In 10 ways to analyze binary files on Linux, I defined methods to use Linux’s wealthy set of native instruments to investigate binaries. But if you wish to discover your binary additional, you want a instrument that’s custom-made for binary evaluation. If you’re new to binary evaluation and have principally labored with scripting languages, 9 essential GNU binutils tools will allow you to get began studying the compilation course of and what constitutes a binary.
It’s pure to ask why you want yet one more instrument if current Linux-native instruments do related issues. Well, it is for a similar causes you utilize your cellphone as your alarm clock, to take notes, as a digicam, to hearken to music, to surf the web, and sometimes to make and obtain calls. Previously, separate gadgets and instruments dealt with these capabilities — like a bodily digicam for taking footage, a small notepad for taking notes, a bedside alarm clock to get up, and so forth. Having one gadget to do a number of (however associated) issues is handy for the person. Also, the killer function is interoperability between the separate capabilities.
Similarly, although many Linux instruments have a particular objective, having related (and higher) performance bundled right into a single instrument may be very useful. This is why I believe Radare2 ought to be your go-to instrument each time it’s worthwhile to work with binaries.
Radare2 (also referred to as r2) is a “Unix-like reverse engineering framework and command-line toolset,” in line with its GitHub profile. The “2” in its title is as a result of this model was rewritten from scratch to make it extra modular.
Why Radare2?
There are tons of (non-native) Linux instruments on the market which are used for binary evaluation, so why do you have to select Radare2? My causes are easy.
First, it is an open supply undertaking with an energetic and wholesome neighborhood. If you’re in search of slick, new options or availability of bug fixes, this issues loads.
Second, Radare2 can be utilized on the command line, and it has a wealthy graphical person interface (GUI) atmosphere known as Cutter for individuals who are extra snug with GUIs. Being a long-time Linux person, I feed extra snug on the shell. While there’s a slight studying curve to getting accustomed to Radare2’s instructions, I’d examine it to learning Vim. You study basic items first, and when you grasp them, you progress on to extra superior stuff. In no time, it turns into second nature.
Third, Radare2 has good help for exterior instruments by way of plugins. For instance, the just lately open sourced Ghidra binary evaluation and reversing instrument is widespread for its decompiler function, which is a essential factor of reversing software program. You can set up and use the Ghidra decompiler proper from the Radare2 console, which is wonderful and offers you the very best of each worlds.
Get began with Radare2
To set up Radare2, merely clone the repo and run the person.sh script. You would possibly want to put in some prerequisite packages if they don’t seem to be already in your system. Once the set up is full, run the r2 -v command to see if Radare2 was put in correctly:
$ git clone https://github.com/radareorg/radare2.git
$ cd radare2
$ sys/person.sh# model
$ r2 -v
radare2 Four.6.Zero-git 25266 @ linux-x86-64 git.Four.Four.Zero-930-g48047b317
commit: 48047b3171e6ed0480a71a04c3693a0650d03543 construct: 2020-11-17__09:31:03
$
Get a pattern check binary
Now that r2 is put in, you want a pattern binary to strive it out. You may use any system binary (ls, bash, and so forth), however to maintain issues easy for this tutorial, compile the next C program:
$ cat adder.c
#embrace <stdio.h>int adder(int num)
return num + 1;int most important()
$
$
$ gcc adder.c -o adder
$
$ file adder
adder: ELF 64-bit LSB executable, x86-64, model 1 (SYSV), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, for GNU/Linux three.2.Zero, BuildID[sha1]=9d4366f7160e1ffb46b14466e8e0d70f10de2240, not stripped
$
$ ./adder
Number now could be : 101
$
Load the binary
To analyze the binary, you need to load it in Radare2. Load it by offering the file as a command line argument to the r2 command. You’re dropped right into a separate Radare2 console totally different out of your shell. To exit the console, you’ll be able to sort Quit or Exit or hit Ctrl+D:
$ r2 ./adder
-- Learn pancake as if you had been radare!
[0x004004b0]> give up
$
Analyze the binary
Before you’ll be able to discover the binary, you need to ask r2 to investigate it for you. You can try this by working the aaa command within the r2 console;
$ r2 ./adder
-- Sorry, radare2 has skilled an inside error.
[0x004004b0]>
[0x004004b0]>
[0x004004b0]> aaa
[x] Analyze all flags beginning with sym. and entry0 (aa)
[x] Analyze operate calls (aac)
[x] Analyze len bytes of directions for references (aar)
[x] Check for vtables
[x] Type matching evaluation for all capabilities (aaft)
[x] Propagate noreturn info
[x] Use -AA or aaaa to carry out further experimental evaluation.
[0x004004b0]>
This implies that every time you decide a binary for evaluation, you need to sort a further command to aaa after loading the binary. You can bypass this by calling r2 with -A adopted by the binary title; this tells r2 to auto-analyze the binary for you:
$ r2 -A ./adder
[x] Analyze all flags beginning with sym. and entry0 (aa)
[x] Analyze operate calls (aac)
[x] Analyze len bytes of directions for references (aar)
[x] Check for vtables
[x] Type matching evaluation for all capabilities (aaft)
[x] Propagate noreturn info
[x] Use -AA or aaaa to carry out further experimental evaluation.
-- Already up-to-date.
[0x004004b0]>
Get some fundamental details about the binary
Before you start analyzing a binary, you want a place to begin. In many circumstances, this may be the binary’s file format (ELF, PE, and so forth), the structure the binary was constructed for (x86, AMD, ARM, and so forth), and whether or not the binary is 32 bit or 64 bit. R2’s helpful iI command can present the required info:
[0x004004b0]> iI
arch x86
baddr 0x400000
binsz 14724
bintype elf
bits 64
canary false
class ELF64
compiler GCC: (GNU) eight.three.1 20190507 (Red Hat eight.three.1-Four)
crypto false
endian little
havecode true
intrp /lib64/ld-linux-x86-64.so.2
laddr 0x0
lang c
linenum true
lsyms true
machine AMD x86-64 structure
maxopsz 16
minopsz 1
nx true
os linux
pcalign Zero
pic false
relocs true
relro partial
rpath NONE
sanitiz false
static false
stripped false
subsys linux
va true[0x004004b0]>
[0x004004b0]>
Imports and exports
Often, as soon as you understand what sort of file you’re coping with, you wish to know what sort of commonplace library capabilities the binary makes use of or study this system’s potential functionalities. In the pattern C program on this tutorial, the one library operate is printf to print a message. You can see this by working the ii command, which reveals all the binary’s imports:
[0x004004b0]> ii
[Imports]
nth vaddr bind sort lib title
―――――――――――――――――――――――――――――――――――――
1 0x00000000 WEAK NOTYPE _ITM_deregisterTMCloneTable
2 0x004004a0 GLOBAL FUNC printf
three 0x00000000 GLOBAL FUNC __libc_start_main
Four 0x00000000 WEAK NOTYPE __gmon_start__
5 0x00000000 WEAK NOTYPE _ITM_registerTMCloneTable
The binary can even have its personal symbols, capabilities, or information. These capabilities are normally proven beneath Exports. The check binary has two capabilities—most important and adder—which are exported. The remainder of the capabilities are added in the course of the compilation section when the binary is being constructed. The loader wants these to load the binary (don’t fret an excessive amount of about them for now):
[0x004004b0]>
[0x004004b0]> iE
[Exports]nth paddr vaddr bind sort dimension lib title
――――――――――――――――――――――――――――――――――――――――――――――――――――――
82 0x00000650 0x00400650 GLOBAL FUNC 5 __libc_csu_fini
85 ---------- 0x00601024 GLOBAL NOTYPE Zero _edata
86 0x00000658 0x00400658 GLOBAL FUNC Zero _fini
89 0x00001020 0x00601020 GLOBAL NOTYPE Zero __data_start
90 0x00000596 0x00400596 GLOBAL FUNC 15 adder
92 0x0000Zero670 0x00400670 GLOBAL OBJ Zero __dso_handle
93 0x00000668 0x00400668 GLOBAL OBJ Four _IO_stdin_used
94 0x000005e0 0x004005e0 GLOBAL FUNC 101 __libc_csu_init
95 ---------- 0x00601028 GLOBAL NOTYPE Zero _end
96 0x00Zero004e0 0x004004e0 GLOBAL FUNC 5 _dl_relocate_static_pie
97 0x00Zero004b0 0x004004b0 GLOBAL FUNC 47 _start
98 ---------- 0x00601024 GLOBAL NOTYPE Zero __bss_start
99 0x000005a5 0x004005a5 GLOBAL FUNC 55 most important
100 ---------- 0x00601028 GLOBAL OBJ Zero __TMC_END__
102 0x00000468 0x00400468 GLOBAL FUNC Zero _init[0x004004b0]>
Hash data
How are you aware if two binaries are related? You cannot precisely open a binary and think about the supply code inside it. In most circumstances, a binary’s hash—md5sum, sha1, sha256—is used to uniquely determine it. You can discover the binary hash utilizing the it command:
[0x004004b0]> it
md5 7e6732f2b11dec4a0c7612852cede670
sha1 d5fa848c4b53021f6570dd9b18d115595a2290ae
sha256 13dd5a492219dac1443a816ef5f91db8d149e8edbf26f24539c220861769e1c2
[0x004004b0]>
Functions
Code is grouped into capabilities; to record which capabilities are current inside a binary, run the afl command. The following record reveals the principle and adder capabilities. Usually, capabilities that begin with sym.imp are imported from the usual library (glibc on this case):
[0x004004b0]> afl
0x004004b0 1 46 entry0
0x004004f0 Four 41 -> 34 sym.deregister_tm_clones
0x00400520 Four 57 -> 51 sym.register_tm_clones
0x00400560 three 33 -> 32 sym.__do_global_dtors_aux
0x00400590 1 6 entry.init0
0x00400650 1 5 sym.__libc_csu_fini
0x00400658 1 13 sym._fini
0x00400596 1 15 sym.adder
0x004005e0 Four 101 loc..annobin_elf_init.c
0x004004e0 1 5 loc..annobin_static_reloc.c
0x004005a5 1 55 most important
0x004004a0 1 6 sym.imp.printf
0x00400468 three 27 sym._init
[0x004004b0]>
Cross-references
In C, the principle operate is the place a program begins its execution. Ideally, different capabilities are known as from most important and, upon exiting a program, the principle operate returns an exit standing to the working system. This is obvious within the supply code; nevertheless, what a couple of binary? How are you able to inform the place the adder operate known as?
You can use the axt command adopted by the operate title to see the place the adder operate known as; as you’ll be able to see under, it’s known as from the principle operate. This is named cross-referencing. But what calls the principle operate itself? The axt most important operate under reveals that it’s known as by entry0 (I will depart studying about entry0 as an train for the reader):
[0x004004b0]> axt sym.adder
most important 0x4005b9 [CALL] name sym.adder
[0x004004b0]>
[0x004004b0]> axt most important
entry0 0x4004d1 [DATA] mov rdi, most important
[0x004004b0]>
Seek places
When working with textual content information, you usually transfer inside a file by referencing a line quantity adopted by a row or a column quantity; in a binary, you utilize addresses. These are hexadecimal numbers beginning with 0x adopted by an handle. To discover the place you’re in a binary, run the s command. To transfer to a distinct location, use the s command adopted by the handle.
Function names are like labels, that are represented by addresses internally. If the operate title is within the binary (not stripped), you should utilize the s command adopted by the operate title to leap to a particular operate handle. Similarly, if you wish to leap to the beginning of the binary, sort s Zero:
[0x004004b0]> s
0x4004b0
[0x004004b0]>
[0x004004b0]> s most important
[0x004005a5]>
[0x004005a5]> s
0x4005a5
[0x004005a5]>
[0x004005a5]> s sym.adder
[0x00400596]>
[0x00400596]> s
0x400596
[0x00400596]>
[0x00400596]> s Zero
[0x00000000]>
[0x00000000]> s
0x0
[0x00000000]>
Hexadecimal view
Oftentimes, the uncooked binary does not make sense. It can assist to view the binary in hexadecimal mode alongside its equal ASCII illustration:
[0x004004b0]> s most important
[0x004005a5]>
[0x004005a5]> px
- offset - Zero 1 2 three Four 5 6 7 eight 9 A B C D E F 0123456789ABCDEF
0x004005a5 5548 89e5 4883 ec10 c745 fc64 0000 Zero08b UH..H....E.d....
0x004005b5 45fc 89c7 e8d8 ffff ff89 45f8 8b45 f889 E.........E..E..
0x004005c5 c6bf 7806 4000 b800 0000 00e8 cbfe ffff ..x.@...........
0x004005d5 b800 0000 00c9 c30f 1f40 00f3 0f1e fa41 [email protected]
0x004005e5 5749 89d7 4156 4989 f641 5541 89fd 4154 WI..AVI..AUA..AT
0x004005f5 4c8d 2504 0820 0055 488d second04 0820 0053 L.%.. .UH.-.. .S
0x00400605 4c29 e548 83ec 08e8 57fe ffff 48c1 fd03 L).H....W...H...
0x00400615 741f 31db 0f1f 8000 0000 004c 89fa 4c89 t.1........L..L.
0x00400625 f644 89ef 41ff 14dc 4883 c301 4839 dd75 .D..A...H...H9.u
0x00400635 ea48 83c4 085b 5d41 5c41 5d41 5e41 5fc3 .H...[]AA]A^A_.
0x00400645 9066 2e0f 1f84 0000 0000 00f3 0f1e fac3 .f..............
0x00400655 0000 00f3 0f1e fa48 83ec Zero848 83c4 08c3 .......H...H....
0x00400665 0000 Zero001 0002 0000 0000 0000 0000 0000 ................
0x00400675 0000 004e 756d 6265 7220 6e6f 7720 6973 ...Number now could be
0x00400685 2020 3a20 2564 0a00 0000 Zero001 1b03 3b44 : %d........;D
0x00400695 0000 0007 0000 0000 feff ff88 0000 0020 ...............
[0x004005a5]>
Disassembly
If you’re working with compiled binaries, there is no such thing as a supply code you’ll be able to view. The compiler interprets the supply code into machine language directions that the CPU can perceive and execute; the result’s the binary or executable. However, you’ll be able to view meeting directions (mnemonics) to make sense of what this system is doing. For instance, if you wish to see what the principle operate is doing, you’ll be able to search the handle of the principle operate utilizing s most important after which run the pdf command to view the disassembly directions.
To perceive the meeting directions, it’s worthwhile to consult with the structure handbook (x86 on this case), its software binary interface (its ABI, or calling conventions), and have a fundamental understanding of how the stack works:
[0x004004b0]> s most important
[0x004005a5]>
[0x004005a5]> s
0x4005a5
[0x004005a5]>
[0x004005a5]> pdf
; DATA XREF from entry0 @ 0x4004d1
┌ 55: int most important (int argc, char **argv, char **envp);
│ ; var int64_t var_8h @ rbp-0x8
│ ; var int64_t var_4h @ rbp-0x4
│ 0x004005a5 55 push rbp
│ 0x004005a6 4889e5 mov rbp, rsp
│ 0x004005a9 4883ec10 sub rsp, 0x10
│ 0x004005advert c745fc640000. mov dword [var_4h], 0x64 ; 'd' ; 100
│ 0x004005b4 8b45fc mov eax, dword [var_4h]
│ 0x004005b7 89c7 mov edi, eax
│ 0x004005b9 e8d8ffffff name sym.adder
│ 0x004005be 8945f8 mov dword [var_8h], eax
│ 0x004005c1 8b45f8 mov eax, dword [var_8h]
│ 0x004005c4 89c6 mov esi, eax
│ 0x004005c6 bf78064000 mov edi, str.Number_now_is__:__d ; 0x400678 ; "Number now is : %dn" ; const char *format
│ 0x004005cb b800000000 mov eax, Zero
│ 0x004005d0 e8cbfeffff name sym.imp.printf ; int printf(const char *format)
│ 0x004005d5 b800000000 mov eax, Zero
│ 0x004005da c9 depart
└ 0x004005db c3 ret
[0x004005a5]>
Here is the disassembly for the adder operate:
[0x004005a5]> s sym.adder
[0x00400596]>
[0x00400596]> s
0x400596
[0x00400596]>
[0x00400596]> pdf
; CALL XREF from most important @ 0x4005b9
┌ 15: sym.adder (int64_t arg1);
│ ; var int64_t var_4h @ rbp-0x4
│ ; arg int64_t arg1 @ rdi
│ 0x00400596 55 push rbp
│ 0x00400597 4889e5 mov rbp, rsp
│ 0x0040059a 897dfc mov dword [var_4h], edi ; arg1
│ 0x0040059d 8b45fc mov eax, dword [var_4h]
│ 0x004005a0 83c001 add eax, 1
│ 0x004005a3 5d pop rbp
└ 0x004005a4 c3 ret
[0x00400596]>
Strings
Seeing which strings are current inside the binary could be a start line to binary evaluation. Strings are hardcoded right into a binary and infrequently present essential hints to shift your focus to investigate sure areas. Run the iz command inside the binary to record all of the strings. The check binary has just one string hardcoded within the binary:
[0x004004b0]> iz
[Strings]
nth paddr vaddr len dimension part sort string
―――――――――――――――――――――――――――――――――――――――――――――――――――――――
Zero 0x00000678 0x00400678 20 21 .rodata ascii Number now could be : %dn[0x004004b0]>
Cross-reference strings
As with capabilities, you’ll be able to cross-reference strings to see the place they’re being printed from and perceive the code round them:
[0x004004b0]> ps @ 0x400678
Number now could be : %d[0x004004b0]>
[0x004004b0]> axt 0x400678
most important 0x4005c6 [DATA] mov edi, str.Number_now_is__:__d
[0x004004b0]>
Visual mode
When your code is sophisticated with a number of capabilities known as, it is simple to get misplaced. It might be useful to have a graphic or visible view of which capabilities are known as, which paths are taken based mostly on sure situations, and many others. You can discover r2’s visible mode through the use of the VV command after shifting to a operate of curiosity. For instance, for the adder operate:
[0x004004b0]> s sym.adder
[0x00400596]>
[0x00400596]> VV
Debugger
So far, you’ve gotten been doing static evaluation—you’re simply taking a look at issues within the binary with out working it. Sometimes it’s worthwhile to execute the binary and analyze numerous info in reminiscence at runtime. r2’s inside debugger permits you to run a binary, put in breakpoints, analyze variables’ values, or dump registers’ contents.
Start the debugger with the -d flag, and add the -A flag to do an evaluation because the binary hundreds. You can set breakpoints at numerous locations, like capabilities or reminiscence addresses, through the use of the db <function-name> command. To view current breakpoints, use the dbi command. Once you’ve gotten positioned your breakpoints, begin working the binary utilizing the dc command. You can view the stack utilizing the dbt command, which reveals operate calls. Finally, you’ll be able to dump the contents of the registers utilizing the drr command:
$ r2 -d -A ./adder
Process with PID 17453 began...
= connect 17453 17453
bin.baddr 0x00400000
Using 0x400000
asm.bits 64
[x] Analyze all flags beginning with sym. and entry0 (aa)
[x] Analyze operate calls (aac)
[x] Analyze len bytes of directions for references (aar)
[x] Check for vtables
[x] Type matching evaluation for all capabilities (aaft)
[x] Propagate noreturn info
[x] Use -AA or aaaa to carry out further experimental evaluation.
-- git checkout hamster
[0x7f77b0a28030]>
[0x7f77b0a28030]> db most important
[0x7f77b0a28030]>
[0x7f77b0a28030]> db sym.adder
[0x7f77b0a28030]>
[0x7f77b0a28030]> dbi
Zero 0x004005a5 E:1 T:Zero
1 0x00400596 E:1 T:Zero
[0x7f77b0a28030]>
[0x7f77b0a28030]> afl | grep most important
0x004005a5 1 55 most important
[0x7f77b0a28030]>
[0x7f77b0a28030]> afl | grep sym.adder
0x00400596 1 15 sym.adder
[0x7f77b0a28030]>
[0x7f77b0a28030]> dc
hit breakpoint at: 0x4005a5
[0x004005a5]>
[0x004005a5]> dbt
Zero 0x4005a5 sp: 0x0 Zero [most important] most important sym.adder+15
1 0x7f77b0687873 sp: 0x7ffe35ff6858 Zero [??] part..gnu.construct.attributes-1345820597
2 0x7f77b0a36e0a sp: 0x7ffe35ff68e8 144 [??] map.usr_lib64_ld_2.28.so.r_x+65034
[0x004005a5]> dc
hit breakpoint at: 0x400596
[0x00400596]> dbt
Zero 0x400596 sp: 0x0 Zero [sym.adder] rip entry.init0+6
1 0x4005be sp: 0x7ffe35ff6838 Zero [most important] most important+25
2 0x7f77b0687873 sp: 0x7ffe35ff6858 32 [??] part..gnu.construct.attributes-1345820597
three 0x7f77b0a36e0a sp: 0x7ffe35ff68e8 144 [??] map.usr_lib64_ld_2.28.so.r_x+65034
[0x00400596]>
[0x00400596]>
[0x00400596]> dr
rax = 0x00000064
rbx = 0x00000000
rcx = 0x7f77b0a21738
rdx = 0x7ffe35ff6948
r8 = 0x7f77b0a22da0
r9 = 0x7f77b0a22da0
r10 = 0x0000000f
r11 = 0x00000002
r12 = 0x004004b0
r13 = 0x7ffe35ff6930
r14 = 0x00000000
r15 = 0x00000000
rsi = 0x7ffe35ff6938
rdi = 0x00000064
rsp = 0x7ffe35ff6838
rbp = 0x7ffe35ff6850
rip = 0x00400596
rflags = 0x00000202
orax = 0xffffffffffffffff
[0x00400596]>
Decompiler
Being capable of perceive meeting is a prerequisite to binary evaluation. Assembly language is at all times tied to the structure the binary is constructed on and is meant to run on. There is rarely a 1:1 mapping between a line of supply code and meeting code. Often, a single line of C supply code produces a number of traces of meeting. So, studying meeting code line-by-line isn’t optimum.
This is the place decompilers are available. They attempt to reconstruct the attainable supply code based mostly on the meeting directions. This is NEVER precisely the identical because the supply code used to create the binary; it’s a shut illustration of the supply based mostly on meeting. Also, have in mind that compiler optimizations that generate totally different meeting code to hurry issues up, scale back the dimensions of a binary, and many others., will make the decompiler’s job tougher. Also, malware authors usually intentionally obfuscate code to place a malware analyst off.
Radare2 gives decompilers via plugins. You can set up any decompiler that’s supported by Radare2. View present plugins with the r2pm -l command. Install a pattern r2dec decompiler with the r2pm set up command:
$ r2pm -l
$
$ r2pm set up r2dec
Cloning into 'r2dec'...
distant: Enumerating objects: 100, executed.
distant: Counting objects: 100% (100/100), executed.
distant: Compressing objects: 100% (97/97), executed.
distant: Total 100 (delta 18), reused 27 (delta 1), pack-reused Zero
Receiving objects: 100% (100/100), 1.01 MiB | 1.31 MiB/s, executed.
Resolving deltas: 100% (18/18), executed.
Install Done For r2dec
gmake: Entering listing '/root/.native/share/radare2/r2pm/git/r2dec/p'
[CC] duktape/duktape.o
[CC] duktape/duk_console.o
[CC] core_pdd.o
[CC] core_pdd.so
gmake: Leaving listing '/root/.native/share/radare2/r2pm/git/r2dec/p'
$
$ r2pm -l
r2dec
$
Decompiler view
To decompile a binary, load the binary in r2 and auto-analyze it. Move to the operate of curiosity—adder on this instance—utilizing the s sym.adder command, then use the pdda command to view the meeting and decompiled supply code side-by-side. Reading this decompiled supply code is commonly simpler than studying meeting line-by-line:
$ r2 -A ./adder
[x] Analyze all flags beginning with sym. and entry0 (aa)
[x] Analyze operate calls (aac)
[x] Analyze len bytes of directions for references (aar)
[x] Check for vtables
[x] Type matching evaluation for all capabilities (aaft)
[x] Propagate noreturn info
[x] Use -AA or aaaa to carry out further experimental evaluation.
-- What do you wish to debug right now?
[0x004004b0]>
[0x004004b0]> s sym.adder
[0x00400596]>
[0x00400596]> s
0x400596
[0x00400596]>
[0x00400596]> pdda
; meeting | /* r2dec pseudo code output */
| /* ./adder @ 0x400596 */
| #embrace <stdint.h>
|
; (fcn) sym.adder () | int32_t adder (int64_t arg1)
0x00400597 mov rbp, rsp
[0x00400596]>
Configure settings
As you get extra snug with Radare2, you’ll want to change its configuration to tune it to how you’re employed. You can view r2’s default configurations utilizing the e command. To set a particular configuration, add config = worth after the e command:
[0x004005a5]> e | wc -l
593
[0x004005a5]> e | grep syntax
asm.syntax = intel
[0x004005a5]>
[0x004005a5]> e asm.syntax = att
[0x004005a5]>
[0x004005a5]> e | grep syntax
asm.syntax = att
[0x004005a5]>
To make the configuration adjustments everlasting, place them in a startup file named .radare2rc that r2 reads at startup. This file is normally discovered in your house listing; if not, you’ll be able to create one. Some pattern configuration choices embrace:
$ cat ~/.radare2rc
e asm.syntax = att
e scr.utf8 = true
eco solarized
e cmd.stack = true
e stack.dimension = 256
$
Explore extra
You’ve seen sufficient Radare2 options to search out your method across the instrument. Because Radare2 follows the Unix philosophy, although you are able to do numerous issues from its console, it makes use of a separate set of binaries beneath to do its duties.
Explore the standalone binaries listed under to see how they work. For instance, the binary info seen within the console with the iI command may also be discovered utilizing the rabin2 <binary> command:
$ cd bin/
$
$ ls
prefix r2agent r2pm rabin2 radiff2 ragg2 rarun2 rasm2
r2 r2-indent r2r radare2 rafind2 rahash2 rasign2 rax2
$
What do you consider Radare2? Share your suggestions within the feedback.
