Radare2 cheat Sheet | All radare2 commands that you might need in an easily organized way.

Command line options

Configuration properties

They can be used in evaluations:? ${asm.tabs}

e: Returns configuration properties
e <property>: Checks a specific property:
  e asm.tabs => false
e <property>=<value>: Change property value
  e asm.arch=ppc
e? help about a configuration property
  e? cmd.stack

You will want to set your favourite options in ~/.radare2rc since every line there will be interpreted at the beginning of each session. Mine for reference:

# Show comments at right of disassembly if they fit in screen
e asm.cmtright=true

# Shows pseudocode in disassembly. Eg mov eax, str.ok = > eax = str.ok
e asm.pseudo = true

# Solarized theme
eco solarized

# Use UTF-8 to show cool arrows that do not look like crap :)
e scr.utf8 = true

There is an easier interface accessible from the Visual mode, just typing Ve

Basic Commands

Command syntax: [.][times][cmd][~grep][@[@iter]addr!size][|>pipe]

  pi~mov,eax        ; lines with mov or eax
  pi~mov&eax        ; lines with mov and eax
  pi~mov,eax:6        ; 6 first lines with mov or eax
  pd 20~call[0]:0       ; grep first column of the first row matching 'call'

• .cmd Interprets command output

is* prints symbols
.is* interprets output and define the symbols in radare (normally they are already loaded if r2 was not invoked with -n)

[0x00000000]> ? 33 +2
35 0x23 043 0000:0023 35 00100011 35.0 0.000000

Note: | and & need to be escaped

?v 0x1625d4ca ^ 0x72ca4247 = 0x64ef968d
?v 0x4141414a - 0x41414140  = 0xa

wx ff @@10 20 30      Writes ff at offsets 10, 20 and 30
wx ff @@`?s  1 10 2`  Writes ff at offsets 1, 2 and 3
wx 90 @@ sym.*        Writes a nop on every symbol

Positioning

Block size

The block size is the default view size for radare. All commands will work with this constraint, but you can always temporally change the block size just giving a numeric argument to the print commands for example (px 20)

JSON Output

Most of commands such as (i)nfo and (p)rint commands accept a j to print their output in json

[0x100000d78]> ij
{"bin":{"type":"mach0","class":"MACH064","endian":"little","machine":"x86 64 all","arch":"x86","os":"osx","lang":"c","pic":true,"canary":false,"nx":false,"crypto":false,"va":true,"bits":64,"stripped":true,"static":false,"linenums":false,"syms":false,"relocs":false},"core":{"type":"Executable file","os":"osx","arch":"x86 64 all","bits":64,"endian":"little","file":"/bin/ls","fd":6,"size":34640,"mode":"r--","block":256,"uri":"/bin/ls","format":"mach064"}}

Analyze

Function analysis (normal mode)

Function analysis (visual mode)

Opcode analysis

Information

Mitigations

Get function address in GOT table: pd 1 @ sym.imp<funct> Returns a jmp [addr] where addr is the address of function in the GOT. Similar to objdump -R | grep <func>

Print

pcp 0x20@0x8048550
import struct
buf = struct.pack ("32B",
0x55,0x89,0xe5,0x83,0xzz,0xzz,0xzz,0xzz,0xf0,0x00,0x00,
0x00,0x00,0xc7,0x45,0xf4,0x00,0x00,0x00,0x00,0xeb,0x20,
0xc7,0x44,0x24,0x04,0x01,0x00,0x00,0x00,0xzz,0xzz)

Write

  wow 11223344 @102!10
    write looped value from 102 to 102+10
    0x00000066  1122 3344 1122 3344 1122 0000 0000 0000
  wox 0x90
    XOR the current block with 0x90. Equivalent to wox 0x90 $$!$b (write from current position, a whole block)
  wox 67 @4!10
    XOR from offset 4 to 10 with value 67

Flags

Flags are labels for offsets. They can be grouped in namespaces as sym for symbols …

yank & paste

Visual Mode

V enters visual mode

    hex, the hexadecimal view
    disasm, the disassembly listing
    Use numbers in [] to follow jump
    Use "u" to go back
    debug, the debugger
    words, the word-hexidecimal view
    buf, the C-formatted buffer
    annotated, the annotated hexdump.

HUD

ROP

Search depth can be configure with following properties:

e search.roplen = 4  (change the depth of the search, to speed-up the hunt)

Searching

Example: Searching function preludes:

push ebp
mov ebp, esp

Opcodes: 5589e5

/x 5589e5
  [# ]hits: 54c0f4 < 0x0804c600  hits = 1
  0x08049f70 hit0_0 5589e557565383e4f081ec
  0x0804c31a hit0_1 5589e583ec18c704246031
  0x0804c353 hit0_2 5589e583ec1889442404c7
  0x0804c379 hit0_3 5589e583ec08e87cffffff
  0x0804c3a2 hit0_4 5589e583ec18c70424302d

pi 5 @@hit* (Print 5 first instructions of every hit)

Its possible to run a command for each hit. Use the cmd.hit property:

e cmd.hit=px

Comments and defines

We can define structures to be shown in the disassembly

Magic files

  [0x00000000]> pm
  0x00000000 1 ELF 32-bit LSB executable, Intel 80386, version 1

Search for magic numbers

Search can be controlled with following properties

search.align
search.from (0 = beginning)
search.to (0 = end)
search.asmstr
search.in

Yara

Yara can also be used for detecting file signatures to determine compiler types, shellcodes, protections and more.

:yara scan

Zignatures

Zignatures are useful when dealing with stripped binaries. We can take a non-stripped binary, run zignatures on it and apply it to a different binary that was compiled statically with the same libraries.

Zignatures are applied as comments

r2-(pid2)> pd 35 @ 0x08049adb-10
|          0x08049adb   call fcn.0805b030
|             fcn.0805b030(unk, unk, unk, unk) ; sign.sign.b.sym.fmt.Println
|          0x08049ae0   add esp, 0xc
|          0x08049ae3   call fcn.08095580

Compare files

Graphs

Basic block graphs

Call graphs

Convert .dot in .png

$ dot -Tpng -o /tmp/b.png b.dot

Generate graph for file:

$ radiff2 -g main crackme.bin crackme.bin > /tmp/a
$ xdot /tmp/a

Debugger

Start r2 in debugger mode. r2 will fork and attach

$ r2 -d [pid|cmd|ptrace] (if command contains spaces use quotes: r2 -d "ls /")

$ ptrace://pid (debug backend does not notice, only access to mapped memory)

To pass arguments

$ r2 -d rarun2 program=pwn1 arg1=$(python exploit.py)

To pass stdin

$ r2 -d rarun2 program=/bin/ls stdin=$(python exploit.py)

Commands

  [0xb776c110]> dm
  sys 0x08048000 - 0x08062000 s r-x /usr/bin/ls
  sys 0x08062000 - 0x08064000 s rw- /usr/bin/ls
  sys 0xb776a000 - 0xb776b000 s r-x [vdso]
  sys 0xb776b000 * 0xb778b000 s r-x /usr/lib/ld-2.17.so
  sys 0xb778b000 - 0xb778d000 s rw- /usr/lib/ld-2.17.so
  sys 0xbfe5d000 - 0xbfe7e000 s rw- [stack]

To follow child processes in forks (set-follow-fork-mode in gdb)

dcf until a fork happen
then use dp to select what process you want to debug.

PEDA like details: drr;pd [email protected];pxr [email protected]

Debug in visual mode

toggl breakpoints with F2
single-step with F7 (s)
step-over with F8 (S)
continue with F9

WebGUI (Enyo)

=h: Start the server
=H: Start server and browser

Radare2 suite commands

All suite commands include a -r flag to generate instructions for r2

rax2 – Base conversion

rahash2 – Entropy, hashes and checksums

radiff2 – File diffing

Examples

Diff original and patched on x86_32, using graphdiff algorithm
$ radiff2 -a x86 -b32 -C original patched
Show differences between original and patched on x86_32
$ radiff2 -a x86 -b32 original patched :

rasm2 – Assembly/Disassembly

rafind2 – Search

ragg2 – Shellcode generator, C/opcode compiler

Example

Generate a x86, 32 bits exec shellcode
$ ragg2 -a x86 -b 32 -i exec

rabin2 – Executable analysis: symbols, imports, strings …

rarun2 – Launcher to run programs with different environments, args, stdin, permissions, fds

Examples:

$ r2 -b 32 -d rarun2 program=pwn1 arg1=$(ragg2 -P 300 -r)
runs pwn1 with a De Bruijn Pattern as first argument, inside radare2's debugger, and force 32 bits
$ r2 -d rarun2 program=/bin/ls stdin=$(python exploit.py)
runs /bin/ls with the output of exploit.py directed to stdin

source