I'm learning to use radare2 and I'm following the same process as other blogs but I'm having problems
The code is as follows:
#include <stdio.h>
int main()
{
int secret = 0;
printf("Please input the secret number:");
scanf("%d",&secret);
if(secret != 123)
{
printf("error secret number!\n");
return 0;
}
printf("Success!\n");
}
compile and run:
➜ practice gcc main.c -o main
➜ practice ./main
Please input the secret number:12
error secret number!
➜ practice ./main
Please input the secret number:123
Success!
➜ practice
I want to change my judgment with radare2
➜ practice r2 -A -w main
WARN: Relocs has not been applied. Please use `-e bin.relocs.apply=true` or `-e bin.cache=true` next time
INFO: Analyze all flags starting with sym. and entry0 (aa)
INFO: Analyze imports (af@@@i)
INFO: Analyze entrypoint (af@ entry0)
INFO: Analyze symbols (af@@@s)
INFO: Recovering variables
INFO: Analyze all functions arguments/locals (afva@@@F)
INFO: Analyze function calls (aac)
INFO: Analyze len bytes of instructions for references (aar)
INFO: Check for objc references (aao)
INFO: Finding and parsing C++ vtables (avrr)
INFO: Analyzing methods
INFO: Finding function preludes (aap)
INFO: Finding xrefs in noncode section (e anal.in=io.maps.x)
INFO: Emulate functions to find computed references (aaef)
INFO: Recovering local variables (afva)
INFO: Type matching analysis for all functions (aaft)
INFO: Propagate noreturn information (aanr)
INFO: Use -AA or aaaa to perform additional experimental analysis
[0x100003ed4]> iz
[Strings]
nth paddr vaddr len size section type string
―――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――
0 0x00003f74 0x100003f74 31 32 2.__TEXT.__cstring ascii Please input the secret number:
1 0x00003f97 0x100003f97 21 22 2.__TEXT.__cstring ascii error secret number!\n
2 0x00003fad 0x100003fad 9 10 2.__TEXT.__cstring ascii Success!\n
[0x100003ed4]> pdf
;-- section.0.__TEXT.__text:
;-- entry0:
;-- _main:
;-- func.100003ed4:
;-- pc:
; NULL XREF from aav.0x100000020 @ +0xb0(r)
┌ 136: int main (int argc, int64_t argv);
│ ; arg int argc @ x0
│ ; arg int64_t argv @ sp+0x60
│ ; var int64_t var_0h_2 @ sp+0x0
│ ; var int64_t var_10h @ sp+0x10
│ ; var int64_t var_8h @ sp+0x18
│ ; var int64_t var_0h @ sp+0x1c
│ ; var int64_t var_20h @ sp+0x20
│ ; var int64_t var_20h_2 @ sp+0x28
│ 0x100003ed4 ffc300d1 sub sp, sp, 0x30 ; [00] -r-x section size 136 named 0.__TEXT.__text
│ 0x100003ed8 fd7b02a9 stp x29, x30, [var_20h]
│ 0x100003edc fd830091 add x29, var_20h
│ 0x100003ee0 bfc31fb8 stur wzr, [x29, -4] ; argc
│ 0x100003ee4 a82300d1 sub x8, x29, 8
│ 0x100003ee8 e80b00f9 str x8, [var_10h]
│ 0x100003eec bf831fb8 stur wzr, [x29, -8] ; argc
│ 0x100003ef0 00000090 adrp x0, 0x100003000
│ 0x100003ef4 00d03d91 add x0, x0, 0xf74 ; 0x100003f74 ; "Please input the secret number:" ; const char *format
│ 0x100003ef8 19000094 bl sym.imp.printf ; int printf(const char *format)
│ 0x100003efc e80b40f9 ldr x8, [var_10h] ; 5
│ 0x100003f00 e9030091 mov x9, sp
│ 0x100003f04 280100f9 str x8, [x9]
│ 0x100003f08 00000090 adrp x0, 0x100003000
│ 0x100003f0c 00503e91 add x0, x0, 0xf94 ; const char *format
│ 0x100003f10 16000094 bl sym.imp.scanf ; int scanf(const char *format)
│ 0x100003f14 a8835fb8 ldur w8, [x29, -8]
│ 0x100003f18 08ed0171 subs w8, w8, 0x7b
│ 0x100003f1c e8179f1a cset w8, eq
│ ┌─< 0x100003f20 e8000037 tbnz w8, 0, 0x100003f3c
│ ┌──< 0x100003f24 01000014 b 0x100003f28
│ ││ ; CODE XREF from main @ 0x100003f24(x)
│ └──> 0x100003f28 00000090 adrp x0, 0x100003000
│ │ 0x100003f2c 005c3e91 add x0, x0, 0xf97 ; 0x100003f97 ; "error secret number!\n" ; const char *format
│ │ 0x100003f30 0b000094 bl sym.imp.printf ; int printf(const char *format)
│ │ 0x100003f34 bfc31fb8 stur wzr, [x29, -4]
│ ┌──< 0x100003f38 05000014 b 0x100003f4c
│ ││ ; CODE XREF from main @ 0x100003f20(x)
│ │└─> 0x100003f3c 00000090 adrp x0, 0x100003000
│ │ 0x100003f40 00b43e91 add x0, x0, 0xfad ; 0x100003fad ; "Success!\n" ; const char *format
│ │ 0x100003f44 06000094 bl sym.imp.printf ; int printf(const char *format)
│ │┌─< 0x100003f48 01000014 b 0x100003f4c
│ ││ ; CODE XREFS from main @ 0x100003f38(x), 0x100003f48(x)
│ └└─> 0x100003f4c a0c35fb8 ldur w0, [x29, -4]
│ 0x100003f50 fd7b42a9 ldp x29, x30, [var_20h]
│ 0x100003f54 ffc30091 add sp, argv
└ 0x100003f58 c0035fd6 ret
[0x100003ed4]> s 0x100003f20
[0x100003f20]> wa tbz w8, 0, 0x100003f3c
INFO: Written 4 byte(s) (tbz w8, 0, 0x100003f3c) = wx e8000036 @ 0x100003f20
[0x100003f20]> q
run main:
➜ practice ./main
[1] 57065 killed ./main
I found many tutorials that worked in this step, but when I tried to open them with r2, I got an error. I used hopper to see that the change was successful, but I don't know why it didn't work.
