Megabeets
  • Member for 5 years
  • Last seen more than a month ago
Reverse engineer .so file from android app with radare2
4 votes

There are several ways to show the different functions of a binary file in radare2. Start by opening the binary file and analyze it. $ r2 -A libdbm64.so Command: afl The simplest way to list the ...

View answer
Meaning of Flags in ELF Section header?
Accepted answer
4 votes

The flag abbreviation of the letter "I" stands for SHF_INFO_LINK. Since readelf is open-source you can access its code to verify this. This will also show you the full list of Flag possibilities: ......

View answer
What does the `$r` do in `pd $r`?
Accepted answer
4 votes

$r is one of the variables available in radare2. More specifically, $r is a variable which holds the height of the console. This command is shown on Visual Disassembly mode (Vp) and usually is not ...

View answer
Basic question: how to input non-printable hex values in GDB / NC?
Accepted answer
4 votes

Well, you have several options to do so. These are the two simplest: Supplying the input through the pipeline: $ python -c "print '\xde\xad\xbe\xef'" | ./binary $ python -c "print 0xdeadbeef" | ./...

View answer
Radare2 debugging - How to get into lazy imported functions?
Accepted answer
4 votes

The sym.imp.* symbols are pointing to the plt and this is intended. In order to locate a specific function of a loaded module/library, you need to use the dmi command and its subcommands. To follow ...

View answer
How do you print fixed width strings with radare's print format `pf`?
Accepted answer
4 votes

To understand how to use pf the way you want, we should go over it step-by-step. I opened an empty memory for a radare2 playground: $ r2 malloc://200 [0x00000000]> Next, I wrote date to this ...

View answer
How do I find out what section variables and strings are defined in?
Accepted answer
4 votes

In the following answer, I'll show you several ways to achieve what you want. I'll use different approaches to do this with radre2. First, let's create a program with a bit longer strings: $ cat ...

View answer
How can I fix the problem of IDA view and corresponding HEX view not being in sync?
Accepted answer
4 votes

Did you validate that your Hex-View is Synchronized with the IDA View? In order to do this, go to the Hex View tab, Right Click anywhere in the view and choose "Synchronize With > IDA View": This ...

View answer
What are these sub_XXX things in IDA's disassembly?
4 votes

These are functions in the binary that were detected by IDA. These names are automatically generated by IDA and are not part of the binary's symbol table. The automatically generated names usually ...

View answer
How do you use the Radare debugger with command line arguments (parameters)?
4 votes

Seems like radare has problems with passing arguments starting with dash ("-"). Please consider open an issue. Anyway, you can pass arguments to radare2 debugged program in several ways. The ...

View answer
How to change a string in a arm 32bit lsb executable binary using radare2?
Accepted answer
4 votes

Let's start from writing a simple Hello, World program and compile it. beet:/tmp$ cat helloworld.c #include <stdio.h> int main() { printf("Hello, World!\n"); return 0; } beet:/tmp$ gcc ...

View answer
How can i start the RE process in radare2?(make changes to the registers)
4 votes

It's not clear exactly what are you asking for, so I'll start from the basic. Reverse Engineering 101 If you don't have previous experience with assembly or reverse engineering I'd suggest you to ...

View answer
Radare can't seek to _start symbol
Accepted answer
4 votes

You can't seek to any symbol that shown by is, you can only seek to "flags" or addresses. The f command is used to list all the flags from the selected flagspace. By default all the available ...

View answer
PDB file vs SDB file?
4 votes

While sdb files was created to translate imports that are referenced by ordinal instead of by name (see "Exporting Functions from a DLL by Ordinal Rather Than by Name"), pdb files are something ...

View answer
What is an SDB file?
Accepted answer
4 votes

SDB stands for String Database. sdb is a simple string key/value database based on cdb disk storage and supports JSON and arrays introspection. You can see the SDB commands listed with the k ...

View answer
How To Print Addresses in Radare2
Accepted answer
4 votes

To print the address of system export of libc with radare2 you can use dmi libc system First you need to open radare2 and continue executing until you reach the program’s entrypoint. You have to do ...

View answer
IDA python, write to specific memory location
4 votes

Byte(), Word() and Dword() are idapython's functions and every try to assign a value to a function call in python will end up with "SyntaxError: can't assign to function call". These 3 functions you ...

View answer
radare2 get API library and name from address
Accepted answer
4 votes

sym.imp.kernel32.dll_GetModuleHandleA is a flag radare2 defined for this address. This flag name is combined from 4 parts: sym for Symbols imp for Imports kernel32.dll is the name of the library ...

View answer
Searching for comments in ollydbg
Accepted answer
4 votes

Searching for user comments can be done like this: OllyDbg V1 Right Click >> Search for >> User-defined comment OllyDbg V2 Right Click >> Search for >> All user comments ...

View answer
Are there any project based books that teach reverse engineering?
Accepted answer
4 votes

You are right, most of the RE books out there are more generic and consists of dozens of different examples and not project oriented. Moreover, they're mostly focused on software reverse engineering. ...

View answer
x86 ASM question about hexadecimal numbers and how to transfer them
4 votes

Most assemblers require numeric constants to begin with a digit, this is so they can distinguish between them and labels. You can see it in FASM Fundamental syntax rules: Numbers are ...

View answer
Searching for strings in ollydbg
Accepted answer
4 votes

From my experience, OllyDbg is not so good with handling string references. Is it because the search only looks for strings which are used in functions? As far as I know, "Search for >> All ...

View answer
How find all subroutine calls using Hopper?
4 votes

If I correctly understand your question, you are searching for the Cross References feature in Hopper. Cross References Cross References (or simply XREFs) is a feature of disassemblers to show you ...

View answer
ARM "add" instruction with shift
Accepted answer
4 votes

It's a Circular Shift on a 32-bit system. Circular Shift In computer programming, a circular shift (or bitwise rotation) is a shift operator that shifts all bits of its operand. Unlike an ...

View answer
Disassembling MIPS 32 version 1 binary with the Radare2 Framework
Accepted answer
4 votes

First of all, make sure you run the latest version of radare2 from git repository: $ git clone https://github.com/radare/radare2.git $ cd radare2 $ ./sys/install.sh If you don’t want to install the ...

View answer
Changing the font in immunity debugger?
Accepted answer
4 votes

Trying to figure out the problem I came with the following solution: Open Immunity Debugger as an Administrator Go to Options >> Appearance >> Fonts Rename one of the fonts to whatever ...

View answer
Make r2 -i <script> use python3 rather than python2
Accepted answer
3 votes

OP did not mention their OS, thus I assume the OS is Linux. radare2 is using the default python version on your machine. That means that, probably, /usr/bin/python on your machine points to /usr/bin/...

View answer
Working with 16bit offsets and segments in Radare2
Accepted answer
3 votes

You can use -m 0x100 to load the binary at a specific address, as can be seen in r2 -h output: -m [addr] map file at given address (loadaddr) So you can do something like this: $ r2 -m 0x100 -...

View answer
Test malware files in host machine?
3 votes

I want to know how to test malware files with out using virtual environment. Check out the answers in the following, similar, question: Analysing malware in a real environment (non-virtual ...

View answer
IDA Pro 64bit offset and opcode issue
3 votes

As you showed us, the opcodes 48 8D 0D 5B EE 01 00 are translated by IDA to: lea rcx, unk_180020030 But how does IDA recognizes this address? Well it's all about relative offsets. These opcodes ...

View answer