22.8 forum: Introduction to radare

radare is not a single binary. It is, in fact a set of programs related to the reverse engineering world. That is, a framework.

Here's the list of programs that the current version of radare installs in your system (0.9.4):

- gradare gtk+vte interface for radare

- radare commandline hexadecimal editor with pluggable interface

- rahash multiple algorithm block-based checksumming utility

- rasm commandline multi-architecture/endian patch assembler

- rabin gets entrypoint, exports, imports, symbols of ELF/PE/Class/..

- xrefs bruteforces data space finding possible xrefs

- rsc shell interface to a set of scripts and utilities

- bdiff erg0t's implementation of the generic binary diff in C++

Some other tools are also installed but will be probably deprecated in the future by using internal radare commands:

- javasm commandline raw java assembler and disassembler

- armasm very basic arm assembler

Maybe you'll feel a bit confused about the usage of the programs, but don't be afraid, and let's start configuring radare editing the ".radarerc" file in our home.

$ echo "eval scr.color = true"     >  ~/.radarerc
$ echo "eval file.identify = true" >> ~/.radarerc

The 'eval' command is the standard interface to configure radare, if we type it in the radare shell we will get a list of key-value pairs of the configuration variables. If you want to list all the flags of a certain domain just end it with a dot '.': Code:

 [0x00000000]> eval cfg.
 cfg.noscript = false
 cfg.encoding = ascii
 cfg.delta = 1024
 cfg.verbose = true
 cfg.endian = false
 cfg.write = false
 cfg.limit = 0
 cfg.rdbdir = TODO
 cfg.datefmt = %d:%m:%Y %H:%M:%S %z
 cfg.count = 0
 cfg.fortunes = true
 cfg.bsize = 512

We can also use pipes in the shell of radare like a plain unix shell: Code:

 [0x00000000]> eval  | grep trace
 asm.trace = false
 file.trace = trace.log
 trace.bt = false
 trace.sleep = 0
 trace.smart = true
 trace.log = true
 trace.dup = false
 trace.cmtregs = false

The radare shell accepts commands in the following format: Code:

 <;> [:] [command] [arg] [@ offset] [| shell-command] [` radare-command]
  |   |     |        |        |             |               |
  |   |     x        x        |             |               |
  |   |                   temporal    pipe output to        |
  |   ` drop verbosity     offset      shell command        |
  |                                                         |
  `- comment                   append output of command ----'

You can also use '>' and '>>' at the end of the command to dump the output to a file.

Here's a basic table of most common operations in radare Code:

Seek     s    > s 0x33
BlockSz  b    > b 0x400
Print    p    > px 20 @ 0x200
Write    w    > wx 90 90 90 @ +2
Search   /    > / lib
Hash     #    > #md5 20 @ esp
Shell    !!   > !!cat /proc/$DPID/maps
Quit     q    > quit

radare only is able to manage "block size" bytes at a time, so, if you want to print data, analyze code, print graphs you will have to setup a high value here to avoid invalid results with broken code blocks.

I don't want to explain everything in detail. Most of commands accept a '?' appended to the 'char' command to give you a help usage. it's mostly self-documented, but there are lot of hidden magic features wink

The most used print modes are: Code:

Hex      px  - hexadecimal
Disasm   pD  - disasm using asm.arch
Octal    po  - octal base
Analyze  pA  - analyzes memory
String0  pz  - zero terminated string
WideStr  pZ  - zero terminated wide string
C array  pc  - outputs C code
Graph    pG  - only when compiled with vala/gtk/cairo

To change the disassembly architecture use the following command:

 [0x0000000]> eval asm.arch = arm

Supported values are: arm, arm16, intel, intel16, intel64, powerpc, java

Let's test all together: Code:

 $ radare -e file.id=true /bin/ls
 open ro /bin/ls
 [0x08049790]> f
 000 0x00001790 512 entrypoint
 [0x08049790]> pD 20
    0x08049790    895e         ebp ^= ebp
    0x08049792    83           pop esi
    0x08049793    e483         ecx = esp
    0x08049795    50f0e4       esp &= 0xf0  ; 240 ' '
    0x08049798    68           push eax
    0x08049799    d0           push esp
    0x0804979A    7b           push edx
    0x0804979B    057bd06800   push dword 0x8057bd0
    0x080497A0    057c206800   push dword 0x8057c20

Wow, maybe you'll be surpressed for this pseudo-asm syntax. You can change it with the asm.syntax variable. Use 'intel', 'att' or 'pseudo'. The last one is the default for readibility reasons. Feel free to setup your favorite one in ~/.radarerc wink

As we see in the previous shell snippet when setupping 'file.id' to true, radare calls rabin internally to determine which kind of file has been opened and automatically setups the base address, flags the entrypoint and jumps there.

The cfg.baddr is the variable which defines the virtual base address. This is good for mapping on-disk and debugged process information and be able to easily apply patches to files.

As a final note, you can use the 'P' command to open and save project files to dump/load all your flags, comments, code atributes, .. from/to disk (also handled by the -P commandline flag). Code:

 $ radare -P /bin/ls
 Using project file: '/tmp/ls.project'
 open ro /bin/ls
 [0x00000000]> q
 Do you want to save the '/tmp/ls.project' project? (Y/n)
 Project '/tmp/ls.project' saved.
 $

That's all for a basic introduction wink simple huh?

Have fun!