#HITB2019AMS D1T3 - Overcoming Fear: Reversing With Radare2

### Overview In this talk presented at HITB2019AMS, Arnau—a mathematics and computer science student from the University of Barcelona and collaborator with r2con—presents an introductory guide to reverse engineering using the Radare2 (r2) framework. The talk aims to demystify Radare2 by demonstrating that users do not need to be advanced reverse engineering professionals or x86 assembly experts to be productive. Radare2 is a free, open-source framework rewritten in C by Sergi Àlvarez (pancake) from an earlier forensics tool. The framework is modular, portable, scriptable, and operates without third-party dependencies across nearly every major platform, architecture, and file format.

### Key Topics - **Architecture and Ecosystem**: Overview of standalone utilities included with the framework, such as `rax2` (base converter), `rabin2` (binary information extractor), `rasm2` (assembler/disassembler), `rahash2` (cryptographic and block-based hashing), `radiff2` (binary diffing), `rarun2` (environment launcher), and `r2pm` (package manager). - **Command Mechanics and Visual Navigation**: Radare2's command design based on short mnemonics (`s` for seek, `p` for print, `a` for analyze, `w` for write) and its built-in inline help system accessed by appending `?`. The framework features interactive visual modes (`V`), graph mode (`VV`), visual configuration editing (`Ve`), and multi-window visual panels (`V!`). - **Code Emulation via ESIL**: Utilizing the Evalable Strings Intermediate Language (ESIL)—a stack-based representation utilizing Reverse Polish Notation (RPN)—to simulate code execution, reconstruct control flow, and unpack obfuscated routines safely without running foreign or untrusted binaries. - **Automation and Scripting**: Programmatic integration using the `r2pipe` API, standard output piping, and native JSON deserialization (`cmdj`). - **Debugging, Exploitation, and Plugins**: Features for dynamic debugging, searching ROP gadgets, pattern generation via `ragg2`, decompilation options, and binary instrumentation using `r2frida`.

### Technical Details - **Installation Best Practices**: The speaker stresses installing Radare2 directly from the git repository using the `./sys/install.sh` script rather than relying on outdated distribution packages (such as Debian's). Releases follow a six-week cycle. - **Command Construction and Modifiers**: Radare2 commands can output formatted JSON by appending `j` (e.g., `iSj`), generate quiet output with `q`, pipe directly to shell commands, or use internal grep (`~`). The temporary seek operator `@` allows querying or disassembling an offset without moving the current seek pointer (e.g., `pdf @ main`). - **Binary Patching Walkthrough**: Demonstrating with a crackme binary, Arnau opens the file in write mode (`-w`), performs analysis (`aaa`), inspects the disassembly (`pdf`), and patches a conditional jump (`jne`) to bypass password verification by overwriting two bytes with NOP instructions (`wx 9090`). - **Safe In-Memory Modification**: Setting `e io.cache = true` allows executing writes and emulating instructions in virtual memory without modifying the original binary on disk. - **ESIL Emulation Demonstration**: By initializing ESIL and virtual stack memory (`aei` and `aeim`), pointing the instruction pointer, and stepping until a target address (`aecu`), Arnau extracts the runtime value computed by a password validation algorithm directly from the stack frame (`pf d @ ebp-0xc`). In a second demo on a 32-bit Windows PE binary, ESIL decrypts a self-modifying code routine in memory, revealing valid disassembly that can be automated via an `r2pipe` Python script. - **Interactive Dynamic Instrumentation**: Using `r2frida`, the speaker attaches to a running counter program, inspects its entry point in visual cursor mode, and live-patches sleep intervals and increment values in memory.

### Takeaways Radare2 is far more accessible than commonly perceived. Users do not need encyclopedic knowledge of x86 assembly or every obscure mnemonic; around ten core commands paired with inline help (`?`) and visual modes are sufficient for most reversing and patching workflows. Beyond static analysis, ESIL provides powerful cross-architecture emulation for unpacking malware and analyzing algorithms without running native processes. Community contributions through bug reporting, documentation, and tooling further maintain the ecosystem.