rizin and radare2 in anger

Ghidra is where I read one gnarly function; rizin/radare2 is where I live — it's faster to orient, scriptable, and it disassembles, patches, and debugs from one prompt. The command grammar is verb-then-noun and relentlessly chainable, which is intimidating for a day and muscle memory after that. Here's the working set.

The two tools share a command language almost byte for byte. I'll write r2; rizin is the same session with renamed binaries — see the note at the end.

open and analyse#

1
2
3

$ r2 -A ./chal        # open and run full analysis up front
$ r2 -d ./chal        # open in debug mode (live process)
$ r2 -w ./chal        # open writable, for patching

Inside, if you didn't pass -A, analyse with aaa (or aaaa for the deep, slow pass). Analysis is what populates function names, xrefs, and strings.

info before instructions#

Read the binary's metadata first — r2 even gives you checksec for free:

navigate and disassemble#

1
2
3
4
5
6

afl                 # list every function analysis found
afl~main            # ...grep for one (~ is r2's internal grep)
s main              # seek to a symbol (or s sym.main, s 0x401234)
pdf                 # disassemble the function at the current seek
pd 20               # disassemble 20 instructions from here
pdf @ sym.check     # disassemble check() without moving the seek (@ = "at")

~ greps, @ runs a command at a temporary address, and they compose: pdf @ main ~call lists every call inside main. That composition is the whole reason to use r2 over clicking.

For the visual mode that feels like a TUI:

1
2

V       # visual disassembly  (p / P cycle views, hjkl move, : for a command, q exits)
VV      # visual graph mode    (the control-flow graph; great for nested branches)

xrefs — the question you ask most#

"Who calls this, and what does this touch?"

1
2
3

axt sym.imp.system     # cross-references TO system  -> where it's called
axt @ str.bin_sh       # who references the "/bin/sh" string
axf @ main             # references FROM main         -> what main calls/reads

axt sym.imp.system is often the fastest path to the bug: find the dangerous call, then read backwards to what feeds it.

search — strings, bytes, and gadgets#

1
2
3
4
5

/ /bin/sh          # search for a string
/x 4831c0          # search for a byte pattern (hex)
/a jmp rax         # search for an assembled instruction
/R pop rdi         # ROP: gadget search ending in ret
/R/ pop r..        # ...as a regex

/R pop rdi makes r2 a serviceable gadget finder when you don't want to leave for ROPgadget.

decompile in place#

1
2

pdc                # r2's built-in pseudo-C (rough but instant)
pdg                # Ghidra-quality decompile, via the r2ghidra / rz-ghidra plugin

pdg needs the plugin (r2pm -ci r2ghidra, or rizin's rz-ghidra), but it's the Ghidra decompiler in your terminal — worth the install.

patch without a hex editor#

Open writable (-w, or oo+ to reopen rw mid-session), then write hex or assembly straight over an instruction:

1
2
3
4
5

oo+                # reopen current file read-write
s 0x401185         # seek to the branch you want gone
wao nop            # assemble-over: turn this instruction into nop(s)
wx 9090            # or write raw bytes
wa jmp 0x4011b0    # or write a new instruction (wa = "write assembly")

This is how you NOP a license check or flip a jz to a jmp and save the binary in one place.

debug from the same prompt#

r2 -d ./chal drops you in with the process live; the debug commands mirror the static ones with a d prefix:

make it yours#

Drop your defaults in ~/.radare2rc (or ~/.rizinrc) so every session starts right:

1
2
3
4

e asm.syntax = intel     # AT&T is the default; fix that
e scr.color = 3          # full colour
e asm.bytes = true       # show opcode bytes next to disasm
e pager = less