CheatPress

radare2 Reverse engineering toolkit

Version 6.2.4 · source

radare2, Postcard, light preview Light · Postcard 102 × 152 mm · PDF radare2, Postcard, dark preview Dark · Postcard 102 × 152 mm · PDF radare2, Postcard, ink saver preview Ink saver · Postcard 102 × 152 mm · PDF
radare2, A5, light preview Light · A5 148 × 210 mm · PDF radare2, A5, dark preview Dark · A5 148 × 210 mm · PDF radare2, A5, ink saver preview Ink saver · A5 148 × 210 mm · PDF
radare2, A4, light preview Light · A4 210 × 297 mm · PDF radare2, A4, dark preview Dark · A4 210 × 297 mm · PDF radare2, A4, ink saver preview Ink saver · A4 210 × 297 mm · PDF
radare2, A4 landscape, light preview Light · A4 landscape 297 × 210 mm · PDF radare2, A4 landscape, dark preview Dark · A4 landscape 297 × 210 mm · PDF radare2, A4 landscape, ink saver preview Ink saver · A4 landscape 297 × 210 mm · PDF
radare2, A3, light preview Light · A3 297 × 420 mm · PDF radare2, A3, dark preview Dark · A3 297 × 420 mm · PDF radare2, A3, ink saver preview Ink saver · A3 297 × 420 mm · PDF
radare2, A3 landscape, light preview Light · A3 landscape 420 × 297 mm · PDF radare2, A3 landscape, dark preview Dark · A3 landscape 420 × 297 mm · PDF radare2, A3 landscape, ink saver preview Ink saver · A3 landscape 420 × 297 mm · PDF
radare2, Letter, light preview Light · Letter 8.5 × 11 in · PDF radare2, Letter, dark preview Dark · Letter 8.5 × 11 in · PDF radare2, Letter, ink saver preview Ink saver · Letter 8.5 × 11 in · PDF
radare2, Tabloid, light preview Light · Tabloid 11 × 17 in · PDF radare2, Tabloid, dark preview Dark · Tabloid 11 × 17 in · PDF radare2, Tabloid, ink saver preview Ink saver · Tabloid 11 × 17 in · PDF

Start here

r2 -A <file>
Open and analyse
afl
List functions
s main
Seek to main
pdf
Disassemble function
iz
Strings in data
axt <addr>
Who references this?
VV
Graph view
<cmd>?
Help for any command

Concepts

  1. Open r2 file
  2. Analyse functions, xrefs
  3. Inspect seek + print
  4. Patch or debug write, step

Open and analyse

r2 -A <file>
Open and run full analysis
r2 -d <file>
Open under the debugger
r2 -q -c '<cmds>' <file>
Run commands and quit
Quote the command string; separate commands with ;. Use -qq to quit even after -i scripts.
r2 -a <arch> -b <bits> <file>
Force architecture and bits
aa
Basic analysis
aaa
Deeper analysis of calls and refs
afl
List functions
afi
Info about function here
afn <name> [addr]
Rename a function
axt <addr>
Find references to an address
e <key>=<value>
Set a config variable

Binary info

iI
Binary info and protections
iz
Strings in data sections
ii
Imported functions
ie
Entry points
iS
Sections
is
Symbols
il
Linked libraries
rabin2 -I <file>
Binary info without opening r2
rabin2 -z <file>
Strings from data sections

Seek and print

s <addr>
Seek to address, flag or function
s- / s+
Undo / redo seek
pdf
Disassemble current function
pd <n>
Disassemble n instructions
px [len]
Hexdump
ps
Print zero-terminated string
psw wide, psp Pascal, psb all strings in block.
p8 <len>
Bytes as hex pairs
pdc
Pseudo-decompile function
pdg needs the r2ghidra plugin for a real decompiler.
<cmd> @ <addr>
Run cmd at addr without seeking
<cmd>~<text>
Grep the output
? <expr>
Evaluate a number expression
f
List flags
CC <text>
Add comment here

Visual mode

V
Enter visual mode
VV
Graph view of function
p / P
Cycle print modes
h j k l
Move
Enter
Follow jump or call
u / U
Seek back / forward
g
Seek to offset or flag
c
Toggle cursor
;
Add comment
x / X
Xrefs to / from here
:
Run a command
_
Open flag and function HUD
s / S
Step into / over (debug)
q
Back to shell
/ <text>
Search for a string
/i <text>
Search ignoring case
/x <hex>
Search hex bytes
Dots are wildcard nibbles (/x 80..80); /x 8080:ff80 applies a mask.
/c <asm>
Search assembly text
/R [filter]
Search ROP gadgets
//
Repeat last search

Write and patch

wx <hex>
Write hex bytes
wa <asm>
Assemble and write
Separate instructions with ;.
wao nop
Patch opcode to nop
w <text>
Write string
oo+
Reopen in write mode

Debugger

ood [args]
Reopen file in debug mode
dc
Start or continue
dcu <addr>
Continue until address
db <addr>
Set breakpoint
db -<addr>
Remove breakpoint
db
List breakpoints
ds [n]
Step into
dso
Step over
dcr
Continue until return
dcs
Continue until syscall
dr
Show registers
dr <reg>=<val>
Set register
drr
Registers with references
dbt
Backtrace
dm
Memory maps
r2 -d <pid>
Attach to a running process
r2 -D gdb gdb://<host>:<port>
Debug via gdbserver

Companion tools

rasm2 -a x86 -b 64 '<asm>'
Assemble to hex
rasm2 -a x86 -b 64 -d <hex>
Disassemble hex
radiff2 -C <a> <b>
Diff code by function
radiff2 -g <sym> <a> <b>
Graph diff one symbol
rax2 <expr>
Calculate and convert bases
rax2 -e <n>
Swap endianness

Recipes

First look at an unknown binary
rabin2 -I ./a.outr2 -A ./a.outiz~httpafl~mains main; pdf
Find who uses a string
iz~password# note the vaddr, say 0x00402010axt 0x00402010s <caller>; pdf
Patch a conditional jump
r2 -w ./a.outs <addr_of_jne>wao noppd 3q
Break on main and inspect
r2 -d ./a.outdb maindcdrpxr 64 @ rspdso