Radare2 - Reverse Engineering - Disassembly - Tutorials - And more!

Reverse engineering can very fun. Beginners are mostly scared away because there is a lot of things going on. Fortunately if you have the right tools this becomes manageable for anyone. The proper  knowledge about the system and programming is also required.

gdb is still in the top list of disassemblers. However it has some limitations and it's not that easy to implement scripting. Yes you can use certain plugins like peda and gef which help you out. But why not use radare2 which uses the capstone framework?

You'll want to use it because...

What is and why use the radare2 ecosystem.

Radare2 is a set of tools used for disassembly and reverse engineering of binaries. You can disassemble and debug many binaries from many architectures by just sitting in your Linux x86 (_64) system without going through any virtual machine or emulation process.

Yes, that's right you can live debug and modify PE's on ELF architecture. Or MIPS architecture on your x86 system. Pretty cool.

The best thing about is that it's scriptable thus you can automate it from your favourite programming language.

You can compare  multiple debuggers at this page lovely http://radare.org/r/cmp.html

Is reverse engineering legal?

It is legal to reverse engineer programs for interoperability between computer programs (look at code and learn from it, modify to make work with something else).
While some EULA's forbid it, the copyright laws allow some form or another regarding compatibility.
Now to understand this better, if you purchased software and  it doesn't work well on one of your systems  you can reverse engineer it to fix some issues.

Article 6 of the 1991 EU Computer Programs Directive allows reverse engineering for the purposes of interoperability, but prohibits it for the purposes of creating a competing product, and also prohibits the public release of information obtained through reverse engineering of software (source).

But to make it public or integrate features in other projects can make it illegal.

All our examples are custom written code or open source projects. When reverse engineering closed source apps, always read the EULA.

Reverse Engineering tutorials

I'm currently working on a series of tutorials on Reverse Engineering with Radare2 and other tools so you can learn assembly from C.

https://andreiclinciu.net/vikings-stole-my-flag-radare2-forensic-analysis

https://andreiclinciu.net/guides-tutorials/reverse-engineering-and-malware-analysis-tutorial-assembly-c-radare2/

Installation and setup

Debian way

Installing it on Debian is extremely simple. Although I recommend using the automated installer from the latest build.
These are the apps we need.

sudo apt-cache search radare2libradare2-1.1 - libraries from the radare2 suitelibradare2-common - arch independent files from the radare2 suitelibradare2-dev - devel files from the radare2 suiteradare2 - free and advanced command line hexadecimal editor

Install it

sudo apt-get install radare2

"Automated" installer

You can use this to either install the newest version or update it. It is very likely that you will need the whole GCC binutils.

Go to the latest release page https://github.com/radare/radare2/releases
Download the latest version. In my case this was 2.2.0 while the debian version was 1.1

Download it, unzip it, and open a command line to the radare folder.

Then to install it just type:

~./sys/install.sh

You'll probably need to type your password and then you can view if it's installed or updated.

r2 -v

There you go, the latest version!

Other platforms including MacOSX and Windows

Yes, you can get binaries for Windows and MacOSX. Get them from http://radare.org/r/down.html

Getting started

Getting started with radare may not seem pretty straightforward. I recommend going through all the links on the following pages

• https://github.com/ifding/radare2-tutorial.
• https://blog.techorganic.com/2016/03/08/radare-2-in-0x1e-minutes/

Aswell as reading the official book provided with radare2.

Or you can just follow the links provided at the top of this page.