r2
General Information
rabin2 -I filename
Output
$ rabin2 -I megabeets_0x1
arch x86
baddr 0x8048000
binsz 6220
bintype elf
bits 32
canary false
class ELF32
compiler GCC: (Ubuntu 5.4.0-6ubuntu1~16.04.4) 5.4.0 20160609
crypto false
endian little
havecode true
intrp /lib/ld-linux.so.2
laddr 0x0
lang c
linenum true
lsyms true
machine Intel 80386
maxopsz 16
minopsz 1
nx false
os linux
pcalign 0
pic false
relocs true
relro partial
rpath NONE
sanitiz false
static false
stripped false
subsys linux
va true
Run Program with R2
r2 ./filename
Find Entrypoints
[0x08048370]> ie
[Entrypoints]
vaddr=0x08048370 paddr=0x00000370 haddr=0x00000018 hvaddr=0x08048018 type=program 1 entrypoints
ie
stands for info entrypoints
Help
If you know the general flag you want to use i.e.
i
for info you can append a?
i?
This will show you all the help available to append to the
i
flag.
Analysis
r2 does not analyze the file by default, you need to specify the
a
flagTo have r2 analyze the file issue
aa
or analyse all, oraaa
[0x08048370]> aaa
[x] Analyze all flags starting with sym. and entry0 (aa)
[x] Analyze function calls (aac)
[x] Analyze len bytes of instructions for references (aar)
[x] Check for objc references
[x] Check for vtables
[x] Type matching analysis for all functions (aaft)
[x] Propagate noreturn information
[x] Use -AA or aaaa to perform additional experimental analysis.
Can also have r2 analyze the file at start up with
r2 -A filename
Flag Space
After analysis radare2 associates names to interesting offsets in the file such as
sections, functions, symbols, strings
.All are called
flags
Choose a flag space using
fs flagspace
and print the flags it contains withf
.Can pass multiple commands with semi colon i.e.
cmd1;cmd2;cmd3
fs imports; f
[0x08048370]> fs imports; f
0x00000000 16 loc.imp.__gmon_start
0x08048320 6 sym.imp.strcmp
0x08048330 6 sym.imp.strcpy
0x08048340 6 sym.imp.puts
0x08048350 6 sym.imp.__libc_start_main
Can see the strcmp, strcpy, puts etc.
We can also list the strings flagspace
[0x08048370]> fs strings
[0x08048370]> f
0x08048700 21 str..::_Megabeets_::.
0x08048715 23 str.Think_you_can_make_it
0x0804872c 10 str.Success
0x08048736 22 str.Nop__Wrong_argument.
Strings
Lets look at the strings
iz
- List the strings in data sectionsizz
Search for strings in the whole binary
[0x08048370]> iz
[Strings]
nth paddr vaddr len size section type string
―――――――――――――――――――――――――――――――――――――――――――――――――――――――
0 0x00000700 0x08048700 20 21 .rodata ascii \n .:: Megabeets ::.
1 0x00000715 0x08048715 22 23 .rodata ascii Think you can make it?
2 0x0000072c 0x0804872c 9 10 .rodata ascii Success!\n
3 0x00000736 0x08048736 21 22 .rodata ascii Nop, Wrong argument.
axt Analyse X-refs to
axt
stands for analyse x-refs toFinds data or code references to this specific address
@@
is like a for each iterator sign used to repeat a command over a list of offsetsstr.*
is a wildcard for all flags that start withstr.
(our strings)This helps to list the function name, where they are used and the reference instruction in addition to the strings
Select the correct strings flagspace (default is
'fs *'
Seeking
Seek command accepts an address or math expression as an arg.
Expression can be math operation, flag, or memory access operations.
We want to seek for the
main
function.Can find it by executing
s main
First we want to see what else radare2 has flagged
[0x08048370]> afl
0x08048370 1 33 entry0
0x08048350 1 6 sym.imp.__libc_start_main
0x080483b0 4 43 sym.deregister_tm_clones
0x080483e0 4 53 sym.register_tm_clones
0x08048420 3 30 sym.__do_global_dtors_aux
0x08048440 4 43 -> 40 entry.init0
0x080486e0 1 2 sym.__libc_csu_fini
0x080483a0 1 4 sym.__x86.get_pc_thunk.bx
0x0804846b 19 282 sym.rot13
0x080486e4 1 20 sym._fini
0x08048585 1 112 sym.beet
0x08048330 1 6 sym.imp.strcpy
0x08048320 1 6 sym.imp.strcmp
0x08048680 4 93 sym.__libc_csu_init
0x080485f5 5 127 main
0x080482ec 3 35 sym._init
0x08048340 1 6 sym.imp.puts
afl stands for analyze functions list
Disassembling
Seek to the main function
s main
Now disassemble it with
pdf
Print Disassemble Function
Prompt will change to the address of main!
Make the Output Prettier
s sec.utf8=true
e srrc.utf8.curvy=true
Can add to
~/.radare2rc
to make changes permanent
Visual Mode and Graph Mode
Much more user-friendly
Press
V
will bring us to the Visual Mode ScreenUse
p/P
to change between the modesNav to the disassembly view using
p
To go back to a specific screen press
q
Cross-Reference
Use
x/X
to list the references to and from (respectively) the current offset. Use the numbers to jump to a reference
radare2 Commands
Use
:command
to execute r2 commands from inside Visual Mode
Comment
You can add a comment using
;<comment>
followed byEnter
Remove it using
;-
Mark Offsets
m<key>
Use this to mark a specific offset with a key of your choice, press
'<key>
to choose your key.This will allow you to mark important addresses you want to jump to quickly
Quit
Press
q
to return to r2 shell
Visual Graphs
radare2 has a Graph view
You can access VG move from your shell by running
VV
Move up, down, R, L with
h,j,k,l
and jump to a func usingg
and the key shown next to thejump call
All Credit:
https://www.megabeets.net/a-journey-into-radare-2-part-1/
Last updated