2

I am currently debugging a C program in radare2 called "test", and I was wondering if there is any way for me to send in hex characters as input through radare2. What I mean by this is that when you're running something outside radare2, you could do easily something like this to send hex values as input into an executable:

$ python -c "print('\x42\x97\x53\x8e\x46\x56')" | ./test

But when I opened the file in debug mode in radare2 and tried to input hex values into my program, it didn't treat the characters starting with "\x" as hex characters and instead saw each character as an actual ascii input character. Is it possible for me to replicate the above command inside radare2?

1 Answers1

3

ENVIRONMENT:

  • radare2: radare2 4.2.0-git 23519 @ linux-x86-64 git.4.1.1-84-g0c46c3e1e commit: 0c46c3e1e30bb272a5a05fc367d874af32b41fe4 build: 2020-01-08__09:49:06
  • system: Ubuntu 18.04.3 LTS

SOLUTION:

  • To recreate the described functionality in radare2 we can utilize two radare2 commands and add additional escape charters to your input string.
    • Command one: doo [args] # Reopen the binary in debug mode with provided arguments.
    • Command two: dc # Continue execution
    • Additional escape charters in input: "\x54\x65\x73\x74" -> "\\x54\\x65\\x73\\x74"

EXAMPLE:

  • Passing passing hex values to /bin/echo:
user@host:~$ echo -e "\x54\x65\x73\x74"
Test
  • Trying the same thing in radare2:
user@host:~$ r2 /bin/echo
[0x00001d10]> doo -e "\x54\x65\x73\x74"
Process with PID 13820 started...
= attach 13820 13820
File dbg:///bin/echo  -e "\x54\x65\x73\x74" reopened in read-write mode
13820
[0x7ff1924ee090]> dc
x54x65x73x74
[0x7ff1924ee090]>
  • Again with radare2 but with additional escape charters ("\x54" -> "\\x54"):
user@host:~$ r2 /bin/echo
[0x00001d10]> doo -e "\\x54\\x65\\x73\\x74"
Process with PID 17265 started...
= attach 17265 17265
File dbg:///bin/echo  -e "\\x54\\x65\\x73\\x74" reopened in read-write mode
17265
[0x7fb080026090]> dc
Test
[0x7fb07fd18e06]>
Kuma
  • 427
  • 5
  • 17
  • Also consider checking out https://reverseengineering.stackexchange.com/ for reverse engineering questions! – Kuma Jan 17 '20 at 14:21