Radare2 - Revision history

Edmund at 21:45, 29 January 2017

2017-01-29T21:45:20Z

← Older revision		Revision as of 00:45, 30 January 2017
Line 123:		Line 123:
	[4] https://github.com/radare/radare2/wiki/Implementing-a-new-analysis-plugin		[4] https://github.com/radare/radare2/wiki/Implementing-a-new-analysis-plugin
	[5] http://solidsec.blogspot.de/2015/09/reversing-elf-binaries-remote-debugging.html</nowiki>		[5] http://solidsec.blogspot.de/2015/09/reversing-elf-binaries-remote-debugging.html</nowiki>

			[[Category:Operatsioonisüsteemide administreerimine ja sidumine]]

Itaal at 00:18, 25 August 2016

2016-08-25T00:18:53Z

← Older revision		Revision as of 03:18, 25 August 2016
Line 1:		Line 1:
			[[File:Radare2.jpg]]

	'''Radare''' <nowiki>[1] is an open source and multi-platform framework for Reverse Engineering activities which supports assembly and disassembly many architectures and binary formats [2].		'''Radare''' <nowiki>[1] is an open source and multi-platform framework for Reverse Engineering activities which supports assembly and disassembly many architectures and binary formats [2].
	As any other reversing framework, Radare framework aims to recognize high level features on machine code, such as: data structures, functions and execution flows.		As any other reversing framework, Radare framework aims to recognize high level features on machine code, such as: data structures, functions and execution flows.
Line 6:		Line 8:
	</nowiki>		</nowiki>

	~~[[File:Radare2.jpg]]~~
	The framework is essentially composed by 7 executables:		The framework is essentially composed by 7 executables:

Itaal at 00:17, 25 August 2016

2016-08-25T00:17:45Z

Show changes

Itaal at 21:36, 24 August 2016

2016-08-24T21:36:51Z

@@ Line 28: / Line 28: @@
 Ragg2
 A frontend for r_egg. ragg2 compiles programs written in a simple high-level language into tiny binaries for x86, x86-64, and ARM.
 Rarun2

Itaal at 21:35, 24 August 2016

2016-08-24T21:35:25Z

@@ Line 6: / Line 6: @@
 The framework is essentially composed by 7 executables:
-    rax - responsible for converting numbers (e.g. string to hexadecimal, decimal to hexadecimal etc);
+Radare2 implements an advanced command line interface for moving around a file, analyzing data, disassembling, binary patching, data comparison, searching, replacing, visualizing. It can be scripted with a variety of languages, including Ruby, Python, Lua, and Perl.
-    rahash - block based hashing utility;
-    rabin - responsible for extracting information about binaries;
+Rabin2
-    rasm - assembly and disassembly from the shell;
+It allows you to extract information from executable binaries, such as ELF, PE, Java CLASS, and Mach-O. rabin2 is used by the core to get exported symbols, imports, file information, cross references (xrefs), library dependencies, sections, etc.
-     rafind - binary file search and edit tool;
-    radiff - responsible for differential analysis. Very useful for analyzing patches;
+Rasm2
-     radare2 - main executable which combines all above mentioned binaries.
+It is a command line assembler and disassembler for multiple architectures (including Intel x86 and x86-64, MIPS, ARM, PowerPC, Java, and MSIL).
 ==References==
 [1] http://radare.org/

Itaal at 21:29, 24 August 2016

2016-08-24T21:29:51Z

← Older revision		Revision as of 00:29, 25 August 2016
Line 14:		Line 14:
	radiff - responsible for differential analysis. Very useful for analyzing patches;		radiff - responsible for differential analysis. Very useful for analyzing patches;
	radare2 - main executable which combines all above mentioned binaries.		radare2 - main executable which combines all above mentioned binaries.
			==References==
			[1] http://radare.org/
			[2] https://en.wikipedia.org/wiki/Radare2#Supported_architectures.2Fformats
			[3] https://github.com/radare/radare2/wiki/Implementing-a-new-architecture
			[4] https://github.com/radare/radare2/wiki/Implementing-a-new-analysis-plugin
			[5] http://solidsec.blogspot.de/2015/09/reversing-elf-binaries-remote-debugging.html

Itaal at 21:25, 24 August 2016

2016-08-24T21:25:29Z

← Older revision		Revision as of 00:25, 25 August 2016
Line 1:		Line 1:
	Radare [1] is an open source and multi-platform framework for Reverse Engineering activities which supports assembly and disassembly many architectures and binary formats [2]. As any other reversing framework, Radare framework aims to recognize high level features on machine code, such as: data structures, functions and execution flows. Radare has buildings for the most populars Operating Systems, such as: Microsoft Windows, Mac OS X, Linux, BSD, iPhone OS, Solaris and MeeGo~~. Figure 01 presents the main command line interface for Radare~~.		Radare [1] is an open source and multi-platform framework for Reverse Engineering activities which supports assembly and disassembly many architectures and binary formats [2].
			As any other reversing framework, Radare framework aims to recognize high level features on machine code, such as: data structures, functions and execution flows.
			Radare has buildings for the most populars Operating Systems, such as: Microsoft Windows, Mac OS X, Linux, BSD, iPhone OS, Solaris and MeeGo.

	==
	Radare offers few options of interactive graphical interfaces, such as: Web, GTK (Python) and ASCII-Art graph. Another very useful characteristic due to its designing is the capacity to easily implement new architectures, binary formats and analyses [3][4]. Radare provides an open API and with many bindings for many programming languages, such as: Python, Java, Ruby, Go and Perl. Radare is also integrated with the most popular debuggers supporting local and remote debugging [5], such as: gdb, rap, webui, r2pipe, winedbg and windbg.		Radare offers few options of interactive graphical interfaces, such as: Web, GTK (Python) and ASCII-Art graph. Another very useful characteristic due to its designing is the capacity to easily implement new architectures, binary formats and analyses [3][4]. Radare provides an open API and with many bindings for many programming languages, such as: Python, Java, Ruby, Go and Perl. Radare is also integrated with the most popular debuggers supporting local and remote debugging [5], such as: gdb, rap, webui, r2pipe, winedbg and windbg.

	==
	The framework is essentially composed by 7 executables:		The framework is essentially composed by 7 executables:

Itaal: /* = */

2016-08-24T21:24:16Z

← Older revision		Revision as of 00:24, 25 August 2016
Line 1:		Line 1:
	Radare [1] is an open source and multi-platform framework for Reverse Engineering activities which supports assembly and disassembly many architectures and binary formats [2]. As any other reversing framework, Radare framework aims to recognize high level features on machine code, such as: data structures, functions and execution flows. Radare has buildings for the most populars Operating Systems, such as: Microsoft Windows, Mac OS X, Linux, BSD, iPhone OS, Solaris and MeeGo. Figure 01 presents the main command line interface for Radare.		Radare [1] is an open source and multi-platform framework for Reverse Engineering activities which supports assembly and disassembly many architectures and binary formats [2]. As any other reversing framework, Radare framework aims to recognize high level features on machine code, such as: data structures, functions and execution flows. Radare has buildings for the most populars Operating Systems, such as: Microsoft Windows, Mac OS X, Linux, BSD, iPhone OS, Solaris and MeeGo. Figure 01 presents the main command line interface for Radare.

	===		==
	Radare offers few options of interactive graphical interfaces, such as: Web, GTK (Python) and ASCII-Art graph. Another very useful characteristic due to its designing is the capacity to easily implement new architectures, binary formats and analyses [3][4]. Radare provides an open API and with many bindings for many programming languages, such as: Python, Java, Ruby, Go and Perl. Radare is also integrated with the most popular debuggers supporting local and remote debugging [5], such as: gdb, rap, webui, r2pipe, winedbg and windbg.		Radare offers few options of interactive graphical interfaces, such as: Web, GTK (Python) and ASCII-Art graph. Another very useful characteristic due to its designing is the capacity to easily implement new architectures, binary formats and analyses [3][4]. Radare provides an open API and with many bindings for many programming languages, such as: Python, Java, Ruby, Go and Perl. Radare is also integrated with the most popular debuggers supporting local and remote debugging [5], such as: gdb, rap, webui, r2pipe, winedbg and windbg.

	This post aims to presenting a comparison between reverse engineering features from IDA pro [6] and Radare 2. We are going to discourse in which situation it is more appropriate to use each tool. This article can be used as a condensed user guide for Radare (a complete guide is available online [7]). This post can be used also as a reference guide once the above mentioned official guide is outdated and most examples do not work with the most recent version of Radare any longer. In this small tutorial we show the main functionalities of Radare in practice by solving a small "crack me" challenge.		==


	The first comparison point is in case the analyst is more comfortable with command line interfaces and quick scripting features. Radare is very customizable and allow scripting characteristics and "piping" outputs to default Unix executables, such as: "wc", "more", "less" etc. This feature will be discoursed in more details in future.

	The framework is essentially composed by 7 executables:		The framework is essentially composed by 7 executables:

Itaal at 21:23, 24 August 2016

2016-08-24T21:23:40Z

← Older revision		Revision as of 00:23, 25 August 2016
Line 1:		Line 1:
	Radare [1] is an open source and multi-platform framework for Reverse Engineering activities which supports assembly and disassembly many architectures and binary formats [2]. As any other reversing framework, Radare framework aims to recognize high level features on machine code, such as: data structures, functions and execution flows. Radare has buildings for the most populars Operating Systems, such as: Microsoft Windows, Mac OS X, Linux, BSD, iPhone OS, Solaris and MeeGo. Figure 01 presents the main command line interface for Radare.		Radare [1] is an open source and multi-platform framework for Reverse Engineering activities which supports assembly and disassembly many architectures and binary formats [2]. As any other reversing framework, Radare framework aims to recognize high level features on machine code, such as: data structures, functions and execution flows. Radare has buildings for the most populars Operating Systems, such as: Microsoft Windows, Mac OS X, Linux, BSD, iPhone OS, Solaris and MeeGo. Figure 01 presents the main command line interface for Radare.

	~~Figure 01: Radare command line interface~~		===
	Radare offers few options of interactive graphical interfaces, such as: Web, GTK (Python) and ASCII-Art graph. Another very useful characteristic due to its designing is the capacity to easily implement new architectures, binary formats and analyses [3][4]. Radare provides an open API and with many bindings for many programming languages, such as: Python, Java, Ruby, Go and Perl. Radare is also integrated with the most popular debuggers supporting local and remote debugging [5], such as: gdb, rap, webui, r2pipe, winedbg and windbg.		Radare offers few options of interactive graphical interfaces, such as: Web, GTK (Python) and ASCII-Art graph. Another very useful characteristic due to its designing is the capacity to easily implement new architectures, binary formats and analyses [3][4]. Radare provides an open API and with many bindings for many programming languages, such as: Python, Java, Ruby, Go and Perl. Radare is also integrated with the most popular debuggers supporting local and remote debugging [5], such as: gdb, rap, webui, r2pipe, winedbg and windbg.

Itaal: Created page with " Radare [1] is an open source and multi-platform framework for Reverse Engineering activities which supports assembly and disassembly many architectures and binary formats [2]..."

2016-08-24T21:22:30Z

Created page with " Radare [1] is an open source and multi-platform framework for Reverse Engineering activities which supports assembly and disassembly many architectures and binary formats [2]..."

New page

Radare [1] is an open source and multi-platform framework for Reverse Engineering activities which supports assembly and disassembly many architectures and binary formats [2]. As any other reversing framework, Radare framework aims to recognize high level features on machine code, such as: data structures, functions and execution flows. Radare has buildings for the most populars Operating Systems, such as: Microsoft Windows, Mac OS X, Linux, BSD, iPhone OS, Solaris and MeeGo. Figure 01 presents the main command line interface for Radare.

Figure 01: Radare command line interface
Radare offers few options of interactive graphical interfaces, such as: Web, GTK (Python) and ASCII-Art graph. Another very useful characteristic due to its designing is the capacity to easily implement new architectures, binary formats and analyses [3][4]. Radare provides an open API and with many bindings for many programming languages, such as: Python, Java, Ruby, Go and Perl. Radare is also integrated with the most popular debuggers supporting local and remote debugging [5], such as: gdb, rap, webui, r2pipe, winedbg and windbg.

This post aims to presenting a comparison between reverse engineering features from IDA pro [6] and Radare 2. We are going to discourse in which situation it is more appropriate to use each tool. This article can be used as a condensed user guide for Radare (a complete guide is available online [7]). This post can be used also as a reference guide once the above mentioned official guide is outdated and most examples do not work with the most recent version of Radare any longer. In this small tutorial we show the main functionalities of Radare in practice by solving a small "crack me" challenge.

The first comparison point is in case the analyst is more comfortable with command line interfaces and quick scripting features. Radare is very customizable and allow scripting characteristics and "piping" outputs to default Unix executables, such as: "wc", "more", "less" etc. This feature will be discoursed in more details in future.

The framework is essentially composed by 7 executables:

rax - responsible for converting numbers (e.g. string to hexadecimal, decimal to hexadecimal etc);
rahash - block based hashing utility;
rabin - responsible for extracting information about binaries;
rasm - assembly and disassembly from the shell;
rafind - binary file search and edit tool;
radiff - responsible for differential analysis. Very useful for analyzing patches;
radare2 - main executable which combines all above mentioned binaries.