A map of the program
radare2 is a free reverse engineering tool that disassembles a program, names the strings and calls it finds, and draws its branches as a graph.
That matters because the place where a program decides is quicker to find on a map than in a long listing. This lesson uses it on a practice program, not on the lab's own five.
By the end of this lesson
Note
I can find where a program decides.
Key words
| Word | What it means | Example |
|---|---|---|
| Analysis | radare2 working out functions and names before you ask | aa |
| Function | a named piece of a program that does one job | main |
| Branch | a place where the program goes one of two ways | |
| Basic block | a run of instructions with no jump inside it | |
| Cross-reference | a place that uses a name or an address | |
| Graph | a drawing of blocks joined by the jumps between them |
The cells students fill in are left blank in this preview.
radare2 analyses first and you ask after
You give radare2 a file and a list of commands. aa tells it to analyse the file: find the functions and name what they use.
afl lists the functions. iz lists the strings. pdf @ main prints the disassembly of the function main. The options -q and -c run the commands and then quit, so each Run below is one line.
Write the practice program
printf '#include <stdio.h>\n#include <string.h>\nint main(int argc, char **argv) {\n if (argc != 2) { puts("usage: vault WORD"); return 2; }\n if (strcmp(argv[1], "blue-harbour") == 0) { puts("Door open."); return 0; }\n puts("Door shut.");\n return 1;\n}\n' > vault.cShown here, not run. Create a free account to press Run and type it into your own lab’s terminal.
Compile it
gcc -O0 -no-pie -fno-stack-protector -o vault vault.cShown here, not run. Create a free account to press Run and type it into your own lab’s terminal.
Find the function called main
r2 -q -e scr.color=0 -c 'aa' -c 'afl' vault 2>/dev/null | grep mainShown here, not run. Create a free account to press Run and type it into your own lab’s terminal.
List the strings with their addresses
r2 -q -e scr.color=0 -c 'iz' vault 2>/dev/nullShown here, not run. Create a free account to press Run and type it into your own lab’s terminal.
A branch has two ways out
A decision in a program is two instructions working together. A compare or test sets a flag. The jump just after it reads the flag.
If the jump is taken the program goes one way. If not, it falls through to the next line. The message printed afterwards is only the result. The decision is the compare and the jump before it.
Worked example: the decision in vault
| Instruction | What it does | What happens next |
|---|---|---|
| call strcmp | Compares the typed word with the stored one | The answer is left in eax |
| test eax, eax | Asks whether eax is zero | Sets the flag |
| jne | Jumps when eax was not zero | Goes to the block that prints Door shut. |
| (falls through) | eax was zero, the words were equal | Runs the block that prints Door open. |
The cells students fill in are left blank in this preview.
The call and the jumps in main
r2 -q -e scr.color=0 -c 'aa' -c 'pdf @ main' vault 2>/dev/null | grep -E "strcmp|jne|je "Shown here, not run. Create a free account to press Run and type it into your own lab’s terminal.
Draw main as a graph
r2 -q -e scr.color=0 -c 'aa' -c 'agf @ main' vault 2>/dev/nullShown here, not run. Create a free account to press Run and type it into your own lab’s terminal.
Who calls strcmp?
r2 -q -e scr.color=0 -c 'aa' -c 'axt sym.imp.strcmp' vault 2>/dev/nullShown here, not run. Create a free account to press Run and type it into your own lab’s terminal.
A common mistake
Warning
Many people think the decision is where the message is printed. The message is only the result. The decision is the compare or test and the jump just before it, so find the jump first and then look at the line above.