18

I have been trying to figure this out for quite some time now, and would really need some help. Firstly, some intro:

I am running the newest version of radare2 from Github on a 64bit Ubuntu 16.04 and have the following sample program r2_test.cpp:

#include <cstdio> int main(int argc, char* argv[]) { int num; while (1) { printf("Enter a number: "); scanf("%d", &num); printf("You entered: %d\n", num); } return 0; }

What I am trying to achieve is to debug this program using radare2 and two terminals in a way that I run radare2 in terminal window T1 and have the programs input/output in terminal window T2. After some research I figured that this should probably be done with the help of rarun2 tool.

So, for my first try I read the man page for rarun2, specifically the part with redirecting IO to another terminal and after identifying the T2 terminal as /dev/pts/17 I created the following test.rr2 file:

#!/usr/bin/rarun2 stdio=/dev/pts/17

In T2 terminal I've then run sleep 999999 and in terminal T1 I run r2 -R test.rr2 -d a.out and when executing the command dc inside radare2, the programs input/output is in terminal T1 which is not what I wanted. I've also tried variations like making test.rr2 equal 

#!/usr/bin/rarun2 stdin=/dev/pts/17 stdout=/dev/pts/17

or

#!/usr/bin/rarun2 stdio=/dev/pts/17 stdin=/dev/pts/17 stdout=/dev/pts/17

but the result was always the same.

For my second try, after some research and reading, I tried running the radare2 in the following way: r2 -d rarun2 program=a.out stdio=/dev/pts/17. With this I've achieved redirecting the IO to terminal T2, but the process which gets debugged inside radare2 is the rarun2 tool and since my knowledge of Linux and reverse engineering on it is not that good, I don't really know how to proceed to debugging the a.out process.

So, to summarize, I would really appreciate if someone could share here if this kind of debugging can be done with radare2 and, if it can, how to achieve it? I've also tried it with using nc, but I haven't made any progress to this topic with it.

Improve this question

1 Answer 1

Reset to default
28

It is actually very simple and works for me just fine as you can see in the following gif:

Direct link

First you need to figure out the tty of the terminal you want to redirect the STDIO to (a.k.a Terminal 2, T2). You can do this by simply execute:

$ tty /dev/pts/2

This tty will soon be used on the rarun2 profile file. Meantime, let's put T2 to sleep by using sleep 999999.

Moving to Terminal 1, let's create a simple rarun2 profile with the following content:

#!/usr/bin/rarun2 stdio=/dev/pts/2

We configured stdio to transfer the standard input and output to T2. Now let's execute our program with the profile we've just created:

$ r2 -e dbg.profile=profile.rr2 -d a.out Process with PID 14074 started... = attach 14074 14074 bin.baddr 0x00400000 Using 0x400000 Assuming filepath /tmp/re/a.out asm.bits 64 -- Mind that the 'g' in radare is silent [0x7f9654e0fd80]>

(The same can be done using: r2 -r profile.rr2 -d a.out)
The program successfully loaded in debug mode. Now just for the example, let's put a breakpoint on the second call to printf and start the program using dc. In the gif I was not creating a breakpoint.

[0x7f9654e0fd80]> db 0x00400580 [0x7f9654e0fd80]> dc Selecting and continuing: 14074

Now T2 gives us the output and asks for our input:

Enter a number:

After we send it a digit our breakpoint on T1 hit:

hit breakpoint at: 400580 [0x00400580]>

We can now continue the execution using dc, the loop would continue forever and the Standard Input and Output will be in T2.

Improve this answer
2
  • Ok, so the problem was that Sublime doesn't automatically add a "newline" character to my profile.rr2 file. Also, I only tried with the -R option and with it it doesn't work. I still don't understand why it doesn't work with -R but does with -e dbg.profile=...Anyway, I know now how to make it work and thanks a lot. If you have time, can you check if it will work for you with the -R. Commented Sep 28, 2017 at 9:47
  • It works just fine with -R as I mentioned in the post :) I checked it few times. Glad I was able to help! Commented Sep 28, 2017 at 9:50

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.