Radare2

posted
read
114 words · 1 min
tags
#ctf
contents

A concise guide to common operations and tools within the Radare2 framework.

rax2 - Base Conversion

Used for converting between various numerical bases and formats.

Command Line

Terminal window
rax2 0x28       # Hex to decimal
rax2 40         # Decimal to hex
rax2 -h         # Show help

Internal (within r2)

Use the ? command to evaluate expressions or convert values.

[0x00000000]> ? 0x28     # Convert 0x28 to all formats
[0x00000000]> ? 3+4      # Evaluate basic math

rabin2 - Binary Information

Extracts information from executable files (imports, exports, strings, etc.).

Common Commands

Terminal window
rabin2 -I file  # General binary info (arch, OS, bits, etc.)
rabin2 -z file  # List strings in data sections
rabin2 -zz file # List strings in the entire binary
rabin2 -i file  # List imports (linked libraries/functions)
rabin2 -e file  # List entry points

radare2 (r2) - Core Interactive Tool

The main interface for disassembly, analysis, and debugging.

Startup

Terminal window
r2 -A file      # Open file and run analysis (aaa)
r2 -w file      # Open file in write mode
r2 file         # Open without any analysis

Information (i)

i               # Show information about current file
ii              # Show information about current function
is              # Show information about current symbol
iz              # Show information about strings in data sections
iE              # Show information about exports(global symbols)
s 0x400500      # Seek to specific address
s main          # Seek to 'main' symbol
s -             # Seek back to previous location

Analysis (a)

aa              # Basic analysis
aaa             # Full analysis (including functions and symbols)
afl             # List all analyzed functions

Disassembly & Printing (p)

pdf             # Print Disassembly of current Function
pdf @ main      # Print Disassembly of specific function
pd 10           # Print 10 lines of Disassembly
pD 32           # Print 32 bytes of Disassembly
px 64           # Print 64 bytes of Hexdump

Writing (w)

Note: Requires opening r2 with -w.

wx 909090       # Write hex bytes (NOPs)
wa nop          # Assemble and write a single instruction

Visual Modes (v, V)

v               # Open visual panels
V               # Enter visual mode
VV              # Enter visual graph mode
v test          # Load saved layout 'test'
v= test         # Save current layout as 'test'
p & P           # Switch view
u & U           # Undo and Redo seek

rasm2 - Assembler & Disassembler

Quickly assemble or disassemble instructions.

Usage

Terminal window
# Assemble an instruction (x86, 64-bit)
rasm2 -a x86 -b 64 "nop"


# Disassemble hex code (machine code)
rasm2 -a x86 -b 64 -d "90"

Useful Shortcuts (Internal)

  • ? - Show general help
  • V - Enter visual mode
  • VV - Enter visual graph mode
  • q - Exit current mode or r2