How to disassemble radare2 with Linux Days?
Disassembling with radare2 Disassembling with radare2 Tomáš Antecký ([email protected]) 8. 10. 2017 antecky.cz/r2 radare2 ● An open source reverse engineering framework ○ http://rada.re ○ https://github.com/radare/radare2
Which is the first disassembly tool for arm?
In this paper, we conduct the first comprehensive study on ARM disassembly tools. Specifically, we build1,896 ARM bina- ries (including 248 obfuscated ones) with different compilers, com- piling options, and obfuscation methods.
How to automate manual password extraction in radare2?
● It can be seen that a new decrypted block is the same as the previous one ● Except a compared character is different (now it is “1”) ● Manual password extraction can be tedious ● There are several ways how to automate this process “encrypted” instructions antecky.cz/r2
Which is the best way to install radare2?
● Can handle tampered binaries ● Mainly used through CLI, but there are graphical frontends ● Scriptable (bindings to Python, Ruby, JavaScript, Perl, Java, C#,…) antecky.cz/r2 Installation ● radare2 packages provided by distributions are obsolete ● Recommend way of installation is by using Git:
How to install language bindings in radare2 suite?
● Language bindings (r2pipe) are installed separately: antecky.cz/r2 $ git clone https://github.com/radare/radare2.git $ cd radare2 System-wide installation (requires root) $ sys/install.sh User based installation (into $HOME) $ sys/user.sh $ pip install r2pipe $ npm install r2pipe $ gem install r2pipe Major binaries in radare2 suite ● rabin2
Which is the best way to demonstrate radare2?
● Quick demonstration of radare2 capabilities ● Static and dynamic analysis ● A simple crackme/CTF challenge ● Goal is to obtain a password/flag stored inside a binary ● Source code at antecky.cz/r2 (spoiler alert) ● Build with help of radare2 (see prepare.py) ● Each step is in this presentation as well ● So no worries, if don’t catch anything
Can you use exe.r2 instead of radare2?
The basic usage is radare2 exe (on some systems you can use simply r2 instead of radare2). If there exists a script named exe.r2, then it gets executed after the others rc-files.
How to disassemble an MS-DOS EXE, reverse?
I’ve been disassembling an MS-DOS EXE and I’ve been using this link http://www.delorie.com/djgpp/doc/exe/ to make heads and tails of the binary. The header seems to be an older version compared to the headers that precede the PE segment found in today’s modern Windows executables.