese and Russian ...

View answer
Radare2 Find command line arguments and location in stack
Accepted answer
7 votes

radare2 currently doesn't flags argv and argc. Yet, it shouldn't be something complicated to implement. Although these arguments are not flagged by radare2, they can be easily be visible to us by ...

View answer
Flare-ON#3: Problem understanding some parts in the program
Accepted answer
7 votes

Should not the location be empty or have some other values than assembly instructions...? The answer is "no". As the author stated in the write-up, this binary is self-modifying: At this stage you ...

View answer
1
2 3 4 5