Megabeets
  • Member for 5 years
  • Last seen more than a month ago
No apparent entry point for stripped, PIE binary using radare2
3 votes

How can I find the entry point of this binary? There's a special radare2 command for this, ie: $ r2 /program_name -- Change the registers of the child process in this way: 'dr eax=0x333' [...

View answer
Is there a way to get the headers with the Radare output?
Accepted answer
3 votes

As @blabb said, this number represents the amount of flags in each flagspace. So for your example: 0 0 * strings 1 6 * symbols 2 14 * sections 3 0 * relocs The flagspace "strings" has 0 ...

View answer
What does it mean when radare2 says "invalid"?
Accepted answer
3 votes

It simply means that the bytes, 0xff in your case, are not valid instructions. So, to put it simply, it means that you are not looking at code. Try another offsets and sections. Is that just a way ...

View answer
Avatao R3v3rs3 2
Accepted answer
3 votes

As your initial instincts told you, it is quite a simple challenge and you are close. Let's understand together the logic of the program. As you did, I used radare2. Let's open the program in radare2:...

View answer
How to print all functions of a binary using radare2 c/c++ API
3 votes

r2pipe The best programming interface to radare2 called r2pipe. To quote from the project's Github page: The r2pipe APIs are based on a single r2 primitive found behind r_core_cmd_str() which ...

View answer
IDAPython: How to check if an instruction is a conditional branch or jump?
Accepted answer
3 votes

You can try this function that I wrote which worked just fine in some quick tests I did. You might need to implement more code to handle edge cases, but in general it should work. The function was ...

View answer
How to label local variables in x64dbg
3 votes

Local variables labeling is not yet supported by x64dbg and as far as I know there's no plugin to achieve that. However, you can still label a specific memory address. You can do this by selecting ...

View answer
Extract conditional instructions using IDA python in ARM binaries
Accepted answer
3 votes

I was able to reproduce your problem on IDA 6.95 but it seems like this bug was fixed in IDA 7 since it works for me just fine. The solution below will be relevant to IDA 6.95 though it would probably ...

View answer
In a native debugger, what must be done in order to resolve ntdll/other API symbols manually?
Accepted answer
3 votes

Simply execute downloadsym ntdll in the command field at the bottom of x32dbg. As you can see in the documentation: Command: symdownload / downloadsym Attempt to download a symbol from a Symbol ...

View answer
How to find paths from current offset to given address using radare2?
3 votes

Seems like the feature is not implemented yet. As you can see in this function: ... if (root && dest) { if (dest == root) { eprintf ("Source and destination are the same\n"); ...

View answer
Does IMAGE_FILE_SYSTEM actually means System file
3 votes

According to PeLib project: IMAGE_FILE_SYSTEM is set if the file is a system file such as a driver. This is unused for executable files; it is also not used in all the NT drivers I inspected. ...

View answer
Is it possible to name mona output files?
3 votes

Since Mona's source is available on Github you can easily modify the code to fit your needs. The code that responsible to save the files can be found (currently) in line 2477 inside the class MnLog....

View answer
Ollydbg not displaying full info
3 votes

OllyDbg, just as other debuggers, needs symbol information in order to retrieve function names. Such information is usually kept inside a Program Database (PDB) file or DBG file which produced by the ...

View answer
Radare2 produces null bytes on write
2 votes

This was probably a bug which I can't reproduce this now. My guess is that the VA is moved and now this address doesn't contain anything. If this bug still happens, please open an issue describing it ...

View answer
radare2 how to interpret ascii-art color bars?
Accepted answer
2 votes

This chart describes the different Sections and Memory Segments in your binary. Each row in the chart is a different section where its name is in the rightest column. From the left, you can see its ...

View answer
How to make Radare2 automatically disassemble next instruction after each `ds` debug single-step?
Accepted answer
2 votes

If you want to execute another command after doing ds you can simply use ; to add a new command. So for example, the command ds; pd 1 @ rip will step one instruction and disassemble the instruction at ...

View answer
How to identify different memory regions of an elf binary in radare2?
Accepted answer
2 votes

It is possible to list the sections and segments of a program using radare2. Sections Use iS to list the program's Sections: [0x00001c50]> iS [Sections] Nm Paddr Size Vaddr Memsz Perms ...

View answer
Learning fine grained analysis in Radare with `a`?
2 votes

Binary analysis is not a simple thing and it is structured from a lot of different tasks that together might create a heavy and slow task. In order to get the best results, you need to understand what ...

View answer
Radare's `aaaa` and -AA what does it do, exactly?
Accepted answer
2 votes

When you execute the aaa command, radare is showing you what are the steps it takes. Each step has the command responsible for it inside parentheses. [0x00000000]> aaa [x] Analyze all flags ...

View answer
What is the right way to pack a payload with Python3's pwntools
Accepted answer
2 votes

Actually, this is a programming question and not an RE question. Anyway, you simply need to tell python to treat your payload as bytes by adding the bytes-literal b before the 'A'*140. >>> ...

View answer
`dmi libc puts~GLOBAL` does not show puts, just putspent?
Accepted answer
2 votes

This is right, and it was caused by using the wrong grep (the ~ character) in the article. This was due the fact that the output of dmi libc is different on different machines and also, the syntax of ...

View answer
How do I view the registers as signed intergers?
2 votes

Although radare2 provides a rich amount of commands to handle registers (see dr?), it is quite tricky to view the values of the registers in decimal mode. That said, I will show you two simple ...

View answer
rasm2 giving different output each time for x64
2 votes

This was a bug, and the issue that was opened by OP is now fixed on radare2 Master and on the latest releases. $ rasm2 -a x86 -b 64 -d "48898D80FEFFFF" mov qword [rbp - 0x180], rcx $ rasm2 -a x86 -...

View answer
Printing bytecode in bytes given a string of assembly for Radare to disassemble?
Accepted answer
2 votes

Actually, there is no lea edx, [0x80490c8] for 64-bits addressing modes. Since, afaik, in all 64-bits addressing modes lea is a register relative opcode. LEA - Load Effective Address Computes the ...

View answer
Running just one function from an compiled executable or shared object?
2 votes

As you correctly mentioned, this is a pseudo C code which output a C-like code. This code can't be compiled since it's not a valid C code. This output can be shown using the pdc command. radare2 ...

View answer
how to deobfuscate Autoit strings?
2 votes

The function STRINGDEC isn't a built-in autoit function. It was implemented by the programmer to create some sort of Substitution cipher. You can see the source code of the function at the bottom of ...

View answer
Running a patched binary within IDA Free
Accepted answer
2 votes

IDA Free doesn't support the "Apply patches to input file..." feature. Hence, you'll have to do this the old way. I'll expand my answer and will go over things you already know so others (e.g coming ...

View answer
IDA Script, Get Function Name That has random Characters involved in name
Accepted answer
2 votes

As far as I know, IDA doesn't have a function_name_to_address() that gets a pattern and returns an address. You can iterate over all the functions and check if their name matches the one you want. It ...

View answer
How to call an item of a Javascript array?
2 votes

The variable _0xe984 in your example is an array of strings, therefore, calling it with _0xe984("0xa") is actually to call as if it was a function that gets the string "0xa" as a parameter. Thus, the ...

View answer
Creating a struct in IDA which contains a cString?
1 votes

IDA introduced "Variable Length Structures" and describe the usage of it with a very straight forward tutorial. In short, you need to make sure the "flexible" item is the last item ...

View answer