已经说了三种反汇编引擎了，再一起学习一种radare2，这个开源项目不仅仅时做反汇编，还有其他功能等着我们去发掘，当然可以根据自己的需求选择合适的反汇编引擎，因为之前的文章都是简单的把反汇编引擎j简单跑起来，并没有去讲到所有的API的使用，有兴趣的同学可以研究一下，记得一起分享下鸭；
Radare2，拥有非常强大的功能，包括反汇编、调试、打补丁、虚拟化等等，而且可以运行在几乎所有的主流平台上（GNU/Linux、Windows、BSD、iOS、OSX……）
github:https://github.com/radareorg/radare2
官网：
0x01:官网有提供二进制文件的下载，不过作者还是建议在本地去编译；
//cd master --> cd sys --> ./install.sh
curits@curits-virtual-machine:~/Desktop/radare2-master/sys$ ./install.sh
LD libr_socket.so
make[1]: curl: Command not found
Makefile:266: recipe for target 'capstone-4.0.2.tar.gz' failed
make[1]: *** [capstone-4.0.2.tar.gz] Error 127
make[1]: *** Waiting for unfinished jobs....
ar: creating libr_winkd.a
Makefile:56: recipe for target 'all' failed
make: *** [all] Error 2
//报错了，没有curl那就安装
curits@curits-virtual-machine:~/Desktop/radare2-master/sys$ sudo apt-get install curl
//curl 安装成功之后
curits@curits-virtual-machine:~/Desktop/radare2-master/sys$ ./install.sh
...........................
mkdir -p "/usr/local/share/radare2/4.6.0-git/"
/bin/sh sys/ldconfig.sh
/bin/sh ./configure-plugins --rm-static //usr/local/lib/radare2/last/
configure-plugins: Loading ./plugins.cfg ..
Removed 0 shared plugins that are already static
0x02:命令行使用方法
Radare2 在命令行下有一些小工具可供使用：
radare2：十六进制编辑器和调试器的核心，通常通过它进入交互式界面；
rabin2：从可执行二进制文件中提取信息；
rasm2：汇编和反汇编；
rahash2：基于块的哈希工具；
radiff2：二进制文件或代码差异比对；
rafind2：查找字节模式；
ragg2：r_egg 的前端，将高级语言编写的简单程序编译成x86、x86-64和ARM的二进制文件；
rarun2：用于在不同环境中运行程序；
rax2：数据格式转换；
curits@curits-virtual-machine:~/Desktop/radare2-master$ ra
rabin2 radiff2 ragg2 ranlib rasign2 rasttopnm rawtopgm rax2
radare2 rafind2 rahash2 rarun2 rasm2 raw rawtoppm
radare2
curits@curits-virtual-machine:~/Desktop/radare2-master$ radare2 -h
Usage: r2 [-ACdfLMnNqStuvwzX] [-P patch] [-p prj] [-a arch] [-b bits] [-i file]
[-s addr] [-B baddr] [-m maddr] [-c cmd] [-e k=v] file|pid|-|--|=
-- run radare2 without opening any file
- same as 'r2 malloc://512'
= read file from stdin (use -i and -c to run cmds)
-= perform !=! command to run all commands remotely
-0 print \x00 after init and every command
-2 close stderr file descriptor (silent warning messages)
-a [arch] set asm.arch
-A run 'aaa' command to analyze all referenced code
-b [bits] set asm.bits
-B [baddr] set base address for PIE binaries
-c 'cmd..' execute radare command
-C file is host:port (alias for -c+=http://%s/cmd/)
-d debug the executable 'file' or running process 'pid'
-D [backend] enable debug mode (e cfg.debug=true)
-e k=v evaluate config var
-f block size = file size
-F [binplug] force to use that rbin plugin
-h, -hh show help message, -hh for long
-H ([var]) display variable
-i [file] run script file
-I [file] run script file before the file is opened
-k [OS/kern] set asm.os (linux, macos, w32, netbsd, ...)
-l [lib] load plugin file
-L list supported IO plugins
-m [addr] map file at given address (loadaddr)
-M do not demangle symbol names
-n, -nn do not load RBin info (-nn only load bin structures)
-N do not load user settings and scripts
-NN do not load any script or plugin
-q quiet mode (no prompt) and quit after -i
-qq quit after running all -c and -i
-Q quiet mode (no prompt) and quit faster (quickLeak=true)
-p [prj] use project, list if no arg, load if no file
-P [file] apply rapatch file and quit
-r [rarun2] specify rarun2 profile to load (same as -e dbg.profile=X)
-R [rr2rule] specify custom rarun2 directive
-s [addr] initial seek
-S start r2 in sandbox mode
-T do not compute file hashes
-u set bin.filter=false to get raw sym/sec/cls names
-v, -V show radare2 version (-V show lib versions)
-w open file in write mode
-x open without exec-flag (asm.emu will not work), See io.exec
-X same as -e bin.usextr=false (useful for dyldcache)
-z, -zz do not load strings or load them even in raw
//调试二进制文件或进程
curits@curits-virtual-machine:~/Desktop/radare2-master$ sudo radare2 -d "/home/curits/Desktop/a.out"
Process with PID 30648 started...
= attach 30648 30648
bin.baddr 0x560384b60000
Using 0x560384b60000
asm.bits 64
-- Remember that word: C H A I R
[0x7fe205753090]>
[0x7fe205753090]>
rabin2
curits@curits-virtual-machine:~/Desktop/radare2-master$ rabin2 -h
Usage: rabin2 [-AcdeEghHiIjlLMqrRsSUvVxzZ] [-@ at] [-a arch] [-b bits] [-B addr]
[-C F:C:D] [-f str] [-m addr] [-n str] [-N m:M] [-P[-P] pdb]
[-o str] [-O str] [-k query] [-D lang symname] file
-@ [addr] show section, symbol or import at addr
-A list sub-binaries and their arch-bits pairs
-a [arch] set arch (x86, arm, .. or <arch>_<bits>)
-b [bits] set bits (32, 64 ...)
-B [addr] override base address (pie bins)
-c list classes
-cc list classes in header format
-C [fmt:C:D] create [elf,mach0,pe] with Code and Data hexpairs (see -a)
-d show debug/dwarf information
-D lang name demangle symbol name (-D all for bin.demangle=true)
-e entrypoint
-ee constructor/destructor entrypoints
-E globally exportable symbols
-f [str] select sub-bin named str
-F [binfmt] force to use that bin plugin (ignore header check)
-g same as -SMZIHVResizcld -SS -SSS -ee (show all info)
-G [addr] load address . offset to header
-h this help message
-H header fields
-i imports (symbols imported from libraries)
-I binary info
-j output in json
-k [sdb-query] run sdb query. for example: '*'
-K [algo] calculate checksums (md5, sha1, ..)
-l linked libraries
-L [plugin] list supported bin plugins or plugin details
-m [addr] show source line at addr
-M main (show address of main symbol)
-n [str] show section, symbol or import named str
-N [min:max] force min:max number of chars per string (see -z and -zz)
-o [str] output file/folder for write operations (out by default)
-O [str] write/extract operations (-O help)
-p show physical addresses
-P show debug/pdb information
-PP download pdb file for binary
-q be quiet, just show fewer data
-qq show less info (no offset/size for -z for ex.)
-Q show load address used by dlopen (non-aslr libs)
-r radare output
-R relocations
-s symbols
-S sections
-SS segments
-SSS sections mapping to segments
-t display file hashes
-T display file signature
-u unfiltered (no rename duplicated symbols/sections)
-U resoUrces
-v display version and quit
-V Show binary version information
-w display try/catch blocks
-x extract bins contained in file
-X [fmt] [f] .. package in fat or zip the given files and bins contained in file
-z strings (from data section)
-zz strings (from raw bins [e bin.rawstr=1])
-zzz dump raw strings to stdout (for huge files)
-Z guess size of binary program
Environment:
RABIN2_LANG: e bin.lang # assume lang for demangling
RABIN2_NOPLUGINS: # do not load shared plugins (speedup loading)
RABIN2_DEMANGLE=0:e bin.demangle # do not demangle symbols
RABIN2_MAXSTRBUF: e bin.maxstrbuf # specify maximum buffer size
RABIN2_STRFILTER: e bin.str.filter # r2 -qc 'e bin.str.filter=??' -
RABIN2_STRPURGE: e bin.str.purge # try to purge false positives
RABIN2_DEBASE64: e bin.debase64 # try to debase64 all strings
RABIN2_DMNGLRCMD: e bin.demanglercmd # try to purge false positives
RABIN2_PDBSERVER: e pdb.server # use alternative PDB server
RABIN2_SYMSTORE: e pdb.symstore # path to downstream symbol store
RABIN2_PREFIX: e bin.prefix # prefix symbols/sections/relocs with a specific string
R2_CONFIG: # sdb config file
//得到二进制文件信息
curits@curits-virtual-machine:~/Desktop/radare2-master$ rabin2 -I /home/curits/Desktop/a.out
arch x86
baddr 0x0
binsz 6441
bintype elf
bits 64
canary false
class ELF64
compiler GCC: (Ubuntu 7.5.0-3ubuntu1~18.04) 7.5.0
crypto false
endian little
havecode true
intrp /lib64/ld-linux-x86-64.so.2
laddr 0x0
lang c
linenum true
lsyms true
machine AMD x86-64 architecture
maxopsz 16
minopsz 1
nx true
os linux
pcalign 0
pic true
relocs true
relro full
rpath NONE
sanitiz false
static false
stripped false
subsys linux
va true
当我们拿到一个二进制文件时，第一步就是获取关于它的基本信息，这时候就可以使用 rabin2。rabin2 可以获取包括 ELF、PE、Mach-O、Java CLASS 文件的区段、头信息、导入导出表、数据段字符串、入口点等信息，并且支持多种格式的输出。
下面介绍一些常见的用法：（我还会列出其他实现类似功能工具的用法，你可以对比一下它们的输出）
-I：最常用的参数，它可以打印出二进制文件信息，其中我们需要重点关注其使用的安全防护技术，如 canary、pic、nx 等。（file、chekcsec -f）
-e：得到二进制文件的入口点。（｀readelf -h`）
-i：获得导入符号表，RLT中的偏移等。（readelf -r）
-E：获得全局导出符号表。
-s：获得符号表。（readelf -s）
-l：获得二进制文件使用到的动态链接库。（ldd）
-z：从 ELF 文件的 .rodare 段或 PE 文件的 .text 中获得字符串。（strings -d）
-S：获得完整的段信息。（readelf -S）
-c：列出所有类，在分析 Java 程序是很有用。
下面要讲到的就是本文的主题辣，反汇编引擎的使用；
0x03:具体的使用方法可以参照 https://book.rada.re/tools/rasm2/disassemble.html
使用rasm2进行反汇编：
curits@curits-virtual-machine:~/Desktop/radare2-master$ rasm2 -h
'Usage: rasm2 [-ACdDehLBvw] [-a arch] [-b bits] [-o addr] [-s syntax]
[-f file] [-F fil:ter] [-i skip] [-l len] 'code'|hex|-
-a [arch] Set architecture to assemble/disassemble (see -L)
-A Show Analysis information from given hexpairs
-b [bits] Set cpu register size (8, 16, 32, 64) (RASM2_BITS)
-B Binary input/output (-l is mandatory for binary input)
-c [cpu] Select specific CPU (depends on arch)
-C Output in C format
-d, -D Disassemble from hexpair bytes (-D show hexpairs)
-e Use big endian instead of little endian
-E Display ESIL expression (same input as in -d)
-f [file] Read data from file
-F [in:out] Specify input and/or output filters (att2intel, x86.pseudo, ...)
-h, -hh Show this help, -hh for long
-i [len] ignore/skip N bytes of the input buffer
-j output in json format
-k [kernel] Select operating system (linux, windows, darwin, ..)
-l [len] Input/Output length
-L List Asm plugins: (a=asm, d=disasm, A=analyze, e=ESIL)
-o,-@ [addr] Set start address for code (default 0)
-O [file] Output file name (rasm2 -Bf a.asm -O a)
-p Run SPP over input for assembly
-q quiet mode
-r output in radare commands
-s [syntax] Select syntax (intel, att)
-v Show version information
-x Use hex dwords instead of hex pairs when assembling.
-w What's this instruction for? describe opcode
If '-l' value is greater than output length, output is padded with nops
If the last argument is '-' reads from stdin
Environment:
RASM2_NOPLUGINS do not load shared plugins (speedup loading)
RASM2_ARCH same as rasm2 -a
RASM2_BITS same as rasm2 -b
R_DEBUG if defined, show error messages and crash signal
curits@curits-virtual-machine:~/Desktop$ sudo rasm2 -a x86 -b 64 -d "488d 2551 3f60 01e8 d400 0000"
lea rsp, [rip + 0x1603f51]
call 0xe0
curits@curits-virtual-machine:~/Desktop/radare2-master$ rasm2 -a x86 -b 64 'mov ebx,520'
bb08020000
curits@curits-virtual-machine:~/Desktop/radare2-master$ rasm2 -d bb08020000
mov ebx, 0x208
curits@curits-virtual-machine:~/Desktop/radare2-master$ rasm2 -D bb08020000
0x00000000 5 bb08020000 mov ebx, 0x208