{"id":2728,"date":"2021-02-09T20:37:46","date_gmt":"2021-02-09T19:37:46","guid":{"rendered":"https:\/\/andreas-klingler.de\/infosec\/?p=2728"},"modified":"2023-12-24T12:32:32","modified_gmt":"2023-12-24T11:32:32","slug":"radare2","status":"publish","type":"post","link":"https:\/\/infosec.andreas-klingler.de\/?p=2728","title":{"rendered":"radare2"},"content":{"rendered":"\n<ul class=\"wp-block-list\"><li>Address\u00ades with\u00adin the mem\u00ado\u00adry are ref\u00ader\u00adenced&nbsp;with&nbsp;@<\/li><\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">General<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Start\u00ading with direct\u00adly analysing all ref\u00ader\u00adenced&nbsp;code.<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">r2 -A $file\n...\ne emu.str = true<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Start\u00ading with enabled debug\u00adger (only when I want to exe\u00adcute the program)<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">r2 -AA -e dbg.follow.child=true -e dbg.forks=true -d $file\n...\ne emu.str = true<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Fork para\u00adme\u00adter:<\/p>\n\n\n\n<ul class=\"wp-block-list\"><li>If the process forks, the debug\u00adger&nbsp;halts<\/li><li>Type dp to see the child processes.<\/li><li>Use dp=&lt;pid&gt; to set the new&nbsp;pid<\/li><li><\/li><\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Get help about pos\u00adsi\u00adble com\u00admands: Add ? to the end of a com\u00admand prefix.<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">aa?<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Count lines&nbsp;count<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">... ~?<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Note: bash com\u00admands are valid as&nbsp;well.<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">afl | wc -l<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Get gen\u00ader\u00adal information&nbsp;<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">ai<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">List all strings (like\u2026 <em>strings<\/em>)<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">izz<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Get address from&nbsp;main<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">iM<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Con\u00advert dec\u00adi\u00admal, hex, binary,&nbsp;\u2026<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">? 0xc0<br>rax2 -h<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\"><\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Debugging<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Show the cur\u00adrent address<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">s<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Step 12 byte for\u00adward or backward<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">s+ 12 | s- 12<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Undo the pre\u00advi\u00adous&nbsp;step<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">s-<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Print cur\u00adrent&nbsp;code<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">pd<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Print code at a&nbsp;label<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">pd @main<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Print only func\u00adtion&nbsp;code<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">pdf @main<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Emo\u00adji hex\u00addump for presentations<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">pxe<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Show val\u00adue of all registers:<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">dr<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Set a breakpoint<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">db<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Restart pro\u00adgram at the beginning<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">ood<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Con\u00adtin\u00adue<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">dc | dcf (dc -&gt; follow also after forks)<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Show reg\u00adis\u00adter content<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">dr  eax<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Show cur\u00adrent vari\u00adable from function<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">afvd<\/pre>\n\n\n\n<h3 class=\"wp-block-heading\">Visual mode<\/h3>\n\n\n\n<pre class=\"wp-block-preformatted\">vv<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Step through the program<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">s<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Add a comment<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">; comment<\/pre>\n\n\n\n<h3 class=\"wp-block-heading\">Dissassembler<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">r2pm init<br>r2pm \u2011i r2dec<br>r2pm \u2011l<br>pdd?<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Open questions<\/h2>\n\n\n\n<ul class=\"wp-block-list\"><li>If I print aflc with \u2011d and with\u00adout, it is not the same.&nbsp;Why?<\/li><\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Gen\u00ader\u00adal&nbsp;hints<\/p>\n\n\n\n<ul class=\"wp-block-list\"><li>Use as pay\u00adload some\u00adthing like 1234567\u2026 and not some oth\u00ader string.<\/li><\/ul>\n\n\n\n<figure class=\"wp-block-embed\"><div class=\"wp-block-embed__wrapper\">\nhttps:\/\/radare.gitbooks.io\/radare2book\/content\/\n<\/div><\/figure>\n","protected":false},"excerpt":{"rendered":"<p>Address\u00ades with\u00adin the mem\u00ado\u00adry are ref\u00ader\u00adenced&nbsp;with&nbsp;@ Gen\u00ader\u00adal Start\u00ading with direct\u00adly analysing all ref\u00ader\u00adenced&nbsp;code. r2 \u2011A $file \u2026 e emu.str = true Start\u00ading with enabled debug\u00adger (only when I want to exe\u00adcute the pro\u00adgram) r2 \u2011<span class=\"caps\">AA<\/span> \u2011e dbg.follow.child=true \u2011e dbg.forks=true \u2011d $file \u2026 e emu.str = true Fork para\u00adme\u00adter: If the process forks, the debug\u00adger&nbsp;halts Type&nbsp;[\u2026]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"wp_typography_post_enhancements_disabled":false,"footnotes":""},"categories":[355],"tags":[61,350],"class_list":["post-2728","post","type-post","status-publish","format-standard","hentry","category-reverse-engineering","tag-forensic","tag-radare2"],"_links":{"self":[{"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=\/wp\/v2\/posts\/2728","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=2728"}],"version-history":[{"count":21,"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=\/wp\/v2\/posts\/2728\/revisions"}],"predecessor-version":[{"id":3552,"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=\/wp\/v2\/posts\/2728\/revisions\/3552"}],"wp:attachment":[{"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=2728"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=2728"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=2728"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}