Contents
How to disassemble a function with radare2?
There are many ways to disassemble a function using radare. You can use pdf ( p rint d isassembly f unction) or you can use more interactive ways – the Visual Mode ( v) and the Visual Graph Mode ( VV ). You can use the way you find most comfortable to you. I usually use the visual modes since they’re more rich and interactive.
What can radare2 be used for in reverse engineering?
Radare2 is an open-source framework that can perform disassembly, debugging, analysis, comparing data and manipulation of binary files. This framework works on Windows, Linux and many other platforms and architectures. The Windows installer can be downloaded from GitHub.
What is the I command in radare2 used for?
The i command used for getting info about the opened file. It’s a wrapper around rabin2 which is an information extractor tool in the radare2 framework. radare2 offers us tons amount of information about the binary. Check out i? to list the information’s subcommands.
What kind of debugger do you use for radare2?
Debug with local native and remote debuggers (gdb, rap, webui, r2pipe, winedbg, windbg)
How to automate manual password extraction in radare2?
● It can be seen that a new decrypted block is the same as the previous one ● Except a compared character is different (now it is “1”) ● Manual password extraction can be tedious ● There are several ways how to automate this process “encrypted” instructions antecky.cz/r2
How to disassemble radare2-linuxdays demo with antecky?
● The second syscall reads from stdin (mov edi, 0) to stack (mov rsi, rsp) ● The third syscall is nanosleep and due to it the binary sleeps for given amount of time ● Length of sleep is specified by a struct at 0x400106 ○ In this case it is hardcoded to 3 seconds ● We can insert comments by pressing ; antecky.cz/r2 Demo
Can you run radare2 with the-a flag?
You can also run radare2 with the -A flag to analyze the binary straight at startup using aaa (e.g r2 -A ./packedup ). Note: as I mentioned in the previous posts, starting with aaa is not always the recommended approach since analysis is very complicated process.
Which is the best version of radare2 to use?
If you are not, I suggest you to start from part 1 of my series “A Journey Into Radare2”. So, without further ado, let’s dig into the binary. Radare2’s development is pretty quick – the project evolves every day, therefore it’s recommended to use the current git version over the stable one.
Can You reverse engineer a Gameboy ROM with radare2?
It is not the first writeup that I publish from r2con competition, you can check out “Reverse engineering a Gameboy ROM with radare2” as well, make sure not to miss the cool swags I got from winning the competition. This article is aimed to those of you who are familiar with radare2.
What kind of debugger do I need for radare?
Disassemble (and assemble for) many different architectures Debug with local native and remote debuggers (gdb, rap, webui, r2pipe, winedbg, windbg) Run on Linux, *BSD, Windows, OSX, Android, iOS, Solaris and Haiku Perform forensics on filesystems and data carving
Which is the best way to install radare2?
● Can handle tampered binaries ● Mainly used through CLI, but there are graphical frontends ● Scriptable (bindings to Python, Ruby, JavaScript, Perl, Java, C#,…) antecky.cz/r2 Installation ● radare2 packages provided by distributions are obsolete ● Recommend way of installation is by using Git: