Pablo Guides

# Course #482: Introduction to radare2

## Installation and Configuration on Kali Linux

### 1.1 Prerequisites

Before diving into the installation of radare2, ensure that your Kali Linux environment is updated to the latest version. To do this, open your terminal and execute the following commands:

"`bash
sudo apt update && sudo apt upgrade
"`

### 1.2 Installing radare2

Kali Linux offers radare2 directly from its default repositories. To install radare2, run:

"`bash
sudo apt install radare2
"`

You can verify the installation by checking the version:

"`bash
r2 -v
"`

Alternatively, if you want to install the latest version or build from the source, follow these steps:

"`bash
# Clone the radare2 repository
git clone https://github.com/radareorg/radare2.git

# Navigate to the directory
cd radare2

# Install using the sys/install.sh script
sys/install.sh
"`

This script will set up radare2 in your system, installing all necessary dependencies and tools.

### 1.3 Configuration

Radare2 comes with a default configuration; however, you can customize it to fit your needs. The configuration file is located at `~/.config/radare2/radare2.conf`. You can create or edit this file to change settings like editor preferences, logging levels, and script paths.

Here’s an example configuration snippet:

"`conf
# Set the default editor
editor = vim

# Enable color output
anal.color = true

# Set the default architecture
asm.arch = x86
"`

## Step-by-Step Usage and Real-World Use Cases

Now that radare2 is installed and configured, let’s explore its features through a step-by-step tutorial.

### 2.1 Basic Commands

Radare2 operates primarily through its command line interface. Here are some basic commands to get you started.

#### 2.1.1 Opening a Binary

To analyze a binary file, use the following command:

"`bash
r2 /path/to/binary
"`

For example, to analyze a sample binary called `sample.bin`:

"`bash
r2 sample.bin
"`

#### 2.1.2 Listing Available Commands

Once inside radare2, you can list available commands by typing:

"`bash
?
"`

This will show several commands organized into categories like analysis, debugging, and scripting.

### 2.2 Disassembly

Disassembly is one of the core features of radare2 that allows you to see the assembly code of a binary. To disassemble the entire binary, use the command:

"`bash
aaaa # Analyze all functions and references
pdf # Print disassembly of the current function
"`

#### 2.2.1 Analyzing Functions

You can list all functions in the binary using:

"`bash
afl # Analyze and list functions
"`

To view a specific function, you can navigate to it using:

"`bash
s # Switch to a specific function
pdf # Print disassembled function code
"`

### 2.3 Real-World Use Case: Binary Exploitation

Let’s consider a practical example of binary exploitation where radare2 can be instrumental. Suppose you have a vulnerable binary that is susceptible to buffer overflow.

1. **Analyze the Binary**: Start radare2 and analyze the binary as described above.
2. **Locate Vulnerable Functions**: Look for functions like `gets`, `strcpy`, or any function that does not perform bounds checking.
3. **Identify Vulnerable Buffers**: Use the disassembly to locate where buffers are defined and how they are manipulated.

"`bash
afl # Analyze functions
pdf # Look for functions that handle user input
"`

4. **Exploit Development**: With the knowledge of the binary and its vulnerabilities, you can craft an exploit.

### 2.4 Debugging with radare2

Radare2 also includes debugging capabilities. You can start debugging a binary with:

"`bash
r2 -d /path/to/binary
"`

Once in debugging mode, you can set breakpoints, inspect registers, and step through the execution:

– **Set Breakpoint**:

"`bash
db

"`

– **Run the Binary**:

"`bash
dc # Continue execution
"`

– **Inspect Registers**:

"`bash
dr # Display registers
"`

### 2.5 Scripting with radare2

Radare2 supports scripting through its own language, r2pipe. You can automate tasks and extend radare2's functionality.

Here’s an example of a simple script that lists all function names in a binary:

"`bash
#!/usr/bin/env bash
r2 -q -c "afl" /path/to/binary
"`

### 2.6 Integrating with Other Tools

Radare2 can be integrated with other tools such as Ghidra, Binary Ninja, or even using Python for advanced scripting with r2pipe.

To use r2pipe in Python, install it via pip:

"`bash
pip install r2pipe
"`

Then, create a script like the following:

"`python
import r2pipe

r2 = r2pipe.open('/path/to/binary')
functions = r2.cmd('afl')
print(functions)
"`

## Detailed Technical Explanations and External References

### 3.1 Understanding the Disassembly

Disassembling a binary requires an understanding of the architecture (x86, ARM, etc.). Radare2 can analyze binaries for different architectures based on the settings in `radare2.conf`.

### 3.2 Environment Variables

Radare2 allows customization through various environment variables. For instance:

– `R2_HOME`: Defines the path to the radare2 home directory.
– `R2_PLUGIN_PATH`: Specifies directories for additional plugins.

### 3.3 References

For further reading and deep dives into radare2, refer to these resources:

– [Official Radare2 Documentation](https://rada.re/n/radare2.html)
– [Radare2 Book](https://radare2.gitbooks.io/radare2book/content/)
– [GitHub Repository](https://github.com/radareorg/radare2)

## Conclusion

In this section, you learned how to install and configure radare2 on Kali Linux and explored its basic functionalities, including disassembly, debugging, and scripting. With practical examples and commands, you are now ready to utilize radare2 in your pentesting endeavors.

As you progress through the course, remember that mastering radare2 will greatly enhance your capabilities in reverse engineering and vulnerability assessment.

—

Made by pablo rotem / פבלו רותם