radare2 Book

repository·master·Indexed 21 days ago

https://github.com/radareorg/radare2-book

Community-maintained documentation for radare2, including guides on code analysis, function management (af commands), cross-references (ax commands), and calling conventions (afc commands). It also contains technical details for the r2png utility and instructions for customizing the physical book cover layout and spine width.

Tokens
158K
Snippets
583
Records
689
Agent score
73%

What's inside radare2-book

  1. What is R2Wars

    master

    R2Wars is a programming duel environment where two programs compete in a shared virtual memory space. The objective is to overwrite the opponent's code to cause a crash. Players use real assembly languages and must be proficient with the radare2 toolchain.

    The official, high-performance implementation used in r2con competitions is written in C# and can be found at: https://github.com/radareorg/r2wars

  2. Overview of radiff2 for binary diffing

    master

    radiff2 is a tool within the radare2 suite used for comparing binary files. It supports various diffing methodologies including 1:1 binary diffing, delta diffing, code analysis diffing, and binary data (bindata) diffing. It can compare files at multiple levels, from raw data to disassembled code, and supports architecture/bits specification and graph diffing.

    Many radiff2 features are also available as the c command within the radare2 shell, allowing you to compare data from disk or process memory without leaving your current session.

  3. Overview of Rasm2 assembler and disassembler

    master

    rasm2 is a command-line tool within the radare2 framework used for both assembling (converting assembly code to machine code) and disassembling (converting machine code to assembly). It is a standalone tool that supports multiple architectures, flexible input/output formats (hex, binary, text), and shellcode generation.

    Key capabilities:

    • Multi-architecture: Supports x86, ARM, MIPS, PowerPC, and many others via plugins.
    • Bi-directional: Functions as both an assembler and a disassembler.
    • Flexible I/O: Handles hex strings, raw binary files, or text files.
    • Shellcode Generation: Useful for security research.
    • Syntax Highlighting: Provides colored output for disassembly.
  4. Overview of Rabin2

    master
    Rabin2 is a powerful tool within the radare2 ecosystem used to analyze binary files. It extracts metadata such as imports, exports, sections, headers, library dependencies, architecture types, and entrypoint addresses. It supports various formats including ELF, PE, Mach-O, Java CLASS, and any format supported by radare2 plugins. Rabin2 can output data in several formats, including JSON, for integration with other tools.
  5. Introduction to r2pm package manager

    master

    r2pm is the dedicated package manager for Radare2, used to manage external plugins and tools that integrate closely with the Radare2 ecosystem.

    Key characteristics:

    • Platform Support: Most packages are tested for UNIX systems, with some supporting Windows and WebAssembly (r2js).
    • Installation Scopes: By default, packages are installed in your home directory. Use the -gi flag for system-wide installation (requires sudo).
    • Build Methods: Most packages are built from source, though some support binary builds.
    • Third-party Extensions: Before developing a custom plugin, check the radare2-extras repository to see if a similar tool already exists.
  6. Overview of ragg2 (radare2's egg compiler)

    master

    ragg2 is a tool used to compile relocatable code snippets (eggs) into tiny binaries for x86, x86-64, and ARM architectures. It is primarily used for generating shellcode for exploitation tasks. It supports compiling both its own domain-specific language and standard C code (via GCC or Clang depending on file extensions).

    Key capabilities include:

    • Generating various output formats: raw binary, C arrays, Python, JavaScript, and executable formats (PE, ELF, Mach-O).
    • Performing encoding and encryption on generated shellcode.
    • Modifying paddings and injecting sequences.
    • Prepending Debruijn patterns or appending specific byte sequences.
  7. Overview of radare2 scripting capabilities

    master

    Radare2 provides several ways to automate tasks and extend its functionality:

    • r2pipe: The primary method for controlling radare2 from external programming languages like Python, JavaScript, or Rust. It is ideal for building custom tools and automation scripts.
    • r2js: A built-in engine that allows you to run JavaScript directly inside radare2, useful for quick scripts and plugins without external dependencies.
    • rlang: Provides access to radare2's inner workings from various programming languages.
    • Shell integration: Radare2 includes a shell-like environment that supports command sequencing, piping, and redirection.
  8. What is r2frida?

    master

    r2frida is a plugin that integrates radare2 with Frida, enabling dynamic analysis and instrumentation of running processes. It allows you to use radare2's mnemonic commands to execute logic inside a target process instead of writing manual JavaScript one-liners. This integration allows you to import dynamic instrumentation data directly into your radare2 static analysis environment.

    Key capabilities include:

    • Executing Frida scripts using the :. command.
    • Running code snippets in C, JavaScript, or TypeScript.
    • Attaching to, spawning, or launching processes locally or remotely.
    • Inspecting sections, symbols, classes, and methods.
    • Searching memory, creating hooks, and manipulating file descriptors.
    • Supporting Dalvik, Java, ObjC, Swift, and C interfaces.
  9. What is Rarun2 and how to use it

    master

    Rarun2 is a tool used to set up a specific execution environment for a binary. It allows you to redefine stdin/stdout, manage pipes, modify environment variables, and configure other settings to create controlled boundary conditions for debugging and reverse engineering.

    It can be used as a standalone tool or integrated into radare2 using the following flags:

    • -r <file>: Load a profile from a file.
    • -R <string>: Specify the profile directives directly from a string.
    $ rarun2 -h
    Usage: rarun2 -v|-t|script.rr2 [directive ..]
  10. Introduction to Firmware Reversing workflows

    master
    Firmware reversing differs significantly from standard userland program analysis. When working with flash dumps, the workflow involves specific steps for environment configuration, loading specialized files, analysis, and emulation. Success in firmware reversing requires establishing consistent habits and understanding core architectural concepts before proceeding to deep analysis.
  11. Use r2png to generate screenshots from r2 commands

    master
    The r2png utility automates the creation of PNG images for documentation by executing a specific list of radare2 commands and capturing the output as a screenshot. This eliminates the need to manually maintain image files when command outputs change.
  12. Use rax2 for shell expression evaluation and base conversion

    master

    The rax2 utility is a minimalistic expression evaluator for the shell. It is used for mathematical calculations, base conversions (hex, octal, binary, decimal, ternary), and handling data formats like Base64, ASCII, and endianness.

    Inside the radare2 framework, you can access rax2 functionality using the ? command.

    Number Representation Syntax

    The base of a number is determined by its prefix or suffix:

    • Decimal (Base 10): 3
    • Hexadecimal (Base 16): 0xface
    • Octal (Base 8): 0472
    • Units: 2M (e.g., 2 megabytes)
    • Binary: 1100011b (suffix b)
    • Ternary: 1010dt (suffix dt)
    • Floating Point: 3.33f (suffix f)
    # Inside radare2
    [0x00000000]> ? 3+4
    
    # From the shell
    $ rax2 3+0x80
    0x83