mac m1 cannot open a file after it is modified using radare2

112 Views Asked by At

I'm learning to use radare2 and I'm following the same process as other blogs but I'm having problems

The code is as follows:

#include <stdio.h>
int main()
{
  int secret = 0;
  printf("Please input the secret number:");
  scanf("%d",&secret);
  if(secret != 123)
  {
    printf("error secret number!\n");
    return 0;
  }
  printf("Success!\n");
}

compile and run:

➜  practice gcc main.c -o main
➜  practice ./main
Please input the secret number:12
error secret number!
➜  practice ./main
Please input the secret number:123
Success!
➜  practice

I want to change my judgment with radare2

➜  practice r2 -A -w main
WARN: Relocs has not been applied. Please use `-e bin.relocs.apply=true` or `-e bin.cache=true` next time
INFO: Analyze all flags starting with sym. and entry0 (aa)
INFO: Analyze imports (af@@@i)
INFO: Analyze entrypoint (af@ entry0)
INFO: Analyze symbols (af@@@s)
INFO: Recovering variables
INFO: Analyze all functions arguments/locals (afva@@@F)
INFO: Analyze function calls (aac)
INFO: Analyze len bytes of instructions for references (aar)
INFO: Check for objc references (aao)
INFO: Finding and parsing C++ vtables (avrr)
INFO: Analyzing methods
INFO: Finding function preludes (aap)
INFO: Finding xrefs in noncode section (e anal.in=io.maps.x)
INFO: Emulate functions to find computed references (aaef)
INFO: Recovering local variables (afva)
INFO: Type matching analysis for all functions (aaft)
INFO: Propagate noreturn information (aanr)
INFO: Use -AA or aaaa to perform additional experimental analysis
[0x100003ed4]> iz
[Strings]
nth paddr      vaddr       len size section            type  string
―――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――
0   0x00003f74 0x100003f74 31  32   2.__TEXT.__cstring ascii Please input the secret number:
1   0x00003f97 0x100003f97 21  22   2.__TEXT.__cstring ascii error secret number!\n
2   0x00003fad 0x100003fad 9   10   2.__TEXT.__cstring ascii Success!\n
[0x100003ed4]> pdf
            ;-- section.0.__TEXT.__text:
            ;-- entry0:
            ;-- _main:
            ;-- func.100003ed4:
            ;-- pc:
            ; NULL XREF from aav.0x100000020 @ +0xb0(r)
┌ 136: int main (int argc, int64_t argv);
│           ; arg int argc @ x0
│           ; arg int64_t argv @ sp+0x60
│           ; var int64_t var_0h_2 @ sp+0x0
│           ; var int64_t var_10h @ sp+0x10
│           ; var int64_t var_8h @ sp+0x18
│           ; var int64_t var_0h @ sp+0x1c
│           ; var int64_t var_20h @ sp+0x20
│           ; var int64_t var_20h_2 @ sp+0x28
│           0x100003ed4      ffc300d1       sub sp, sp, 0x30           ; [00] -r-x section size 136 named 0.__TEXT.__text
│           0x100003ed8      fd7b02a9       stp x29, x30, [var_20h]
│           0x100003edc      fd830091       add x29, var_20h
│           0x100003ee0      bfc31fb8       stur wzr, [x29, -4]        ; argc
│           0x100003ee4      a82300d1       sub x8, x29, 8
│           0x100003ee8      e80b00f9       str x8, [var_10h]
│           0x100003eec      bf831fb8       stur wzr, [x29, -8]        ; argc
│           0x100003ef0      00000090       adrp x0, 0x100003000
│           0x100003ef4      00d03d91       add x0, x0, 0xf74          ; 0x100003f74 ; "Please input the secret number:" ; const char *format
│           0x100003ef8      19000094       bl sym.imp.printf          ; int printf(const char *format)
│           0x100003efc      e80b40f9       ldr x8, [var_10h]          ; 5
│           0x100003f00      e9030091       mov x9, sp
│           0x100003f04      280100f9       str x8, [x9]
│           0x100003f08      00000090       adrp x0, 0x100003000
│           0x100003f0c      00503e91       add x0, x0, 0xf94          ; const char *format
│           0x100003f10      16000094       bl sym.imp.scanf           ; int scanf(const char *format)
│           0x100003f14      a8835fb8       ldur w8, [x29, -8]
│           0x100003f18      08ed0171       subs w8, w8, 0x7b
│           0x100003f1c      e8179f1a       cset w8, eq
│       ┌─< 0x100003f20      e8000037       tbnz w8, 0, 0x100003f3c
│      ┌──< 0x100003f24      01000014       b 0x100003f28
│      ││   ; CODE XREF from main @ 0x100003f24(x)
│      └──> 0x100003f28      00000090       adrp x0, 0x100003000
│       │   0x100003f2c      005c3e91       add x0, x0, 0xf97          ; 0x100003f97 ; "error secret number!\n" ; const char *format
│       │   0x100003f30      0b000094       bl sym.imp.printf          ; int printf(const char *format)
│       │   0x100003f34      bfc31fb8       stur wzr, [x29, -4]
│      ┌──< 0x100003f38      05000014       b 0x100003f4c
│      ││   ; CODE XREF from main @ 0x100003f20(x)
│      │└─> 0x100003f3c      00000090       adrp x0, 0x100003000
│      │    0x100003f40      00b43e91       add x0, x0, 0xfad          ; 0x100003fad ; "Success!\n" ; const char *format
│      │    0x100003f44      06000094       bl sym.imp.printf          ; int printf(const char *format)
│      │┌─< 0x100003f48      01000014       b 0x100003f4c
│      ││   ; CODE XREFS from main @ 0x100003f38(x), 0x100003f48(x)
│      └└─> 0x100003f4c      a0c35fb8       ldur w0, [x29, -4]
│           0x100003f50      fd7b42a9       ldp x29, x30, [var_20h]
│           0x100003f54      ffc30091       add sp, argv
└           0x100003f58      c0035fd6       ret
[0x100003ed4]> s 0x100003f20
[0x100003f20]> wa tbz w8, 0, 0x100003f3c
INFO: Written 4 byte(s) (tbz w8, 0, 0x100003f3c) = wx e8000036 @ 0x100003f20
[0x100003f20]> q

run main:

➜  practice ./main
[1]    57065 killed     ./main

I found many tutorials that worked in this step, but when I tried to open them with r2, I got an error. I used hopper to see that the change was successful, but I don't know why it didn't work. enter image description here

0

There are 0 best solutions below