r2

10 rzeczy których mogłeś nie wiedzieć

O mnie

  • Octal Solutions
  • lider Wroc.NET
  • dotnetomaniak.pl
  • https://blog.octal.pl
  • https://ctfs.ghost.io
  • @pawel_lukasik
  • http://OstraPila.pl

10 rzeczy o r2

których mogliście nie wiedzieć

1. r2...

...istnieje

2. r2...

... to support wielu platform

3. r2...

... to ekosystem 

rasm2

asembler/disassembler

rabin2

ekstraktor

rasm2 -a x86 "mov eax,0x4141414141; call eax"
b841414141ffd0


rasm2 -a x86 -d 5690
push esi
nop
rabin2 -a x86 -e /bin/ls
000 0x00000000 38624 x86_64
[Entrypoints]
vaddr=0x1000011e0 paddr=0x000011e0 baddr=0x100000000 laddr=0x00000000 type=program

1 entrypoints

radiff2

diff tool

ragg2

prosty język wysokiego poziomu

radiff2 smoothie smoothie.old
0x0000057b 25 => 3f 0x0000057b
add@global(4) {
.var0 = .arg0 + .arg1;
.var0;
}

main@global() {
add (3,4);
}

rax2

konwerter

rarun2

A launcher for running programs within different environments, with different arguments, permissions, directories, and overridden default file descriptors. rarun2 is useful for:

  • Crackmes
  • Fuzzing
  • Test suites
rax2 0b101010101
0x155

rahash2

obliczanie hashy, ekrypt/dekrypt

rafind2

wyszukiwarka wzorców w pliku

rahash2 -a md5,sha1,sha256 -s "SecurityBSides"
0x00000000-0x0000000d md5: 405dc595d13e57f5831719832f59b97b
0x00000000-0x0000000d sha1: 1b93b81e42322dc96edd06514ddfa719d743f928
0x00000000-0x0000000d sha256: c1a602cb045e313e65e849c56ceecd73e3efa0a7d751b22c9eb44a09a245860e
rafind2 -s "bin" -Z /bin/ls
0x48fe bin/ls/cmp.c,v 1.12 2002/06/30 05:13:54 obrien Exp $
0x49be bin/ls/ls.c,v 1.66 2002/09/21 01:28:36 wollman Exp $
0x4a0e bin/ls/print.c,v 1.57 2002/08/29 14:29:09 keramida Exp $
0x4a5e bin/ls/util.c,v 1.38 2005/06/03 11:05:58 dd Exp $
0x4b19 bin/ls
0x6076 binder
0x71ae binder

r2pipe

import r2pipe

r2 = r2pipe.open("./smoothie")

r2.cmd('doo AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA')

r2.cmd('db 0x80485bb')
flag = ''
for i in range(31):
    r2.cmd('dc')
    dl = r2.cmd('dr? dl')
    flag += chr(int(dl,16))
    r2.cmd('dr eax = 0x0')

print flag

4. r2...

... to nie tylko tekst

Nie tylko tryb "graficzny" (VV)

Także "okienka" (V!)

Ale także IDE!

cutter

5. r2...

... to szukanie ROP

/R

[0x10000b000]> "/R/ pop r[dca]x;ret"

6. r2...

... to emulacja

e asm.emu=1

7. r2...

... to grafy

ag?

8. r2...

... to packet manager

r2pm

r2pm init
r2pm update
r2pm -i mdmp
r2pm -s

a3a     	 [rust] a3a - full program analysis in Rust (by defragger)
acr     	 [syspkg] ACR autoconf replacement
agc     	 [r2-arch] AGC disassembly module
androguard     	 [bin] androguard
armthumb     	 [r2-arch] Tiny ARM Thumb disassembler
avarice     	 [syspkg] avarice - gdbserver bridge the avr jtag
axml2xml     	 [app] axml2xml
baleful     	 [r2-arch] Baleful VM disassembler and analyzer
bcl     	 [r2-arch] BaseCall DNA sequence disassembler, analyzer
bin-md380fw      [r2-bin] Load md380 firmware images
blackfin     	 [r2-arch] BlackFin disassembler plugin
blessr2     	 [tui-node] Bless-based radare2 TUI
bokken     	 [syspkg] Bokken GUI
bpf     	 [r2-arch] BPF disassembler, analyzer, emulator
chita     	 [r2-r2pipe-node] Exploiting helper
clemency     	 [clemency] cLEMENCy architecture plugins
cutter     	 [gui] C++/Qt GUI for radare2
dex2jar     	 [app] dex2jar
diaphora     	 [r2] Diaphora binary diffing engine
dirtycow     	 [r2-io] Linux DirtyC0w exploit based IO plugin for r2
dlang     	 [r2-bin] dlang symbol demangler plugin
dwarf-parser     [syslib] dwarf parser
esilburner     	 [r2-r2pipe-python] Burn asm.emu results in real comments (MIPS oriented)
groovy     	 [app] groovy programming language
insert_dylib     [tool] insert_dylib - insert dylib into mach0 for OSX
io-ewf     	 [r2-io] EWF Forensic Image Loader
java2dex     	 [syspkg] java2dex
kaitai-struct-compiler     	 [bin] kaitai-struct-compiler commandline tool
keystone     	 [r2-arch] Keystone assembler plugins
keystone-lib     [syspkg] keystone assembler library
ksv     	 [bin] kaitai-struct-visualizer
lang-csharp     	 [r2-lang] C# r2pipe/RLang bin/csharp-cs
lang-duktape     	 [r2-lang] Duktape Javascript plugin #!duktape
lang-lua     	 [lang-lua] Lua r2pipe/RLang plugin
lang-python2     	 [lang-python2] Python2 r2pipe/RLang plugin
lang-python3     	 [lang-python3] Python3 r2pipe/RLang plugin
libdwarf     	 [syspkg] libdwarf - git
lief     	 [bin] LIEF bin plugins for r2
m68k-net     	 [r2-arch] m68k disassembler and analyzer
mc6809     	 [r2-arch] Motorola MC6809 disassembler
mdmp     	 [r2-bin] MDMP | Minidump file support
meson     	 [syspkg] meson build configuration for ninja
microblaze     	 [r2-arch] Support for the microblaze microprocessor assembly
msil     	 [r2-arch] MSIL disassembler (wip)
ninja     	 [syspkg] The Ninja build system required for meson
pcap     	 [r2-bin] PCAP | libpcap packet capture file support
pimp     	 [symbolic] Triton based R2 plugin for concolic execution and total control
ppcdisasm     	 [r2-arch] tiny PowerPC disassembler
psosvm     	 [r2-arch] PSOSVM disassembler
pyc     	 [r2-arch] PYC | Python byte-compiled file support
r2-lua53     	 Lua 5.3 disassembler, analyzer and bin parser plugins for radare2
r2angr     	 [r2-angr] ANGR IO plugin for radare2
r2api-lua     	 [r2-api] Native Lua API bindings
r2api-perl     	 [r2-script] Native Perl API bindings
r2api-python     	 [r2-api] Native Python API bindings
r2api-vala     	 [r2-script] Vala interface (VAPI) files for radare2 libraries
r2apktool     	 [r2-r2pipe-python] APK decompiler alternative to apktool
r2b-lua     	 [syspkg] Native Lua SWIG bindings
r2com     	 [r2-r2pipe-python] COM object identification. A comment specifying the COM object will be added before CoCreateInstance call
r2dec     	 [r2-r2pipe-node] an Experimental Decompiler
r2docker     	 [syspkg] radare2 docker image on Ubuntu
r2frida     	 [r2-io] r2frida:// IO plugin (env R2FRIDA_CYLANG=0|1)
r2k-linux     	 [r2-io] r2k Linux kernel module
r2k-linux-unstable     	 [r2k] Unstable Linux kernel module (from leberus/panda repository)
r2kaitai     	 [bin] r2kaitai command to list signatures and launch ksv
r2lldb     	 [r2lldb] lldb as backend for r2
r2pipe-cs     	 [r2pipe] API for C# and .Net
r2pipe-go     	 [syspkg-r2pipe] r2pipe API for Go
r2pipe-java     	 [r2pipe] r2pipe API for Java
r2pipe-js     	 [r2pipe] r2pipe API for NodeJS
r2pipe-ocaml     	 [r2pipe] r2pipe API for OCaml
r2pipe-py     	 [syspkg-r2pipe] r2pipe API for Python
r2pipe-rb     	 [syspkg-r2pipe] r2pipe API for Ruby
r2pipe-vala     	 [r2pipe] API for Vala and C-Glib
r2r     	 [r2-tool] radare2-regressions tools (provides r2r and r2-v)
r2rls     	 [r2-tool] radare2 releasing machinery
r2snow     	 [decompiler] snowman decompiler integration with radare2
r2wars     	 r2wars game
r2yara     	 [syspkg] r2 module for yara. Powerful of r2 functionalities in Yara
radare2     	 [pkg] radare2 symstall
radeco     	 [syspkg] Radare Decompiler in Rust
rarop     	 [syspkg] Graphical ROP chain builder using radare2 and r2pipe
retdec     	 [r2-r2pipe-node] RetDec Decompiler script
sdb     	 [syspkg] Simple/String DataBase
simulavr     	 [syspkg] simulavr - avr simulator with gdb server
simulavr-old     	 [syspkg] simulavr - avr simulator with gdb server
skynet     	 [syspkg] SkyNet TWD AI
ssdeep     	 [r2-core] ssdeep plugin for radare2
ssdeep-lib     	 [syspkg] ssdeep-2.13 library
swf     	 [r2-bin] SWF / Flash disassembler
swig     	 [syspkg] SWIG compiler
syms2elf     	 [r2-r2pipe-python] Export recognized symbols to the ELF symbol table
tcc     	 [syspkg] TinyCC compiler aka TCC
uncrustify     	 [syspkg] uncrustify
unicorn     	 [r2-debug] Unicorn emulator plugin for radare2
unicorn-lib     	 [syspkg] unicorn emulation library
vala     	 [syspkg] Vala compiler from git
valabind     	 [syspkg] Valabind tool to generate bindings from vapi files
valgrind     	 [r2-arch] Keystone assembler plugins
vapi     	 [syspkg] radare2 Vapi files for Vala
vc4     	 [r2-arch] VC4 / RPI VideoCore4 disassembler
winapi     	 [r2] Get info about windows functions
www-enyo     	 [r2-www] The enyo WebUI of /m
www-m     	 [r2-www] The Material WebUI of /m
www-p     	 [r2-www] The panel WebUI of /p
www-t     	 [r2-www] The tiled WebUI of /t
x86bea     	 [r2-arch] X86 BeaEngine Disassembler
x86olly     	 [r2-arch] X86 Olly Assembler
x86tab     	 [r2-arch] X86 Tab Assembler
x86zyan     	 [r2-arch] X86 Zyan Disassembler
yara     	 [syspkg] yara library and commandline tools from git
yara-r2     	 [r2-core] yara plugin for radare2
z80-nc     	 [r2-arch] Z80 assembler and disassembler non-GPL
zig-masm32     	 [r2-zig] Get zignatures for MASM32 libraries
zpu     	 [r2-arch] Support for the ZPU microprocessor assembly

9. r2...

... to statystyki

p=?

| p=       print bytes of current block in bars
| p==[..]  same subcommands as p=, but using flame column graph instead of rows
| p=b      same as above
| p=c      print number of calls per block
| p=d      print different bytes from block
| p=e      print entropy for each filesize/blocksize
| p=F      print number of 0xFF bytes for each filesize/blocksize
| p=i      print number of invalid instructions per block
| p=j      print number of jumps and conditional jumps in block
| p=m      print number of flags and marks in block
| p=p      print number of printable bytes for each filesize/blocksize
| p=s      print number of syscall and priviledged instructions
| p=z      print number of chars in strings in block
| p=0      print number of 0x00 bytes for each filesize/blocksize

p=?

10. r2...

... to nie tylko praca :)

2048

Clippy

omfg

omfg - change flags/perms for all maps (global)
wtf - write to file

Easter eggs

11. r2...

... to wiele więcej

...jak...

  • reverse debugger
  • wsparcie dla gdb: remote protocol
  • kody QR

Co dalej?

Gdzie szukać informacji?

  • radare2 blog
  • radare2 book
  • radare2 github (issues!)
  • stackoverflow/stackexchange
  • r2con201{6,7} videos

Dziękuję za uwagę!

@pawel_lukasik

r2

By Pawel Lukasik

r2

10 rzeczy których mogliście nie wiedzieć o radare2

  • 3,168