Radare
Radare
//rooted
pancake
pancake@nopcode.org
nibble
nibble.ds@gmail.com
Overview
radare2 is a rewrite of radare (r1) focusing on:
- API (refactor, clean)
- Por tability (osx,linux,bsd,w32)
- Modularity (˜40 modules)
- Scripting and bindings (valaswig)
Status of 0.4
- Aiming to be as compatible as possible with r1
- Some command and concepts has been redefined
- Runtime >10x faster
- Smar t and cleaner code (40% of LOCs)
- Refactoring never ends -:)
radare2 // 0.4 release
Download sources:
http://www.radare.org/get/radare2-0.4.tar.gz
Debian packages:
http://www.radare.org/get/r2deb
Chiptune session: (Thanks neuroflip!)
http://www.radare.org/get/r2-0.4.mp3
$ python
>>> import libr
>>> core = libr.RCore()
>>> core.loadlibs()
>>> file = core.file_open("dbg:///bin/ls", False)
>>> core.dbg.use("native")
>>> core.cmd0("dp=%d"%file.fd)
$ lua
> require "r_bin"
> file = arg[1] or "/bin/ls"
> b = r_bin.RBin ()
> b:load (file, "")
> baddr = b:get_baddr ()
> s = b:get_sections ()
> for i=0,s:size()-1 do
> print (string.format (’0x%08x va=0x%08x size=%05i %s’,
s[i].offset, baddr+s[i].rva, s[i].size, s[i].name))
> end
Scripting demo (2)
$ ruby <<EOF
require ’libr’
core = Libr::RCore.new
core.file_open("/bin/ls", 0);
print core.cmd_str("pd 20");
EOF
$ perl <<EOF
require "r2/r_asm.pm";
sub disasm {
my ($a, $arch, $op) = @_;
$a->use ($arch);
my $code = $a->massemble ($op);
if (defined($code)) {
my $buf = r_asmc::RAsmCode_buf_hex_get ($code);
print "$op | $arch | $buf\n";
}
}
my $a = new r_asm::RAsm();
disasm ($a, ’x86.olly’, ’mov eax, 33’);
disasm ($a, ’java’, ’bipush 33’);
EOF
r2w
Aims to be a web frontend for radare2
- Written in python (no dependencies)
- jQuer y and CSS hardly simplifies the design of the gui
- At the moment it is just a PoC
- Assembler/disassembler, debugger, hasher demos
$ python main.py
Process with PID 20951 started...
URL=http://127.0.0.1:8080/
ROOT=/home/pancake/prg/r2w/www
$ surf http://127.0.0.1:8080
...
(demo)
Searching bytes
* One of the very basic features of r1 has been rewritten
in order to offer a clean API to search keywords with
binar y masks, patterns, regular expressions and strings.
$ r2 -d ls
[0x080498a0]> ds # step one instruction
[0x080498a0]> dsl # step source line
[0x080498a0]> dr= # display registers
eip 0xb7883812 oeax 0xffffffff eax 0xbfd89800
ecx 0x00000000 edx 0x00000000 esp 0xbfd89800
esi 0x00000000 edi 0x00000000 eflags 0x00000292
[0x080498a0]> dcu sym.main # continue until sym.main
[0x080498a0]> dpt # display process threads
6064 s (current)
6064 s thread_0
[0x080498a0]> dbt # display backtrace
main@global(128) {
.var80 = "argc = %d\n"; # arguments
printf (.var80, .arg0);
.var80 = "0x%08x : argv[%02d] = %s\n";
.var0 = 0;
.var4 = *.arg1;
while (.var0 <= .arg0) {
printf (.var80, .var4, .var0, .var4);
.var0 += 1; # increment counter
.arg1 += 4; # increment pointer
.var4 = *.arg1; # get next argument
}
.var80 = "0x%08x : envp[%02d] = %s\n"; # environ
.var0 = 0;
.var4 = *.arg2;
{ printf (.var80, .var4, .var0, .var4);
.var0 += 1; # increment counter
.arg2 += 4; # increment pointer
.var4 = *.arg2; # get next environ
} while (.var4);
0;
}
RAnal
* Data and code analysis
* Analyzed data is accessible from opcode level to
function level (opcode, BB, functions, vars, xrefs...)
* Combine data is very quickly
Eg.: Filter bb by function, graph bb hierarchy,
analyze references...
* Graph output in graphviz format (dot)
Demo
* Code & Data analysis
* Graph generation
- Full
- Par tial
* Source code graph
RAnal
RBin
* Header analysis
* Suppor ts:
ELF32, ELF64, PE32, PE32+, MACH-O,
MACH-O64, CLASS...
* Format-Agnostic API
* All sub-libs have been written from scratch
* All sub-libs offer a complete API for working
with specific formats
* Keeps reversing (and minimalism) in mind
RBin
* Read support
- Impor ts
- Symbols (Exports)
- Sections
- Linked libraries
- Strings
- Binar y info
object type
endianness
debug data/stripped
static/dynamic...
RBin
* Write support (*)
- Add/Remove/Resize {sections, impor ts, symbols}
- Edit header fields
* Metadata support (*)
(*) = Work in progress
Demo
* Format-agnostic API
$ python imports.py ls
$ python imports.py user32.dll
$ python imports.py osx-ls.1
$ cat imports.py
#!/usr/bin/python
from libr import *
import sys
if (len (sys.argv) == 2):
file = sys.argv[1]
else:
file = "/bin/ls"
b = RBin ()
b.load(file, None)
baddr= b.get_baddr()
print ’-> Imports’
for i in b.get_imports ():
print ’offset=0x%08x va=0x%08x %s’ % (
i.offset, baddr+i.rva, i.name)
RAsm
* (Dis)Assembly library
* Suppor ts x86, x86-64, PPC, MIPS, ARM,
SPARC, m68k, psosvm...
* Uses:
- (Dis)Assembly backed
- Compile inline code in order to be injected
- Assembly backend of rcc
* All parameters (arch, wordsize...) can be modified
in runtine, so generic injection are easy to implement
Demo
* Interactive disassembler
$ ./widget-asm
Demo
* XorPacker
- ELF structure
Demo (XorPacker)
$ LD_PRELOAD=./preload.so ./a.out
Fake sleep call from import 0x8 @ 0x804830c
Fake sleep call from import 0x18 @ 0x804832c
ROOTED!
Fake sleep call from import 0x18 @ 0x804832c
ROOTED!
Fake sleep call from import 0x18 @ 0x804832c
ROOTED!
ˆC
So...
EOF
• Ideas, questions?