#advanced
Reversing with radare2
[Step-1] Running the binary
Download run from here & execute
Command: ./run
After executing the above program, it shows that there are 3 variables (a, b, c) where c is the sum of a and b.
[Step-2] Open file in debug mode
Command: r2 -d ./run
This will open the binary in debugging mode.
[Step-3] Analyzing run
Once the binary is open, one of the first things to do is ask radare2 to analyze the program, and this can be done by typing in: aa
It analyses all symbols and entry points in the executable.
[Step-4] List all functions
Once the analysis is complete, you would want to know where to start analysing from - most programs have an entry point defined as main. To find list of all the functions run: afl
Command: afl | grep main
Here we're using grep to filter results containing main
Queries & suggestions @Revnexbot
Reversing with radare2
[Step-1] Running the binary
Download run from here & execute
Command: ./run
After executing the above program, it shows that there are 3 variables (a, b, c) where c is the sum of a and b.
[Step-2] Open file in debug mode
Command: r2 -d ./run
This will open the binary in debugging mode.
[Step-3] Analyzing run
Once the binary is open, one of the first things to do is ask radare2 to analyze the program, and this can be done by typing in: aa
It analyses all symbols and entry points in the executable.
[Step-4] List all functions
Once the analysis is complete, you would want to know where to start analysing from - most programs have an entry point defined as main. To find list of all the functions run: afl
Command: afl | grep main
Here we're using grep to filter results containing main
Queries & suggestions @Revnexbot
#advanced
[Step-5] Print disassembly function
As seen from the output of Step-4, there actually is a function at main. Let’s examine the assembly code at main by running the command:
pdf @main
Where pdf means print disassembly function & doing so gives us the view shown above
The column to left of screenshot shown in green is actually the memory addresses & they may be different on your computer.
Now to understand rest of the output of pdf @main, we need to know some basic assembly instructions & we'll be doing the same in next few steps
Queries & suggestions @Revnexbot
[Step-5] Print disassembly function
As seen from the output of Step-4, there actually is a function at main. Let’s examine the assembly code at main by running the command:
pdf @main
Where pdf means print disassembly function & doing so gives us the view shown above
The column to left of screenshot shown in green is actually the memory addresses & they may be different on your computer.
Now to understand rest of the output of pdf @main, we need to know some basic assembly instructions & we'll be doing the same in next few steps
Queries & suggestions @Revnexbot
#intermediate
Introduction to Assembly Language & Registers
An assembly language is a low level programming language designed for a specific type of processor. The core of assembly language involves using registers to do the following:
[1] Transfer data between memory and register, and vice versa
[2] Perform arithmetic operations on registers and data
[3] Transfer control to other parts of the program
The registers store data elements for processing without having to access the memory.
64 bit • %rax | %rbx | %rcx | %rdx | %rsi | %rdi | %rsp | %rbp
32 bit • %eax | %ebx | %ecx | %edx | %esi | %edi | %esp | %ebp
The first six registers are known as general purpose registers while %rsp and %rbp are special purpose and their meaning will be explained later on.
Queries & suggestions @Revnexbot
Introduction to Assembly Language & Registers
An assembly language is a low level programming language designed for a specific type of processor. The core of assembly language involves using registers to do the following:
[1] Transfer data between memory and register, and vice versa
[2] Perform arithmetic operations on registers and data
[3] Transfer control to other parts of the program
The registers store data elements for processing without having to access the memory.
64 bit • %rax | %rbx | %rcx | %rdx | %rsi | %rdi | %rsp | %rbp
32 bit • %eax | %ebx | %ecx | %edx | %esi | %edi | %esp | %ebp
The first six registers are known as general purpose registers while %rsp and %rbp are special purpose and their meaning will be explained later on.
Queries & suggestions @Revnexbot
#intermediate
Opcodes & Assembly Instructions
Each assembly language statement is split into an opcode and an operand. The opcode is the instruction that is executed by the CPU and the operand is the data or memory location used to execute that instruction.
To move data using registers, the following instruction is used:
movq source, destination
This involves:
Transferring constants(which are prefixed using the $ operator) e.g. movq $3 rax would move the constant 3 to the register
Transferring values from a register e.g. movq %rax %rbx which involves moving value from rax to rbx
Transferring values from memory which is shown by putting registers inside brackets e.g. movq %rax (%rbx) which means move value stored in %rax to memory location represented by %rbx.
The last letter of the mov instruction represents the size of the data:
Data Type (size in bytes) Suffix
Byte (1) b • Word (2) w • Double Word (4) l • Quad Word (8) q • Single Precision (4) s • Double Precision (8) l
Queries @Revnexbot
Opcodes & Assembly Instructions
Each assembly language statement is split into an opcode and an operand. The opcode is the instruction that is executed by the CPU and the operand is the data or memory location used to execute that instruction.
To move data using registers, the following instruction is used:
movq source, destination
This involves:
Transferring constants(which are prefixed using the $ operator) e.g. movq $3 rax would move the constant 3 to the register
Transferring values from a register e.g. movq %rax %rbx which involves moving value from rax to rbx
Transferring values from memory which is shown by putting registers inside brackets e.g. movq %rax (%rbx) which means move value stored in %rax to memory location represented by %rbx.
The last letter of the mov instruction represents the size of the data:
Data Type (size in bytes) Suffix
Byte (1) b • Word (2) w • Double Word (4) l • Quad Word (8) q • Single Precision (4) s • Double Precision (8) l
Queries @Revnexbot
This media is not supported in your browser
VIEW IN TELEGRAM
#intermediate
Some Important Instructions in Assembly Language
[1] leaq source, destination
this instruction sets destination to the address denoted by the expression in source
[2] addq source, destination
destination = destination + source
[3] subq source, destination
destination = destination - source
[4] imulq source, destination
destination = destination * source
[5] salq source, destination
destination = destination << source where << is the left bit shifting operator
[6] sarq source, destination
destination = destination >> source where >> is the right bit shifting operator
[7] xorq source, destination
destination = destination XOR source
[8] andq source, destination
destination = destination & source
[9] orq source, destination
destination = destination | source
Queries & suggestions @Revnexbot
Some Important Instructions in Assembly Language
[1] leaq source, destination
this instruction sets destination to the address denoted by the expression in source
[2] addq source, destination
destination = destination + source
[3] subq source, destination
destination = destination - source
[4] imulq source, destination
destination = destination * source
[5] salq source, destination
destination = destination << source where << is the left bit shifting operator
[6] sarq source, destination
destination = destination >> source where >> is the right bit shifting operator
[7] xorq source, destination
destination = destination XOR source
[8] andq source, destination
destination = destination & source
[9] orq source, destination
destination = destination | source
Queries & suggestions @Revnexbot
#advanced
Step-5 Walkthrough & explanation
Now that we know some basic assembly, let’s jump back to step-5 and walkthrough the code to see what the instructions mean when combined.
The line starting with sym.main indicates that we’re looking at the main function. The next 3 lines (box-1) are used to represent the variables stored in the function. The column (a) indicates that they are integers, column (b) specifies the name that radare2 uses to reference them and column (c) shows the actual memory location.
The next 3 instructions (box-2) are used to allocate space on the stack. This ensures that there’s enough room for variables to be allocated.
Queries & suggestions @Revnexbot
Step-5 Walkthrough & explanation
Now that we know some basic assembly, let’s jump back to step-5 and walkthrough the code to see what the instructions mean when combined.
The line starting with sym.main indicates that we’re looking at the main function. The next 3 lines (box-1) are used to represent the variables stored in the function. The column (a) indicates that they are integers, column (b) specifies the name that radare2 uses to reference them and column (c) shows the actual memory location.
The next 3 instructions (box-2) are used to allocate space on the stack. This ensures that there’s enough room for variables to be allocated.
Queries & suggestions @Revnexbot
#advanced
Introduction to Breakpoints
A more efficient and practical way to analyse the program is to do so while it runs. And the best way to do this is using breakpoints.
A breakpoint specifies where the program should stop executing. This is useful as it allows us to look at the state of the program at that particular point.
[Step-6] Setting breakpoints
Now let’s set a breakpoint using the command
db address
In this case, we want to set breakpoint at mov dword [local_ch], 4 and the memory address corresponding to this instruction is 0x00400b55
db 0x00400b55
Now that we’ve set a breakpoint, let’s run the program using
dc
Running dc will execute the program until we hit the breakpoint.
Queries & suggestions @Revnexbot
Introduction to Breakpoints
A more efficient and practical way to analyse the program is to do so while it runs. And the best way to do this is using breakpoints.
A breakpoint specifies where the program should stop executing. This is useful as it allows us to look at the state of the program at that particular point.
[Step-6] Setting breakpoints
Now let’s set a breakpoint using the command
db address
In this case, we want to set breakpoint at mov dword [local_ch], 4 and the memory address corresponding to this instruction is 0x00400b55
db 0x00400b55
Now that we’ve set a breakpoint, let’s run the program using
dc
Running dc will execute the program until we hit the breakpoint.
Queries & suggestions @Revnexbot
#advanced
Instruction pointers & the little b
Command - pdf
Once we hit the breakpoint, we can use this command instead of pdf @main to directly print out the main function.
The rip (see box-1) which is the current instruction shows where execution has stopped. The little b marked as box-2 represents the breakpoint.
We know that the mov instruction is used to transfer values. The statement (box-3) is transferring the value 4 into the variable (local_ch). Note that currently the instruction pointer (rip) is just above the memory address we specified i.e. the code box-3 haven't executed and the value of the variable should be empty
Queries & suggestions @Revnexbot
Instruction pointers & the little b
Command - pdf
Once we hit the breakpoint, we can use this command instead of pdf @main to directly print out the main function.
The rip (see box-1) which is the current instruction shows where execution has stopped. The little b marked as box-2 represents the breakpoint.
We know that the mov instruction is used to transfer values. The statement (box-3) is transferring the value 4 into the variable (local_ch). Note that currently the instruction pointer (rip) is just above the memory address we specified i.e. the code box-3 haven't executed and the value of the variable should be empty
Queries & suggestions @Revnexbot
#advanced
[Step-7] Printing contents of a variable
To view the contents of the variable (local_ch), we use the following instruction
px @memory-address
In this case, the corresponding memory address for local_ch will be rbp-0xc (from the first few lines of @pdf main)
This instruction prints the values of memory in hex
px @rbp-0xc
This shows that the variable currently doesn’t have anything stored in it - it’s just 0000 (row 1 - column 0).
Queries & suggestions @Revnexbot
[Step-7] Printing contents of a variable
To view the contents of the variable (local_ch), we use the following instruction
px @memory-address
In this case, the corresponding memory address for local_ch will be rbp-0xc (from the first few lines of @pdf main)
This instruction prints the values of memory in hex
px @rbp-0xc
This shows that the variable currently doesn’t have anything stored in it - it’s just 0000 (row 1 - column 0).
Queries & suggestions @Revnexbot
#advanced
[Step-8] ds - step to next instruction
Let’s execute this instruction (i.e. mov dword [local_ch], 4) and go to the next one using the following command (which only goes to the next instruction)
ds
If we view the memory location after running this command, we get the above (screenshot) output
We can see that the first 2 bytes (row 1 - column 0) have the value 4.
Queries & suggestions @Revnexbot
[Step-8] ds - step to next instruction
Let’s execute this instruction (i.e. mov dword [local_ch], 4) and go to the next one using the following command (which only goes to the next instruction)
ds
If we view the memory location after running this command, we get the above (screenshot) output
We can see that the first 2 bytes (row 1 - column 0) have the value 4.
Queries & suggestions @Revnexbot
Product Name:AceThinker Screen Grabber Pro(Yearly Subscription)
License Code:696B8-7A61Q-O12GD-8F2B5
Product Name:AceThinker Video Master
License Code:8B1E1-A8815-PA0GD-D3575
Product Name:AceThinker iPhone Screen Recorder
License Code:846E3-19F17-M02GD-1F6D4
Product Name:AceThinker PDF Writer(Yearly Subscription)
License Code:8D29B-3041P-PCFGD-238D9
Product Name:AceThinker Audio Recorder Online
License Code:59861-6941J-P72GD-A99C4
Product Name:AceThinker Screen Recorder Online
License Code:6DC53-45914-PDEGD-48F41
Product Name:AceThinker Video Converter Online(Yearly Subscription)
License Code:78CD9-5FC16-NA1GD-8E946
Product Name:AceThinker Music Recorder
License Code:9889C-D3D1I-O34GD-072D6
Product Name:AceThinker Video Keeper(Yearly Subscription)
License Code:86CE0-EB31F-M50GD-0D6F6
Product Name:AceThinker Screen Grabber Pro (Mac)
License Code:EA954-C881Q-P33GD-9CE28
Product Name:AceThinker Mac iPhone Screen Recorder
License Code:3E7B1-AF31N-N63GD-7858A
Product Name:AceThinker Disk Recovery(Yearly Subscription)
License Code:08C1A-F8C1F-QFFGD-F3E44
Product Name:AceThinker Rec
License Code:36904-CD21Q-M05GD-F9011
Product Name:AceThinker Video Editor(Yearly Subscription)
License Code:5B598-8EC1G-QC8GD-835B6
Product Name:AceThinker PDF Writer Mac
License Code:A4CCC-CFC1O-N1DGD-6A515
Product Name:AceThinker PDF Converter Pro(Yearly Subscription)
License Code:F0D7E-5BB1J-OC2GD-10C39
Product Name:AceThinker PDF Converter Pro Mac
License Code:2F7C1-9C91Q-P2BGD-B3542
Product Name:AceThinker iOS Recovery
License Code:96C1A-F6D1M-RA8GD-941A4
Product Name:AceThinker iOS Recovery
License Code:0B0EE-19817-R98GD-D2C45
Product Name:AceThinker Disk Recovery(Yearly Subscription)
License Code:E87E3-2161I-O2AGD-E0279
Product Name:AceThinker PDF Converter Lite
License Code:B8EB2-1561G-R82GD-6789D
Product Name:AceThinker PDF Writer
License Code:962CF-9271K-NF5GD-96CB8
Product Name:AceThinker Watermark Eraser(Yearly Subscription)
License Code:12279-5B51K-OC5GD-0468C
Product Name:AceThinker Mirror(Yearly Subscription)
License Code:9BA76-F9B15-R48GD-DBF4D
Product Name:AceThinker iOS Unlock(Yearly Subscription)
License Code:C2193-23F1P-QF1GD-66E2F
Product Name:AceThinker Video Editor Pro
License Code:5F97D-6531O-R0DGD-A43EB
Product Name:AceThinker Video Editor
License Code:1E4D7-1F014-M65GD-9C8F2
Send screenshots @Revnexbot
License Code:696B8-7A61Q-O12GD-8F2B5
Product Name:AceThinker Video Master
License Code:8B1E1-A8815-PA0GD-D3575
Product Name:AceThinker iPhone Screen Recorder
License Code:846E3-19F17-M02GD-1F6D4
Product Name:AceThinker PDF Writer(Yearly Subscription)
License Code:8D29B-3041P-PCFGD-238D9
Product Name:AceThinker Audio Recorder Online
License Code:59861-6941J-P72GD-A99C4
Product Name:AceThinker Screen Recorder Online
License Code:6DC53-45914-PDEGD-48F41
Product Name:AceThinker Video Converter Online(Yearly Subscription)
License Code:78CD9-5FC16-NA1GD-8E946
Product Name:AceThinker Music Recorder
License Code:9889C-D3D1I-O34GD-072D6
Product Name:AceThinker Video Keeper(Yearly Subscription)
License Code:86CE0-EB31F-M50GD-0D6F6
Product Name:AceThinker Screen Grabber Pro (Mac)
License Code:EA954-C881Q-P33GD-9CE28
Product Name:AceThinker Mac iPhone Screen Recorder
License Code:3E7B1-AF31N-N63GD-7858A
Product Name:AceThinker Disk Recovery(Yearly Subscription)
License Code:08C1A-F8C1F-QFFGD-F3E44
Product Name:AceThinker Rec
License Code:36904-CD21Q-M05GD-F9011
Product Name:AceThinker Video Editor(Yearly Subscription)
License Code:5B598-8EC1G-QC8GD-835B6
Product Name:AceThinker PDF Writer Mac
License Code:A4CCC-CFC1O-N1DGD-6A515
Product Name:AceThinker PDF Converter Pro(Yearly Subscription)
License Code:F0D7E-5BB1J-OC2GD-10C39
Product Name:AceThinker PDF Converter Pro Mac
License Code:2F7C1-9C91Q-P2BGD-B3542
Product Name:AceThinker iOS Recovery
License Code:96C1A-F6D1M-RA8GD-941A4
Product Name:AceThinker iOS Recovery
License Code:0B0EE-19817-R98GD-D2C45
Product Name:AceThinker Disk Recovery(Yearly Subscription)
License Code:E87E3-2161I-O2AGD-E0279
Product Name:AceThinker PDF Converter Lite
License Code:B8EB2-1561G-R82GD-6789D
Product Name:AceThinker PDF Writer
License Code:962CF-9271K-NF5GD-96CB8
Product Name:AceThinker Watermark Eraser(Yearly Subscription)
License Code:12279-5B51K-OC5GD-0468C
Product Name:AceThinker Mirror(Yearly Subscription)
License Code:9BA76-F9B15-R48GD-DBF4D
Product Name:AceThinker iOS Unlock(Yearly Subscription)
License Code:C2193-23F1P-QF1GD-66E2F
Product Name:AceThinker Video Editor Pro
License Code:5F97D-6531O-R0DGD-A43EB
Product Name:AceThinker Video Editor
License Code:1E4D7-1F014-M65GD-9C8F2
Send screenshots @Revnexbot
Apowersoft spoofer v1.3 (Update)
👉🏻 Link ~ @ApowersoftBot
~ Get license keys to all apowersoft products FREE
Send screenshots @Revnexbot
👉🏻 Link ~ @ApowersoftBot
~ Get license keys to all apowersoft products FREE
Send screenshots @Revnexbot