After some googling and testing, I have compiled a list of commands that enabled me to look deeply into the code and get useful information. I intend to update this list while I\u2019m learning new commands.<\/p>\n\n\n\n
r2 -Ad .\/crackme0x01\n<\/strong>Opens r2 in debug mode with the Analyze all<\/em> flag active\nNote: If I hadn't passed A<\/em> flag, aa <\/em>would be the first command to execute after running Radare<\/pre>\n\n\n\nFirst of all, let me state that it\u2019s always possible to use ? to list all commands available as well as use it at the end of every command to get more information about it.<\/p>\n\n\n\n
?\n<\/strong>Used alone, lists all the commands available\nUsed at the end of a command, shows a brief description about it (eg. afl?)<\/pre>\n\n\n\nSo, to start exploring an executable is always good idea list all the present functions, using afll. One can also use just afl which is not as verbose as afll.<\/p>\n\n\n\n
afll<\/strong>\nLists all functions and their location in memory<\/pre>\n\n\n\nIt\u2019s possible to use afvd for variables.<\/p>\n\n\n\n
afvd<\/strong>\nShows the content of all local\/args variables<\/pre>\n\n\n\nWhen the time to set breakpoints come, one can use db command.<\/p>\n\n\n\n
db 0x12345678<\/strong>\nSets a breakpoint at address 0x12345678. It's possible to set more than one breakpoint<\/pre>\n\n\n\nTo run the executable and stop at a breakpoint, I can use dc.<\/p>\n\n\n\n
dc<\/strong>\nRuns the program until it hits a breakpoint<\/pre>\n\n\n\nIf the program is stopped at a breakpoint I can use dr to display the registers.<\/p>\n\n\n\n
dr<\/strong>\nShows the content of all registers. Use dr <register> for a specific register<\/pre>\n\n\n\nYou can also use the \u201ctelescoping\u201d method.<\/p>\n\n\n\n
drr\n<\/strong>Shows the content of all registers and the registers references.<\/pre>\n\n\n\nTo execute a single instruction, use ds.<\/p>\n\n\n\n
ds<\/strong>\nSteps a single instruction<\/pre>\n\n\n\nIf I was looking for the \u201clow hanging fruit\u201d iz would be a good command to start.<\/p>\n\n\n\n
iz<\/strong>\nShows the strings present in the data section\nOne can use izz to see the strings for the entire binary<\/pre>\n\n\n\nTo explore the code of the function that I sought to, I can use pdf which will display the code of that function. You can also use pdf @ sym.main (which means something like \u201cshow me the main function without seek to it\u201d) .<\/p>\n\n\n\n
pdf\n<\/strong>\"Print Disassembling Function\"<\/pre>\n\n\n\nIt\u2019s also possible to print the content of a memory cell with pf.<\/p>\n\n\n\n
pf<\/strong>\nPrints formatted data. Use pf?? to see available formats and pf??? for examples<\/pre>\n\n\n\nTo see raw data from some memory address, use px.<\/p>\n\n\n\n
px 3 @0x08080808\n<\/strong>Prints hexadecimal dump (3 bytes) from 0x08080808 address.<\/pre>\n\n\n\nNow that the location of all functions is known, I can seek to one of those functions with the s command. It\u2019s always a very good habit to type ? after a command to see all the options available.<\/p>\n\n\n\n
s sym.main\n<\/strong>Seeks to function sym.main. Address in prompt will change<\/pre>\n\n\n\nTo edit the program an write instructions, use wa.<\/p>\n\n\n\n
wa nop @ 0x08080808<\/strong>\nWrites a nop instruction at 0x08080808 address.\nNote: The program must be started with w flag<\/pre>\n\n\n\nInstead of instructions, it\u2019s possible to write opcodes.<\/p>\n\n\n\n
wx 90 @ 0x08080808<\/strong>\nWrites the opcode 90 (nop) at 0x08080808 address.<\/pre>\n\n\n\nThe ? command is an interesting feature, I must confess. Apart of all the use described above, one can use it also to convert a value to another base.<\/p>\n\n\n\n
? 0x10<\/strong>\nConverts the number 0x10 to the most common bases<\/pre>\n\n\n\nWith all the previous commands we can perform some basic debugging. Somewhere in time I\u2019ll write a similar post with an introduction for the Visual mode that I ended up discovering. In that mode, one can do all the tasks described previously with much less pain.<\/p>\n","protected":false},"excerpt":{"rendered":"
After some googling and testing, I have compiled a list of commands that enabled me to look deeply into the code and get useful information.…<\/p>\n