8ea9758b8e
It was assumed all the values were functions but that might not be true and then wrong hints would be set. This should be handled by ESIL which is the only one it will know whether a call is gonna be made with the data under analysis. The issue #12340 shows how data is wrongly interpreted. const int a = 0x000103c9; int main() { int b; b = 2; b = b + a; return 0; } It gets translated to ┌ (fcn) main 56 │ main (int argc, char **argv, char **envp); │ ; UNKNOWN XREF from entry0 (+0x34) │ 0x000103c8 04b02de5 str fp, [sp, -4]! │ 0x000103cc 00b08de2 add fp, sp, 0 │ 0x000103d0 0cd04de2 sub sp, sp, 0xc │ 0x000103d4 0230a0e3 mov r3, 2 │ 0x000103d8 08300be5 str r3, [local_8h] ; 8 │ 0x000103dc 1c209fe5 ldr r2, aav.0x000103c9 ; [0x10400:4]=0x103c9 aav.0x000103c9 │ 0x000103e0 08301be5 ldr r3, [local_8h] ; 8 │ 0x000103e4 023083e0 add r3, r3, r2 │ 0x000103ec 0030a0e3 mov r3, 0 │ 0x000103f0 0300a0e1 mov r0, r3 │ 0x000103f4 00d08be2 add sp, fp, 0 │ 0x000103f8 04b09de4 pop {fp} └ 0x000103fc 1eff2fe1 bx lr ; DATA XREF from main (0x103dc) 0x00010400 .dword 0x000103c9 ; main There are other cases where they should be handled elsewhere like below | # 0x000102f8 0c009fe5 ldr r0, [0x0001030c] ; [0x1030c:4]=0x103c8 main | # 0x000102fc 0c309fe5 ldr r3, aav.0x00010404 ; [0x10310:4]=0x10404 aav.0x00010404 | # 0x00010300 ebffffeb bl sym.imp.__libc_start_main ;[1] ; int __libc_start_main(func main, int argc, char **ubp_av, func init, func fini, func rtld_fini, void *stack_end) # 0x00010304 f0ffffeb bl sym.imp.abort ;[2] ; void abort(void) r2 should handle __libc_start_main to detect those functions but aav should not make those assumptions
____ ___ ___ ___ ____ ___ ____
| _ \/ \| \/ \ _ \/ _ \ (__ \
| ( - | | ) - | ( _/ / __/
|__\__|_|__|___/__|__|_\__|___| |____|
https://www.radare.org
--pancake
| Jenkins | |
| TravisCI |  |
| AppVeyor | |
| Coverity |  |
| Infrastructure | |
| Codecov |  |
 |
|
Introduction
r2 is a rewrite from scratch of radare in order to provide a set of libraries and tools to work with binary files.
Radare project started as a forensics tool, a scriptable command-line hexadecimal editor able to open disk files, but later added support for analyzing binaries, disassembling code, debugging programs, attaching to remote gdb servers...
radare2 is portable.
Architectures
i386, x86-64, ARM, MIPS, PowerPC, SPARC, RISC-V, SH, m68k, AVR, XAP, System Z, XCore, CR16, HPPA, ARC, Blackfin, Z80, H8/300, V810, V850, CRIS, XAP, PIC, LM32, 8051, 6502, i4004, i8080, Propeller, Tricore, Chip8 LH5801, T8200, GameBoy, SNES, MSP430, Xtensa, NIOS II, Dalvik, WebAssembly, MSIL, EBC, TMS320 (c54x, c55x, c55+, c66), Hexagon, Brainfuck, Malbolge, DCPU16.
File Formats
ELF, Mach-O, Fatmach-O, PE, PE+, MZ, COFF, OMF, TE, XBE, BIOS/UEFI, Dyldcache, DEX, ART, CGC, Java class, Android boot image, Plan9 executable, ZIMG, MBN/SBL bootloader, ELF coredump, MDMP (Windows minidump), WASM (WebAssembly binary), Commodore VICE emulator, Game Boy (Advance), Nintendo DS ROMs and Nintendo 3DS FIRMs, various filesystems.
Operating Systems
Windows (since XP), GNU/Linux, OS X, [Net|Free|Open]BSD, Android, iOS, OSX, QNX, Solaris, Haiku, FirefoxOS.
Bindings
Vala/Genie, Python (2, 3), NodeJS, Lua, Go, Perl, Guile, PHP, Newlisp, Ruby, Java, OCaml...
Dependencies
radare2 can be built without any special dependency, just get a working toolchain (gcc, clang, tcc...) and use make.
Optionally you can use libewf for loading EnCase disk images.
To build the bindings you need latest valabind, g++ and swig2.
Install
The easiest way to install radare2 from git is by running the following command:
$ sys/install.sh
If you want to install radare2 in the home directory without using root privileges and sudo, simply run:
$ sys/user.sh
Building with meson + ninja
If you don't already have meson and ninja, you can install them with your distribution package manager or with r2pm:
$ r2pm -i meson
If you already have them installed, you can run this line to compile radare2:
$ python ./sys/meson.py --prefix=/usr --shared --install
This method is mostly useful on Windows because the initial building with Makefile is not suitable. If you are lost in any way, just type:
$ python ./sys/meson.py --help
Update
To update Radare2 system-wide, you don't need to uninstall or pull. Just re-run:
$ sys/install.sh
If you installed Radare2 in the home directory, just re-run:
$ sys/user.sh
Uninstall
In case of a polluted filesystem, you can uninstall the current version or remove all previous installations:
$ make uninstall
$ make purge
To remove all stuff including libraries, use
$ make system-purge
Package manager
Radare2 has its own package manager - r2pm. Its packages repository is on GitHub too. To start to using it for the first time, you need to initialize packages:
$ r2pm init
Refresh the packages database before installing any package:
$ r2pm update
To install a package, use the following command:
$ r2pm install [package name]
Bindings
All language bindings are under the r2-bindings directory. You will need to install swig and valabind in order to build the bindings for Python, Lua, etc..
APIs are defined in vapi files which are then translated to swig interfaces, nodejs-ffi or other and then compiled.
The easiest way to install the python bindings is to run:
$ r2pm install lang-python2 #lang-python3 for python3 bindings
$ r2pm install r2api-python
$ r2pm install r2pipe-py
In addition there are r2pipe bindings, which is an API
interface to interact with the prompt, passing commands
and receivent the output as a string, many commands support
JSON output, so its integrated easily with many languages
in order to deserialize it into native objects.
$ npm install r2pipe # NodeJS
$ gem install r2pipe # Ruby
$ pip install r2pipe # Python
$ opam install radare2 # OCaml
And also for Go, Rust, Swift, D, .NET, Java, NewLisp, Perl, Haskell, Vala, OCaml, and many more to come!
Regression Testsuite
Running make tests will fetch the radare2-regressions
repository and run all the tests in order to verify that no
changes break any functionality.
We run those tests on every commit, and they are also executed with ASAN and valgrind on different platforms to catch other unwanted 'features'.
Documentation
There is no formal documentation of r2 yet. Not all commands are compatible with radare1, so the best way to learn how to do stuff in r2 is by reading the examples from the web and appending '?' to every command you are interested in.
Commands are small mnemonics of few characters and there is some extra syntax sugar that makes the shell much more pleasant for scripting and interacting with the APIs.
You could also checkout the radare2 book.
Coding Style
Look at CONTRIBUTING.md.
Webserver
radare2 comes with an embedded webserver which serves a pure html/js interface that sends ajax queries to the core and aims to implement an usable UI for phones, tablets and desktops.
$ r2 -c=H /bin/ls
To use the webserver on Windows, you require a cmd instance with administrator rights. To start the webserver, use the following command in the project root.
> radare2.exe -c=H rax2.exe
Pointers
Website: https://www.radare.org/
IRC: irc.freenode.net #radare
Telegram: https://t.me/radare
Matrix: @radare2:matrix.org
Twitter: @radareorg