radare2 entry

About Radare2:

radare2 is an open source and binary reverse engineering analysis framework, including anti-compile, analyze data, patching, comparative data, search, replace, virtualization and so on, along with the powerful scripting capabilities to load, it can run on almost all major the platform (GNU / Linux, .Windows * BSD, iOS, OSX, Solaris ...) and supports a lot of cpu architecture and file format. radare2 project is composed of a series of components that can be used alone or in radare2 interface - for example, we are going to use in the next experiment rahash2, rabin2, ragg2 three components, all of these components gives powerful static radare2 and dynamic analysis, a hex editor and the ability to overflow mining.

Kali already comes radare2

Familiar with the commonly used commands:

We can enter to see -h help

I begin with the main command used to get all kinds of information

A series of commands for analysis files

R2 introduced under the framework of one of the strongest tools: rabin2.

rabin2 may include obtaining ELF, PE, Mach-O, Java CLASS files section, header information, import and export table, character string related entry point, etc., and supports several output file format.

We can use it to get the binary file basic information

Enter the man rabin2 to see more usage

For disassembly, we can enter into the graphical interface vv

You can enter q to exit the graphical interface, back shell

To radare2 specific learning through a crack crackme

First rabin2 plus -I parameter to make rabin2 print out the binary file system attributes, language, byte order, frame, and which reinforcement technology

We can see that this is a 32-bit elf file, not stripped symbol table and are dynamically linked

Next, we try to run it

We can see, regardless of whether additional parameters are displayed wrong.

Next we use to crack radare2

Yellow may output an address (0x08048370), which is the automatic recognition of program entry point

Or we can use the print command to manually ie the entrance point

接下来输入aa或者aaa进行细致的分析

分析完成之后， r2会将所有有用的信息和特定的名字绑定在一起，比如区段、函数、符号、字符串，这些都被称作 'flags', flags 被整合进 <flag spaces>，一个 flag 是所有类似特征的集合

接下来我们看看所有的flag

我们打印出imports下面的信息

为了获取更多的信息，我们可以再列出数据段里的字符串

出现了关键字，一个是success，一个是我们之前运行时的wrong….

那我们接下来就跟着success走，看看哪儿进行了调用

输入命令axt @@ str.*

'axt' 命令用来在 data/code段里找寻某个地址相关的引用（更多的操作，请看 'ax?'）.

'@@'就像一个迭代器，用来在地址空间里不断地匹配后面一系列相关的命令（更多操作，请看 '@@?'）

'str.*' 是一个通配符，用来标记所有以 'str.'开头的信息，不光会列出字符串标志，同时也包括函数名，找到它们到底在哪里以及何处被调用。

接下来我们看看radare2分析出来哪些函数

看到两个引起我们注意的sym.beet和sym.rot13

接下来我们用 's main' 指令定位到main函数入口处，然后用 'pdf'输出反汇编代码

分析函数的执行流程，我们知道二进制程序是通过获取 beet函数的返回结果来判断是否正确

因此我们去beet函数反汇编的部分看看

因此我们定位到beet

输入[email protected]进行跳转

自动跳转到beet函数的反汇编部分

我们看到输入的参数被拷贝到了一个缓存空间里，这个空间的地址是 ‘ebp – local_88h’ 。 'local_88h' 就是十进制的 136。由于4个字节会被用来保存 ebp 的地址，4个字节被用来保存返回地址，所以这个缓冲区得大小是 128个字节.它们加起来刚好是 136. 我们输入的参数被拷贝到缓冲区后被用来和 sym.rot13的返回结果作对比， Rot-13 是一个著名的替换密码算法，在ctf和crackme中被广泛使用，这个函数接受了9个十六进制值作为参数，但是上图中看起来r2好像没有识别出来到底是什么字符，这里我们需要用 'ahi s' 来做些处理.

输入