Radare2 - Reverse Engineering Framework¶

generieren

Radare2 steht als eines der leistungsfähigsten und vielseitigsten Open-Source-Reverse-Engineering-Frameworks, die heute verfügbar sind, und stellt einen kompletten Paradigmenwechsel dar, wie Sicherheitsforscher, Malware-Analysten und Softwareentwickler eine binäre Analyse angehen. Im Gegensatz zu herkömmlichen GUI-basierten Disassemblern umfasst Radare2 eine Kommandozeilen-Interface-Philosophie, die Automatisierung, Skriptfähigkeit und tiefe Anpassungsfähigkeiten priorisiert. Dieser umfassende Rahmen bietet eine umfangreiche Palette von Werkzeugen für die Demontage, Debugging, binäre Analyse, Forensik und Ausbeutung Entwicklung, alle unter einer konsequenten und leistungsstarken Kommandostruktur vereint. Was Radare2 besonders überzeugend macht, ist seine modulare Architektur, die es Anwendern ermöglicht, verschiedene Analysetechniken nahtlos zu kombinieren, von statischer Demontage und dynamischem Debugging bis hin zur binären Diffing und Exploit-Entwicklung. Das Engagement des Frameworks für Open-Source-Prinzipien, kombiniert mit seinem umfangreichen Plugin-Ökosystem und der aktiven Community-Entwicklung, hat es als ein wesentliches Werkzeug für Sicherheitsexperten etabliert, die sowohl Tiefe als auch Flexibilität in ihren Analyse-Workflows benötigen.

Installation und Inbetriebnahme¶

Cross-Platform Installation¶

```bash

Ubuntu/Debian Installation¶

sudo apt update sudo apt install radare2

Alternative: Install latest version from source¶

git clone https://github.com/radareorg/radare2 cd radare2 sys/install.sh

macOS Installation via Homebrew¶

brew install radare2

Windows Installation¶

Download from https://github.com/radareorg/radare2/releases ¶

Or use package managers:¶

Chocolatey: choco install radare2¶

Scoop: scoop install radare2¶

Arch Linux Installation¶

sudo pacman -S radare2

CentOS/RHEL/Fedora Installation¶

sudo dnf install radare2

or¶

sudo yum install radare2

Build from Source (Latest Features)¶

git clone https://github.com/radareorg/radare2 cd radare2 ./configure --prefix=/usr/local make -j$(nproc) sudo make install

Verify Installation¶

r2 -v radare2 -v

Update Radare2¶

r2pm update r2pm upgrade

Install Additional Packages¶

r2pm -i r2dec # Decompiler plugin r2pm -i r2ghidra # Ghidra decompiler integration r2pm -i r2frida # Frida integration r2pm -i r2pipe # Programming language bindings ```_

Konfiguration und Umwelt-Setup¶

```bash

Radare2 Configuration Directory¶

Linux/macOS: ~/.config/radare2/¶

# Windows: %APPDATA%\radare2\

Main Configuration File¶

~/.config/radare2/radare2rc

Basic Configuration Options¶

echo 'e scr.color=3' >> ~/.config/radare2/radare2rc # Enable colors echo 'e asm.syntax=intel' >> ~/.config/radare2/radare2rc # Intel syntax echo 'e asm.describe=true' >> ~/.config/radare2/radare2rc # Show descriptions echo 'e bin.strings=true' >> ~/.config/radare2/radare2rc # Auto-detect strings

Environment Variables¶

export R2_NOPLUGINS=0 # Enable plugins export R2_DEBUG=0 # Disable debug output export R2_MAGICPATH=/usr/share/radare2/magic

Plugin Management¶

r2pm init # Initialize package manager r2pm update # Update package database r2pm list # List available packages r2pm search keyword # Search for packages r2pm install package_name # Install package r2pm uninstall package_name # Remove package

Essential Plugins¶

r2pm -i r2dec # Decompiler r2pm -i r2ghidra-dec # Ghidra decompiler r2pm -i r2pipe-py # Python bindings r2pm -i r2pipe-js # JavaScript bindings r2pm -i r2frida # Dynamic instrumentation r2pm -i r2yara # YARA integration

Custom Plugin Directory¶

mkdir -p ~/.config/radare2/plugins export R2_USER_PLUGINS=~/.config/radare2/plugins ```_

Basic Radar2 Verwendung¶

Belastung und Erstanalyse¶

```bash

Basic File Loading¶

r2 /path/to/binary # Load binary for analysis r2 -A /path/to/binary # Load with automatic analysis r2 -AA /path/to/binary # Load with extended analysis r2 -AAA /path/to/binary # Load with experimental analysis

Loading Options¶

r2 -d /path/to/binary # Load in debug mode r2 -w /path/to/binary # Load in write mode r2 -n /path/to/binary # Load without parsing headers r2 -B 0x1000 /path/to/binary # Set base address

Remote Analysis¶

r2 - # Read from stdin r2 http://example.com/file # Load from URL r2 rap://host:port/file # Remote access protocol

Multiple File Analysis¶

r2 -m 0x400000 file1 file2 # Load multiple files

Project Management¶

Ps project_name # Save current session as project Po project_name # Open existing project Pd project_name # Delete project Pl # List projects

Session Management¶

. script.r2 # Execute r2 script q # Quit radare2 q! # Force quit without saving ```_

```bash

s address # Seek to address s+10 # Seek forward 10 bytes s-10 # Seek backward 10 bytes s++ # Seek to next function s-- # Seek to previous function

Address Formats¶

s 0x401000 # Hexadecimal address s main # Symbol name s entry0 # Entry point s +100 # Relative offset

Information Commands¶

i # File information ii # Imports iE # Exports iz # Strings iS # Sections ih # Headers ic # Classes (for OOP binaries)

Binary Information¶

ib # Basic file info iI # Binary info iH # Headers iM # Main function ie # Entry points ir # Relocations

Architecture Information¶

iA # Architecture info e asm.arch # Current architecture e asm.bits # Current bit mode e asm.cpu # CPU type

Memory Layout¶

dm # Memory maps dmi # Memory map info dmh # Heap info dms # Stack info ```_

Demontage und Codeanalyse¶

```bash

Basic Disassembly¶

pd # Print disassembly pd 10 # Print 10 instructions pd @main # Print disassembly at main pD 100 # Print 100 bytes as disassembly

Disassembly Modes¶

pda # Print disassembly with addresses pdb # Print disassembly with bytes pdc # Print disassembly with comments pdi # Print disassembly with inline comments pdj # Print disassembly as JSON

Function Analysis¶

afl # List all functions afi # Function information afn new_name # Rename function afc # Function calling convention afv # Function variables afa # Function arguments

Code Analysis¶

aa # Analyze all aaa # Analyze all (experimental) aab # Analyze basic blocks aac # Analyze function calls aad # Analyze data references aan # Analyze function names

Cross-References¶

axt # Cross-references to axf # Cross-references from ax # List all cross-references axg # Cross-reference graph

Control Flow Analysis¶

agf # Function call graph agc # Function call graph (compact) agg # Global call graph VV # Visual graph mode ```_

Erweiterte Analysefunktionen¶

Funktionsanalyse und Manipulation¶

```bash

Function Creation and Management¶

af # Analyze function at current address af @address # Analyze function at specific address af- @address # Delete function at address afr new_name @address # Rename function

Function Signatures¶

afs signature # Set function signature afs int main(int argc, char **argv) # Example signature afts # Show function signature

Function Variables and Arguments¶

afv # List function variables afvn old_name new_name # Rename variable afvt var_name type # Set variable type afva addr name type # Add function argument

Function Calling Conventions¶

afc # Show calling convention afc cdecl # Set calling convention afc stdcall # Windows standard call afc fastcall # Fast calling convention

Function Analysis Options¶

e anal.calls=true # Analyze function calls e anal.jmp.tbl=true # Analyze jump tables e anal.pushret=true # Analyze push/ret sequences e anal.hasnext=true # Analyze function continuations

Advanced Function Analysis¶

aab # Analyze basic blocks aae # Analyze ESIL expressions aai # Analyze imports aar # Analyze references aas # Analyze symbols aat # Analyze types

Function Diffing¶

cc # Compare functions ccc # Compare code ccf # Compare functions ```_

Datenanalyse und Strukturen¶

```bash

Data Type Analysis¶

t # List types t- # Remove type tk # List type kinds tl # List type links

Structure Definition¶

ts struct_name # Define structure ts- struct_name # Remove structure ts struct_name field_type field_name # Add field to structure

Example Structure Definition¶

ts Person ts Person int age ts Person char name[32] ts Person float height

Apply Structure to Data¶

tss struct_name @address # Apply structure at address Ct struct_name @address # Cast to structure type

Array Analysis¶

ta array_name type size # Define array type ta int_array int 10 # Array of 10 integers

Enum Definition¶

te enum_name # Define enumeration te Colors RED=1 GREEN=2 BLUE=3

String Analysis¶

iz # List strings izz # List all strings (including data) izzz # Deep string search iz~keyword # Filter strings by keyword

String Operations¶

ps @address # Print string at address psz @address # Print zero-terminated string psu @address # Print UTF-16 string psw @address # Print wide string

Data Visualization¶

px 100 # Print 100 bytes as hex pxw 20 # Print as 32-bit words pxq 10 # Print as 64-bit words pf format @address # Print formatted data ```_

Speicher und binäre Analyse¶

```bash

Memory Operations¶

dm # List memory maps dmi # Memory map information dmm # Memory map with permissions dmp # Memory protection

Memory Search¶

/ pattern # Search for pattern /x 41424344 # Search for hex bytes /i pattern # Case-insensitive search // pattern # Repeat last search

Advanced Search¶

/R # Search for ROP gadgets /a # Search for AES keys /c # Search for crypto constants /r # Search for references

Binary Operations¶

p8 100 # Print 100 bytes as raw pb 100 # Print 100 bytes as binary pc 100 # Print 100 bytes as C array pj 100 # Print 100 bytes as JSON

Binary Modification¶

w hello # Write string wx 41424344 # Write hex bytes wa "mov eax, 1" # Write assembly wf file.bin # Write file contents

Binary Comparison¶

c # Compare cc # Compare code cd # Compare data cg # Compare graphs

Entropy Analysis¶

p=e 1000 # Show entropy graph phe # Print entropy histogram ```_

Debugging und dynamische Analyse¶

Operationen im Debug-Modus¶

```bash

Starting Debug Session¶

r2 -d /path/to/binary # Load in debug mode r2 -d -A /path/to/binary # Load with analysis in debug mode

Process Attachment¶

r2 -d pid://1234 # Attach to process ID r2 -d gdb://localhost:1234 # Connect to GDB server

Debug Information¶

dp # List processes dpt # List threads dpr # Show registers drr # Show register references

Execution Control¶

dc # Continue execution ds # Step one instruction dso # Step over dsu address # Step until address dt # Trace execution

Breakpoints¶

db address # Set breakpoint db- address # Remove breakpoint dbc address # Set conditional breakpoint dbt # Backtrace dbl # List breakpoints

Memory Breakpoints¶

dbh address # Hardware breakpoint dbw address # Write breakpoint dbr address # Read breakpoint

Watchpoints¶

dw address # Set watchpoint dw- address # Remove watchpoint dwl # List watchpoints

Register Manipulation¶

dr # Show all registers dr eax # Show specific register dr eax=0x1234 # Set register value drt # Show register types ```_

Erweiterte Debugging-Funktionen¶

```bash

Memory Analysis During Debug¶

dm # Memory maps dmi # Memory info dmh # Heap analysis dms # Stack analysis

Dynamic Memory Operations¶

dma address size # Allocate memory dmf # Free memory dmd address # Dump memory

Tracing and Logging¶

dt # Trace execution dtl # Trace with logging dts # Trace syscalls dte # Trace events

Advanced Tracing¶

e dbg.trace=true # Enable tracing e dbg.trace.tag=1 # Tag traced instructions dtt # Trace to file

Signal Handling¶

dk # Send signal dk 9 # Send SIGKILL dko # Signal handling options

Process Information¶

dpl # List loaded libraries dpj # Process info as JSON dpp # Process permissions

Remote Debugging¶

r2 -d rap://host:port # Remote debugging =!rarun2 # Use rarun2 for debugging ```_

ESIL (Evaluable Strings Intermediate Language)¶

```bash

ESIL Introduction¶

ESIL is Radare2's intermediate language for emulation¶

Allows platform-independent analysis and emulation¶

ESIL Operations¶

aei # Initialize ESIL VM aeim # Initialize ESIL memory aeip # Initialize ESIL stack

ESIL Execution¶

aes # Step one ESIL instruction aeso # Step over ESIL instruction aesu address # Step until address aec # Continue ESIL execution

ESIL State¶

aer # Show ESIL registers aer reg=value # Set ESIL register aets # Show ESIL stack aem # Show ESIL memory

ESIL Analysis¶

aea # Analyze with ESIL aef # Analyze function with ESIL aeg # Generate ESIL graph

ESIL Emulation¶

e asm.emu=true # Enable emulation e emu.str=true # Emulate string operations e emu.write=true # Enable write emulation

ESIL Debugging¶

aed # Debug ESIL aedc # Continue ESIL debugging aeds # Step ESIL debugging ```_

Skript und Automatisierung¶

R2Pipe Programmierschnittstelle¶

```python

Python R2Pipe Example¶

import r2pipe

Open binary¶

r2 = r2pipe.open("/path/to/binary")

Execute commands¶

info = r2.cmd("i") functions = r2.cmdj("aflj") # JSON output disasm = r2.cmd("pd 10")

Analysis automation¶

r2.cmd("aaa") # Analyze all strings = r2.cmdj("izj") # Get strings as JSON

Function analysis¶

for func in functions: print(f"Function: \\{func['name']\\} at \\{hex(func['offset'])\\}")

Search operations¶

xrefs = r2.cmdj("axtj @main") # Cross-references to main

Close session¶

r2.quit() ```_

R2 Scripting Language¶

```bash

R2 Script Basics (.r2 files)¶

Comments start with¶

Commands are executed sequentially¶

Example analysis script¶

!/usr/bin/env r2 -i¶

Auto-analysis script¶

Load and analyze¶

aaa

Find interesting functions¶

afl~main afl~crypto afl~password

Search for strings¶

iz~password iz~key iz~secret

Generate function graph¶

agf @main > main_graph.dot

Export analysis¶

Ps analysis_project ```_

Erweiterte Skripttechniken¶

```bash

Conditional Execution¶

?e "Starting analysis" ? eax==0x1234; ?e "EAX is 0x1234"

Loops and Iteration¶

Iterate through functions¶

afl~[0]|while read addr; do echo "Analyzing function at $addr" s $addr pdf done

Macros¶

(macro_name arg1 arg2; command1; command2) (analyze_func addr; s $addr; af; pdf)

Variables¶

$var=value ?e $var

Environment Variables¶

e var.name=value ?e $var.name

Function Hooks¶

e cmd.hit=px 32 # Execute on breakpoint hit e cmd.load=aaa # Execute on file load

Custom Commands¶

"(custom_cmd arg; echo Custom command with $arg)" ```_

Plugin-Entwicklung¶

```c // Basic R2 Plugin Structure (C)

include ¶

static int r2_cmd_example(void *user, const char *input) \\{ RCore *core = (RCore *)user;

switch (*input) \\\\{
    case '?':
        r_cons_printf("Usage: example [args]\n");
        break;
    case ' ':
        // Handle arguments
        r_cons_printf("Example command executed\n");
        break;
    default:
        r_cons_printf("Unknown command\n");
        break;
\\\\}

return true;

\\}

RCorePlugin r_core_plugin_example = \\{ .name = "example", .desc = "Example plugin", .license = "MIT", .call = r2_cmd_example, \\};

ifndef CORELIB¶

RLibStruct radare_plugin = \\{ .type = R_LIB_TYPE_CORE, .data = &r_core_plugin_example, .version = R2_VERSION \\};

endif¶

```_

Malware-Analyse mit Radare2¶

Strategische Malware-Analyse¶

```bash

Initial Triage¶

i # Basic file information iI # Detailed binary info ih # File headers iS # Sections analysis ie # Entry points

Packer Detection¶

rabin2 -I /path/to/binary # Binary information rabin2 -S /path/to/binary # Sections rabin2 -z /path/to/binary # Strings

Entropy Analysis¶

p=e 1000 # Entropy visualization rahash2 -a entropy file # Calculate entropy

Import/Export Analysis¶

ii # Imports iE # Exports ir # Relocations

String Analysis¶

iz # Strings in data sections izz # All strings izzz # Deep string search iz~http # Filter HTTP-related strings iz~password # Filter password-related strings

Cryptographic Constants¶

/x 67452301 # MD5 constants /x 01234567 # SHA constants /x 61707865 # "apxe" (expand 32-byte k)

Suspicious API Detection¶

ii~CreateFile ii~WriteFile ii~RegOpenKey ii~socket ii~connect ```_

Dynamische Malware-Analyse¶

```bash

Safe Analysis Environment Setup¶

Use isolated VM with network monitoring¶

Snapshot VM before analysis¶

Debug Mode Analysis¶

r2 -d /path/to/malware # Load in debug mode aaa # Analyze all

API Monitoring¶

dcs # Syscall tracing dt # Trace execution dtl # Trace with logging

Breakpoint Strategy¶

db sym.CreateFileA # Break on file creation db sym.RegOpenKeyA # Break on registry access db sym.socket # Break on network activity

Memory Analysis¶

dm # Memory maps dmi # Memory info dmh # Heap analysis

Network Behavior¶

Monitor with external tools while debugging¶

Wireshark, netstat, etc.¶

Unpacking Analysis¶

Set breakpoint at entry point¶

db entry0 dc # Continue to entry

Step through unpacking routine¶

ds # Step instruction

Look for jumps to unpacked code¶

Dump unpacked code when found¶

```_

Erweiterte Malware-Techniken¶

```bash

Anti-Analysis Detection¶

Look for anti-debugging checks¶

/x 64A118000000 # PEB access (Windows) /x 0F31 # RDTSC instruction ii~IsDebuggerPresent # Debugger detection API

Obfuscation Analysis¶

Control flow obfuscation¶

agf # Function graph VV # Visual graph mode

String Obfuscation¶

Look for string decryption routines¶

afl~decrypt afl~decode afl~xor

Code Injection Detection¶

ii~VirtualAlloc ii~VirtualProtect ii~WriteProcessMemory ii~CreateRemoteThread

Persistence Mechanisms¶

iz~Run # Registry run keys iz~Service # Windows services iz~Task # Scheduled tasks

Communication Analysis¶

iz~http iz~tcp iz~udp ii~socket ii~connect ii~send ii~recv

Evasion Techniques¶

VM detection¶

iz~VMware iz~VirtualBox iz~QEMU iz~Xen

Sandbox evasion¶

iz~sleep iz~delay ii~GetTickCount ii~timeGetTime ```_

Binary Exploitation und Reverse Engineering¶

Schwachstellenanalyse¶

```bash

Buffer Overflow Detection¶

Look for dangerous functions¶

ii~strcpy ii~strcat ii~sprintf ii~gets

Format String Vulnerabilities¶

ii~printf ii~sprintf ii~fprintf iz~%s iz~%x iz~%n

Integer Overflow Detection¶

Look for arithmetic operations¶

/x 01C0 # add eax, eax /x 29C0 # sub eax, eax /x F7E0 # mul eax

Use-After-Free Detection¶

ii~free ii~malloc ii~realloc

Stack Analysis¶

afv # Function variables afc # Calling convention K # Show stack frame

ROP Gadget Search¶

/R # Search ROP gadgets /R pop # Search specific gadgets /R ret # Search return gadgets

Shellcode Analysis¶

Look for shellcode patterns¶

/x 31C0 # xor eax, eax /x 50 # push eax /x 68 # push immediate ```_

Entwicklung nutzen¶

```bash

Pattern Generation¶

ragg2 -P 100 -r # Generate pattern ragg2 -q 0x41414141 # Find pattern offset

Address Calculation¶

? 0x401000+0x100 # Calculate addresses ? 0x7fff0000-0x7ffe0000 # Calculate offsets

Shellcode Generation¶

ragg2 -a x86 -b 64 -i exec # Generate shellcode ragg2 -a x86 -b 32 -i connect # Network shellcode

Binary Patching¶

wa "nop" # Write NOP instruction wx 90 # Write NOP byte wa "jmp 0x401234" # Write jump

Exploit Testing¶

r2 -d ./vulnerable_app # Debug target dc # Continue execution dr # Check registers after crash

ASLR Bypass¶

dm # Check memory layout dmi libc # Find libc base ? libc_base+system_offset # Calculate system address ```_

Die umfangreichen Funktionen von Radare2, leistungsstarke Kommandozeilenschnittstelle und umfangreiche Automatisierungsfunktionen machen es zu einem unverzichtbaren Werkzeug für die moderne Reverse Engineering- und Sicherheitsanalyse. Seine Open-Source-Natur, kombiniert mit aktiver Community-Entwicklung und umfangreichem Plugin-Ökosystem, sorgt dafür, dass es an der Spitze der binären Analysetechnologie bleibt. Ob für Malware-Analysen, Schwachstellenforschung, Entwicklung oder allgemeine Reverse Engineering-Aufgaben verwendet, Radare2 bietet die Tiefe, Flexibilität und Leistung, die Sicherheitsexperten für ihre herausforderndste Analysearbeit benötigen. Das Engagement des Frameworks für Skriptfähigkeit und Automatisierung macht es besonders wertvoll für groß angelegte Analyseprojekte und die Integration in Sicherheitsworkflows, die es als Eckpfeiler im Toolkit des modernen Sicherheitsanalytikers etablieren.

Radare2 - Reverse Engineering Framework¶

Installation und Inbetriebnahme¶

Cross-Platform Installation¶

Ubuntu/Debian Installation¶

Alternative: Install latest version from source¶

macOS Installation via Homebrew¶

Windows Installation¶

Download from https://github.com/radareorg/radare2/releases¶

Or use package managers:¶

Chocolatey: choco install radare2¶

Scoop: scoop install radare2¶

Arch Linux Installation¶

CentOS/RHEL/Fedora Installation¶

or¶

Build from Source (Latest Features)¶

Verify Installation¶

Update Radare2¶

Install Additional Packages¶

Konfiguration und Umwelt-Setup¶

Radare2 Configuration Directory¶

Linux/macOS: ~/.config/radare2/¶

Main Configuration File¶

Basic Configuration Options¶

Environment Variables¶

Plugin Management¶

Essential Plugins¶

Custom Plugin Directory¶

Basic Radar2 Verwendung¶

Belastung und Erstanalyse¶

Basic File Loading¶

Loading Options¶

Remote Analysis¶

Multiple File Analysis¶

Project Management¶

Session Management¶

Navigation und Information¶

Basic Navigation¶

Address Formats¶

Information Commands¶

Binary Information¶

Architecture Information¶

Memory Layout¶

Demontage und Codeanalyse¶

Basic Disassembly¶

Disassembly Modes¶

Function Analysis¶

Code Analysis¶

Cross-References¶

Control Flow Analysis¶

Erweiterte Analysefunktionen¶

Funktionsanalyse und Manipulation¶

Function Creation and Management¶

Function Signatures¶

Function Variables and Arguments¶

Function Calling Conventions¶

Function Analysis Options¶

Advanced Function Analysis¶

Function Diffing¶

Datenanalyse und Strukturen¶

Data Type Analysis¶

Structure Definition¶

Example Structure Definition¶

Apply Structure to Data¶

Array Analysis¶

Enum Definition¶

String Analysis¶

String Operations¶

Data Visualization¶

Speicher und binäre Analyse¶

Memory Operations¶

Memory Search¶

Advanced Search¶

Binary Operations¶

Binary Modification¶

Binary Comparison¶

Entropy Analysis¶

Debugging und dynamische Analyse¶

Operationen im Debug-Modus¶

Starting Debug Session¶

Process Attachment¶

Download from https://github.com/radareorg/radare2/releases ¶