Thanks to pwntester, we've got a new web-interface for radare2! You can either get it by using the latest git, or try it on our cloud.
Lets highlight the new features:
The web-interface is now using viz.js to show interractive graphs, and the disassembly has now syntax highlighting, like the command line interface. When we say Interractive, we mean that you can not only move the graph, but also modify, edit and annotate it.
Afficionados of IDA shouldn't be lost anymore, since the web-interface now shares a lot of its shortcuts:
n to rename a function
g to go on a specific offset
; to add a comment
c to define as code
u to undefine
space to switch between disassembly and graph view
You can now see hexdump, graph view, disassembly, settings and strings since each of them has a dedicated webview!
By the way, changes made within the web interface are persistent, this means that you can build your colourscheme in an interractive manner. nOf course, every useful information that can be used to move in the binary can be displayed in the side bar, like functions, sections, imports, relocs, and flags.
Since everything is not doable within the web interface (yet), you'll find a command-line widget at the bottom of your screen, and the changes are propagated in real-time.
Some miscreants are saying that radare2 is not documented, this is wrong.
The "radare book" was released together with radare 1.0, several years ago, so some of the examples/features may not be compatible with radare2.
You can read it online or download the PDF.
Recently, our tester in chief, maijin, started a project to update the radare book to create the radare2 book; feel free to contribute.
The radare2 api (aka libr) is described in vapi files. Those files are translated by valaswig into swig interface files to generate the bindings for python, ruby, perl and others.
Those Vala vapi files are at the same time parsed by Valadoc to generate the online documentation.
Some e-zines and bloggers have published articles about how to use radare.
- phrack, issue #66, article 14, manual binary mangling with radare, by pancake
- arteam#4, handy primer on linux reversing, by Gunther
- canthack.org, Adventures with Radare2 #1: A Simple Shellcode Analysis, by a concatenation of geeks from Canterbury, UK.
- dustri.org, Defeating IOLI with radare2, by jvoisin
- crowell's blog
- trollprod.org wrote some blogposts in French.
- dukebarman's blog - articles about Radare2 in Russian language.
- This blog ;)
People gave talks about radare2 at several well-know conferences, like hack.lu, pses, oggcamp, rootedlabs, lancon, …
We also did a lot of workshops!
There are some worthful information and gems on our wiki. Feel free to complete it with your favourites tips and tricks.
@pwntester did a really great cheatsheet to put on your wall, along with the refcard.
October is over and we delayed a bit the end of the RSoC in order to get everything done for the release, and it seems that little happened as planned:
The RSoC advertisement was a great opportunity to get new developers interested in contributing to the project, some of them even without joining the RSoC took some points that weren't requested and delivered them! That's pretty cool, because our two selected students disapeared during the summer.
We're a bit sad that the sdbization task wasn't completed, since this would have been a huge improvement, both in term of performances and cool new features, like collaboration. Also, no one gave some love to the web interface, so it will still be an ugly PoC a bit longer.
Most of the tasks weren't completed on the test cases and documentation sides, but we hope to get things done in time for the next release, the 0.9.9.
We'd like to congratulate our 3 volunteers for their hard work and dedication. They were supposed to be the 'free' team, but since our two official students left, we'd like to pay them as if they were selected: We managed to get $2100 in budget, so each of them will receive $700.
Skia did great to implement structures support, a bit à la 010Editor.
r2 -nn it is possible to analyze the file header structs using the
pxa and other related commands.
$ r2 -nn /path/to/bin
FLIRT and YARA support
jfrankowski did a great RSoC, and improved yara support in radare2, and also added the FLIRT one! Currently, radare2 is only able to use existing signatures, but feel free to drop us a patch to build our own, using radare!
Yara3 support is almost there, but we prefer to release for a welltested yara2 version and push the upgrade in 0.9.9.
inisider implemented a standalone library to handle PDB files, and integrated it into radare2. You can now analyse/debug PE with much more ease.
> .!rabin2 -rP test.pdb
Nobody took that task from the RSoC, but pancake and condret raised the bar and managed to get a working implementation of ESIL, mainly tested on gameboy, brainfuck, x86 and mips. Also, pancake made a new search command to use esil expressions to perform complex conditional carving useful for forensics and data analysis.
We enjoyed holding this first RSoC. We made some mikstakes, and learned a lot of things. If we won't get selected for a GSoC once again, be sure that the second RSoC will be better than the first one.
We'd like to thank everyone who attended, participated, donated, supported, helped, advertised, improved and tested things. Without you, the RSoC wouldn't have been so productive!