|
| 1 | +--- |
| 2 | +description: a walkthrough and usage guide for the Radare2 reverse engineering framework |
| 3 | +--- |
| 4 | + |
| 5 | +# Radare2 |
| 6 | + |
| 7 | +_By_ [_Isaac_](../../../members/members/isaac.md) |
| 8 | + |
| 9 | + |
| 10 | + |
| 11 | +## What is it? |
| 12 | + |
| 13 | +Radare2 is a framework for performing reverse engineering and binary analysis both statically (when the program isn't running) and dynamically (when it is running). R2 is made up of a number of smaller command line utilities, including, but not limited to, the following: |
| 14 | + |
| 15 | +1. `Radare2` - The core tool, a hex editor and debugger, also allows for other tools to be pulled and used seamlessly to perform actions such as data analysis, string extraction, disassembly, binary patching, data comparison, searching, writing, visualising, and has functionality for scripting in Python and JavaScript, amongst others. |
| 16 | +2. `Rabin2` - Extracts info from executable binaries such as ELF and PE data, which is metadata for Linux and Windows files. |
| 17 | +3. `Rasm2` - Assembler and disassembler for x86, x86-64, ARM, and a slew of other architectures. |
| 18 | +4. `Rahash2` - A hash tool |
| 19 | +5. `Radiff2` - A tool that allows the user to see the differences between two files |
| 20 | + |
| 21 | +Using Radare2 is as simple as writing `r2 path/to/file` on the command line, once in, you're presented with a prompt that reads out the location of the entry point of a program in hexadecimal. In the case of `/bin/ls` that entry point is `0x000067d0`. After this, its simply a case of learning the tool. Radare2 is similar to [Vim](help-guides\software\tools\vim.md) in a few ways, not least the high skill ceiling and steep learning curve. However where it is arguably most similar is how similar learning it feels to learning a language, due to the fact that both tools make use of compound mnemonics to perform actions. For example, in Vim, using `ci)` will delete anything inside a set of parentheses and put you in edit mode to change the contents. In the same way, using something like `pdf` will disassemble functions, which you can learn by knowing that `p` prints, `pd` prints disassembly, and `pdf` prints disassembled functions. |
| 22 | + |
| 23 | +To learn these commands, or if a user needs a reminder of them, said user can add a `?` symbol to the end of a command, using the print disassembly example, `pd?` prints the following: |
| 24 | + |
| 25 | +``` |
| 26 | +[0x000067d0]> pd? |
| 27 | +Usage: p[dD][ajbrfils] [[-]len] # Print N bytes/instructions bw/forward |
| 28 | +| NOTE: len parameter can be negative |
| 29 | +| NOTE: Pressing ENTER on empty command will repeat last print command in next page |
| 30 | +| pD N disassemble N bytes |
| 31 | +| pd -N disassemble N instructions backwards |
| 32 | +| pd N disassemble N instructions |
| 33 | +| pd--[n] context disassembly of N instructions |
| 34 | +| pda[?] disassemble all possible opcodes (byte per byte) |
| 35 | +| pdb[?] disassemble basic block |
| 36 | +| pdc[?][c] pseudo disassembler output in C-like syntax |
| 37 | +| pdC show comments found in N instructions |
| 38 | +| pde[q|qq|j] [N] disassemble N instructions following execution flow from current PC |
| 39 | +| pdo[N] convert esil expressions of N instructions to C (bytes for pdO) |
| 40 | +| pdf[?] disassemble function |
| 41 | +| pdi like 'pi', with offset and bytes |
| 42 | +| pdj disassemble to json |
| 43 | +| pdJ formatted disassembly like pd as json |
| 44 | +| pdk[?] disassemble all methods of a class |
| 45 | +| pdl show instruction sizes |
| 46 | +| pdp[?] disassemble by following pointers to read ropchains |
| 47 | +| pdr[?] recursive disassemble across the function graph |
| 48 | +| pdr. recursive disassemble across the function graph (from current basic block) |
| 49 | +| pdR recursive disassemble block size bytes without analyzing functions |
| 50 | +| pds[?] disassemble summary (strings, calls, jumps, refs) (see pdsf and pdfs) |
| 51 | +| pdu[aceios?] disassemble instructions until condition |
| 52 | +| pd, [n] [query] disassemble N instructions in a table (see dtd for debug traces) |
| 53 | +| pdx [hex] alias for pad or pix |
| 54 | +
|
| 55 | +``` |
| 56 | + |
| 57 | +## Installation |
| 58 | + |
| 59 | +Linux users can install Radare2 either through their package manager, e.g. `sudo apt install radare2` for debian-based systems, or perhaps the more recommended approach, cloning directly from the github repository by running the following commands in succession: |
| 60 | + |
| 61 | +```sh |
| 62 | +git clone https://github.com/radareorg/radare2.git; |
| 63 | +cd radare2; |
| 64 | +sys/install.sh; |
| 65 | +``` |
| 66 | + |
| 67 | +And to update, simply run `git pull` in the source tree. |
| 68 | + |
| 69 | +## Usage |
| 70 | + |
| 71 | +### Command line Options |
| 72 | + |
| 73 | +As mentioned previously, Radare2's standard usage on the command line is `r2 /path/to/file`, naturally, however, there are flags you can use on the command line to enhance the behaviour of the program from the start. A couple of the most useful commands are listed below: |
| 74 | + |
| 75 | +``` |
| 76 | +-A run 'aaa' command (analysis of all referenced code in a binary) |
| 77 | +-c 'cmd...' run arbitrary commands in radare without having to open first |
| 78 | +-d debug executable |
| 79 | +-h or -hh show help |
| 80 | +-w open file in write mode |
| 81 | +``` |
| 82 | + |
| 83 | +### Radare2 Commands |
| 84 | + |
| 85 | +- `iS`: List sections in an executable |
| 86 | +- `px @ [memory address]`: print hexdump at memory address |
| 87 | +- `ps @ [memory address]`: print string at memory address |
| 88 | +- `ws "Hello World!" @ [memory address]`: overwrite things in memory location (default will not allow overwriting on disk until commit) |
| 89 | +- `fo`: print a quirky message (a fortune),same that you get shown at launch |
| 90 | +- `?E "Hello World!"`: display a message from Clippy! |
| 91 | +- `?E [backtick]fo[backtick]`: surround a command in backticks to pipe it to another command (this shows a fortune in Clippy) |
| 92 | +- `s [memory address] OR s [memory address]+0x24`: to navigate (seek) to an address, can do maths in the seek too |
| 93 | +- `afl`: list functions inside the program/exe (with descriptors) |
| 94 | +- `pdf [function name]`: Print the disassembly of a function, `pd n` will also print `n` instructions |
| 95 | +- `pdd`: decompile a function with built in decompiler (you can see code lol) |
| 96 | +- `pdg`: decompile function with Ghidra decompiler (looks nicer lmao) |
| 97 | +- `? [number]`: quickly convert between data types, also supports maths |
| 98 | +- `![command]`: run system commands from Radare2 |
| 99 | +- `axt [function name]`: see all the places a function is called (cross references) |
| 100 | +- `agCd`: view and manoeuvre the control flow graph of a function - may be important for malware reversing for me |
| 101 | +- `iz`: print out all the strings |
| 102 | +- `pdf~edi`: Search command output using `~`, `~+` is case insensitive (like grep), example prints disassembly of a function and searches for the keyword "edi" |
| 103 | +- `aa OR aaa`: analyse the program |
| 104 | +- `aaaaaaa`: call in tech support lol |
| 105 | +- `eco`: list and configure themes |
| 106 | +- `eco gruvbox; pd 5`: chain commands via `;`, example switches theme to gruvbox and then prints 5 lines of disassembly at the current memory location |
| 107 | +- `V or V!`: enter visual or visual panels mode |
| 108 | +- `(in visual panel mode) r2048`: possible to play 2048 using visual panels mode menu |
| 109 | +- `itj`: get command outputs as JSON, `it` command gets hashes |
| 110 | +- `itj~{}`: pretty print formatted JSON |
| 111 | +- `itj~{}md5`: access JSON elements you want to parse out |
| 112 | +- `(in python) imprt r2pipe`: script analysis via r2pipe |
| 113 | +- `ii`: gets list of imported functions |
| 114 | +- `afl?`: print help for a command with `?` |
| 115 | +- `afl[TAB]`: or just hit tab for same effect |
| 116 | +- `pqz`: print data as a qr code via `pq`, `pqz` prints based on current string, `pq20` prints next 20 bites as QR |
| 117 | +- `(in visual mode) (`: get festive with snow mode |
| 118 | +- `pa mov x19, x1`: convert mnemonics into hex pairs using `pa` |
| 119 | +- `pad`: reverses `pa` |
| 120 | +- `CC Hello World! @ [memory address]`: add comments |
| 121 | +- `CC-`: remove comments |
| 122 | +- `afn [new function name] @ [old function name]`: rename things to make it easier to understand |
| 123 | +- `pdga`: print disassembly and ghidra decompile side by side to help understand assembly |
| 124 | +- `/R`: list ROP gadgets available in the program |
| 125 | +- `(in cli) r2 -i example.r2s -e scr.interctive=false -e cfg.slides.heading.colour=yellow`: write and present slides in r2, write in markdown |
| 126 | +- `[backticks in slides]`: write r2 commands in slides and run them live |
| 127 | +- `(in cli) r2 -d [program]`: debug programs |
| 128 | +- `db, dc, dr`: set breakpoint, continue program, print registers |
| 129 | +- `pd @ rdi`: dump registers and stack |
| 130 | +- `pdf @ [function name]`: leverage temporary seeks to avoid repeated jumping around |
| 131 | +- `pd 2 @@ [backtick]afl[backtick]`: use `@@` or `@@@` to loop |
| 132 | +- `iaito`: use the GUI "iaito" |
| 133 | +- `config`: configure pretty much everything |
| 134 | +- `r2 -e cfg.fortunes.tts=true`: have fortunes spoken to you |
| 135 | +- `vim cmdlist.txt && r2 -i ./cmdlist.txt path/to/binary`: pass in pre defined list of commands |
| 136 | +- `r2 -w path/to/binary`: permanently patch a binary with -w |
| 137 | +- `ic`: list objective c classes and methods |
| 138 | +- `~...`: interactive filter (real time) a command output with `...` after the `~` operator |
| 139 | +- `randiff2`: use one of many cli tools that come with Radare2 to diff two binaries |
| 140 | +- `r2 apk://[app loaction]`: analyse an android app using `apk://` prefix |
| 141 | +- `ic`: list android java classes and methods |
| 142 | +- `i`: check compiler security features are used |
| 143 | +- `emulate`: emulate code (bunch of different commands) |
| 144 | +- `roms`: analyse gameboy roms |
| 145 | + |
| 146 | +## Further Reading |
| 147 | + |
| 148 | +* [A Radare2 Tutorial series](https://www.youtube.com/playlist?list=PLg_QXA4bGHpvsW-qeoi3_yhiZg8zBzNwQ) - by BinaryAdventure on YouTube |
| 149 | +* [Open Source Reverse Engineering: 60 Things In 60 Minutes](https://www.youtube.com/watch?v=7l67hP23OIE) - A talk about Radare2 given at our very own SecuriTay X by the wonderful Grant Douglas |
| 150 | +* [The Github Repo](https://github.com/radareorg/radare2) - Keep up to date with (or even contribute to) Radare2 here |
| 151 | +* [The Radare2 Book](https://book.rada.re/index.html) - As much documentation as your heart desires |
0 commit comments