DOCSEARCHbyAlgolia
Submit Docs

radare2 (r2)

repository·master·Indexed 12 days ago

https://github.com/radareorg/radare2

A comprehensive open-source reverse engineering framework for Unix systems. It provides libraries, tools, and plugins for analyzing, emulating, debugging, and modifying binaries across various architectures and operating systems. Features include a native sandbox for security, C structure loading via TinyCC, the ragg2 compiler for .r programs, and the XPS system for integrating static external plugins.

Tokens
165.5K
Snippets
558
Records
737
Agent score
98%

What's inside radare2

  1. Use GProbe to communicate with video chipsets

    master

    GProbe is a protocol used to communicate with Genesis, STMicro, MegaChips, and Kinetic Technologies chips (often used in video chipsets) that feature an integrated Turbo186 core. It allows you to read/write RAM, reset the CPU, execute code in RAM, and more. It supports communication via Serial1 protocol (USB serial) and DDC2Bi3 protocol (Linux I2C).

    Implemented features:

    • RAM read/write access
    • CPU Reset
    • DebugOn/DebugOff
    • RunCode
    • GetDeviceId / GetInformation
    • Flash commands
    • Listen command (to dump Print-messages from the chip)

  2. Tricore Architecture Support in Radare2

    master
    Radare2 provides support for the Tricore Instruction Set Architecture (ISA). This implementation covers various versions of the architecture, including ISA 1.3, ISA 1.6, and the 1.6P/1.6E variants. It also adheres to the Tricore EABI (Embedded Application Binary Interface) specifications.

  3. Overview of popular radare2 plugins

    master

    Radare2 can be extended with many plugins. Some notable ones include:

    • iaito: Official Qt graphical interface.
    • r2pipe: Script radare2 from any programming language.
    • r2ghidra: Standalone native Ghidra decompiler (accessible via pdg).
    • r2dec: JS-based decompiler (accessible via pdd).
    • r2frida: Frida IO plugin (start with r2 frida://0).
    • r2ai: Integration with Large Language Models.
    • decai: AI-based decompiler.

  4. What is XPS (Static External Plugins)?

    master
    XPS (Static External Plugins) is a system that allows radare2 to build third-party plugin repositories as part of the main radare2 build process. Unlike standard plugins, XPS plugins are linked statically, meaning users do not need separate runtime plugin files. This is typically used for integrating external libraries or specialized plugin repositories (like r2hermes or r2unity) directly into the radare2 binary.

  5. Understand the relationship between radare2 library APIs

    master

    The radare2 architecture is built around a central lib core that manages various specialized API modules. These modules interact to provide reversing, debugging, and analysis capabilities.

    Key functional groups include:

    • Core & Configuration: Manages the central state and config settings.
    • Analysis & Disassembly: Includes asm (assembly), bin (binary analysis), and anal (analysis engine).
    • Execution & Debugging: Provides debug, bp (breakpoints), vm (virtual machine), reg (registers), syscall, var (variables), and trace capabilities.
    • Comparison & Integrity: Includes diff (diffing), sign (signature matching), and hash (hashing).
    • Interface & Interaction: Handles cons (console), line (command line), cmd (commands), search, and print operations.
    • Extensibility: Supported via a plugins system.
    • Metadata & Language: Manages flags, meta (metadata), lang (language), and macro support.
    +--------+
           .-| config |
          /  +--------+
   +------+  +------+ +------+ +------+
   | core |--| cons | | asm  | | diff |
   +------+  | line | | bin  | | sign |
     |    \  +------+ | anal | | hash |    ,_____.
   +----+  \          +---.--+ +--.---+   +._____.+
   | io |   +-------------'------/        |       |
   +----+   | cmd, search, print |<------>| flags |
     |      +------.-------------
     |   .----| debug, bp, vm | | lang  |
     |   |    | reg, syscall  | | macro |
  +------'--+ |  var, trace   | +-------+
  | plugins | +---------------+
  +-----.---+
        `---------------------------'

  6. Integrate r2 with proprietary software via r2pipe or WebUI

    master

    Using radare2 via r2pipe, scripting, or the WebUI (textual interface) does not trigger the same restrictive licensing requirements as static or dynamic linking, provided you do not modify r2 itself to facilitate the integration.

    If you must modify r2 to make it work with your tools, those changes should be made public to ensure users maintain the freedom to upgrade or modify the r2 libraries.

  8. Identify VBA runtime functions in Msvbvm50.dll

    master

    When analyzing Visual Basic 5.0 binaries, look for functions prefixed with __vba or rtc. These represent the core runtime logic for array manipulation, string handling, variable operations, and runtime checks. Common patterns include:

    • Array Operations: __vbaAryConstruct, __vbaAryCopy, __vbaAryDestruct, __vbaAryMove, __vbaRedim.
    • String Operations: __vbaStrCat, __vbaStrCmp, __vbaLenBstr, __vbaMidStmtBstr.
    • Variable/Type Operations: __vbaVarAdd, __vbaVarSub, __vbaVarMul, __vbaVarDiv, __vbaVarCmpEq.
    • Runtime Checks: __vbaHresultCheck, __vbaChkstk.
    • Runtime Library (rtc) Functions: rtcMsgBox, rtcInputBox, rtcDateAdd, rtcDateDiff, rtcCreateObject.

  9. Evaluate expressions and use variables

    master

    Use the ? command to evaluate expressions.

    Common Variables:

    • $$: Current address.
    • $s: File size.
    • $b: Block size.
    • $l: Opcode length.
    • $j: Address where a jmp goes.
    • $f: Address where a jmp fails.
    • $m: Opcode memory reference (e.g., for mov eax,[0x10], returns 0x10).
    • ??: Result from previous operations.

    Useful Commands:

    • ?v <expr>: Show the hex value of a math expression.
    • ?l <str>: Returns the length of a string.
    • ?s <from> <to> [step]: Generates a sequence.
    • @@: Used for iterations (e.g., wx ff @@10 writes ff at 10 locations).
    ?v 0x1625d4ca ^ 0x72ca4247
?s 1 10 2

  10. Understand ESIL (Evaluable Strings Intermediate Language)

    master

    ESIL is an intermediate language used by radare2 to represent instruction semantics. It allows for architecture-independent analysis and emulation by expressing instructions as a sequence of operations on registers, memory, and flags.

    In ESIL, instructions are represented as strings that describe the state changes. For example, an AVR LDI (Load Immediate) instruction might be represented as 0x0,r19,=, which indicates that the value 0x0 is being assigned to register r19.

  11. Mmsystem DLL Symbol Groups

    master

    The mmsystem symbols are categorized by their functional area in the Windows Multimedia API. When analyzing a binary, these groups help identify the subsystem being used:

    • Joystick/Joy: Functions related to joystick device management and input (e.g., JOYGETNUMDEVS, JOYSETCAPTURE).
    • MIDI Out: MIDI output device management and messaging (e.g., MIDIOUTOPEN, MIDIOUTSETVOLUME).
    • MIDI In: MIDI input device management and buffering (e.g., MIDIINOPEN, MIDIINADDBUFFER).
    • MIDI Stream: MIDI stream control (e.g., MIDISTREAMOPEN, MIDISTREAMSTOP).
    • Auxiliary (AUX): Auxiliary audio device controls (e.g., AUXGETVOLUME).
    • Wave Out: Audio output device management and playback (e.g., WAVEOUTOPEN, WAVEOUTWRITE).
    • Wave In: Audio input device management and recording (e.g., WAVEINOPEN, WAVEINSTART).
    • Time: System time and event management (e.g., TIMEGETTIME, TIMEBEGINPERIOD).
    • MCI (Media Control Interface): Command-based media control (e.g., MCISENDCOMMAND, MCIEXECUTE).
    • Mixer: Audio mixer device and line control (e.g., MIXEROPEN, MIXERGETLINEINFO).
    • MM Task/Thread: Multimedia task and thread management (e.g., MMTASKCREATE, MMTHREADCREATE).
    • MM IO: Multimedia I/O operations (e.g., MMIOOPEN, MMIOWRITE).

  12. How type propagation and code analysis data is structured in anal/d

    master

    The anal/d directory contains key-value (k=v) files that are compiled into .sdb databases or gperf structures. These databases drive the code analysis and type propagation logic within radare2.

    Key files include:

    • spec.sdb.txt: Defines format modifiers (e.g., %p, %d, %s) used for type propagation.
    • types.sdb.txt: Contains basic C-like type definitions.
    • $os-$bits.sdb.txt: Contains architecture-specific structs and enums based on the operating system and bitness.