The Official Radare2 Book — страница 33 из 64

Signatures configuration stored in the zign. config vars' namespace:

[0x000051c0]> e? zign.

zign.autoload: Autoload all zignatures located in ~/.local/share/radare2/zigns

zign.bytes: Use bytes patterns for matching

zign.diff.bthresh: Threshold for diffing zign bytes [0, 1] (see zc?)

zign.diff.gthresh: Threshold for diffing zign graphs [0, 1] (see zc?)

zign.graph: Use graph metrics for matching

zign.hash: Use Hash for matching

zign.maxsz: Maximum zignature length

zign.mincc: Minimum cyclomatic complexity for matching

zign.minsz: Minimum zignature length for matching

zign.offset: Use original offset for matching

zign.prefix: Default prefix for zignatures matches

zign.refs: Use references for matching

zign.threshold: Minimum similarity required for inclusion in zb output

zign.types: Use types for matching

[0x000051c0]>

Finding Best Matcheszb

Often you know the signature should exist somewhere in a binary but z/ and z. still fail. This is often due to very minor differences between the signature and the function. Maybe the compiler switched two instructions, or your signature is not for the correct function version. In these situations the zb commands can still help point you in the right direction by listing near matches.

[0x000040a0]> zb?

Usage: zb[r?] [args] # search for closest matching signatures

| zb [n] find n closest matching zignatures to function at current offset

| zbr zigname [n] search for n most similar functions to zigname

The zb (zign best) command will show the top 5 closest signatures to a function. Each will contain a score between 1.0 and 0.0.

[0x0041e390]> s sym.fclose

[0x0040fc10]> zb

0.96032 0.92400 B 0.99664 G sym.fclose

0.65971 0.35600 B 0.96342 G sym._nl_expand_alias

0.65770 0.37800 B 0.93740 G sym.fdopen

0.65112 0.35000 B 0.95225 G sym.__run_exit_handlers

0.62532 0.34800 B 0.90264 G sym.__cxa_finalize

In the above example, zb correctly associated the sym.fclose signature to the current function. The z/ and z. command would have failed to match here since both the Byte and Graph scores are less then 1.0. A 30% separation between the first and second place results is also a good indication of a correct match.

The zbr (zign best reverse) accepts a zignature name and attempts to find the closet matching functions. Use an analysis command, like aa to find functions first.

[0x00401b20]> aa

[x] Analyze all flags starting with sym. and entry0 (aa)

[0x00401b20]> zo ./libc.sdb

[0x00401b20]> zbr sym.__libc_malloc 10

0.94873 0.89800 B 0.99946 G sym.malloc

0.65245 0.40600 B 0.89891 G sym._mid_memalign

0.59470 0.38600 B 0.80341 G sym._IO_flush_all_lockp

0.59200 0.28200 B 0.90201 G sym._IO_file_underflow

0.57802 0.30400 B 0.85204 G sym.__libc_realloc

0.57094 0.35200 B 0.78988 G sym.__calloc

0.56785 0.34000 B 0.79570 G sym._IO_un_link.part.0

0.56358 0.36200 B 0.76516 G sym._IO_cleanup

0.56064 0.26000 B 0.86127 G sym.intel_check_word.constprop.0

0.55726 0.28400 B 0.83051 G sym.linear_search_fdes

Graph commands

When analyzing data it is usually handy to have different ways to represent it in order to get new perspectives to allow the analyst to understand how different parts of the program interact.

Representing basic block edges, function calls, string references as graphs show a very clear view of this information.

Radare2 supports various types of graph available through commands starting with ag:

[0x00005000]> ag?

|Usage: ag [addr]

| Graph commands:

| aga[format] Data references graph

| agA[format] Global data references graph

| agc[format] Function callgraph

| agC[format] Global callgraph

| agd[format] [fcn addr] Diff graph

| agf[format] Basic blocks function graph

| agi[format] Imports graph

| agr[format] References graph

| agR[format] Global references graph

| agx[format] Cross references graph

| agg[format] Custom graph

| ag- Clear the custom graph

| agn[?] title body Add a node to the custom graph

| age[?] title1 title2 Add an edge to the custom graph

Output formats:

| Ascii art

| * r2 commands

| d Graphviz dot

| g Graph Modelling Language (gml)

| j json ('J' for formatted disassembly)

| k SDB key-value

| t Tiny ascii art

| v Interactive ascii art

| w [path] Write to path or display graph image (see graph.gv.format and graph.web)

The structure of the commands is as follows: ag

.

For example, agid displays the imports graph in dot format, while aggj outputs the custom graph in JSON format.

Here's a short description for every output format available:

Ascii Art ** (e.g.agf)

Displays the graph directly to stdout using ASCII art to represent blocks and edges.

Warning: displaying large graphs directly to stdout might prove to be computationally expensive and will make r2 not responsive for some time. In case of a doubt, prefer using the interactive view (explained below).

Interactive Ascii Art (e.g.agfv)

Displays the ASCII graph in an interactive view similar to VV which allows to move the screen, zoom in / zoom out, ...

Tiny Ascii Art (e.g.agft)

Displays the ASCII graph directly to stdout in tiny mode (which is the same as reaching the maximum zoom out level in the interactive view).

Graphviz dot (e.g.agfd)

Prints the dot source code representing the graph, which can be interpreted by programs such as graphviz or online viewers like this

JSON (e.g.agfj)

Prints a JSON string representing the graph.

   • In case of the f format (basic blocks of function), it will have detailed information about the function and will also contain the disassembly of the function (use J format for the formatted disassembly.

   • In all other cases, it will only have basic information about the nodes of the graph (id, title, body, and edges).

Graph Modelling Language (e.g.agfg)

Prints the GML source code representing the graph, which can be interpreted by programs such as yEd

SDB key-value (e.g.agfk)

Prints key-value strings representing the graph that was stored by sdb (radare2's string database).

R2 custom graph commands (e.g.agf*)

Prints r2 commands that would recreate the desired graph. The commands to construct the graph are agn [title] [body] to add a node and age [title1] [title2] to add an edge. The [body] field can be expressed in base64 to include special formatting (such as newlines).

To easily execute the printed commands, it is possible to prepend a dot to the command (.agf*).

Web / image (e.g.agfw)

Radare2 will convert the graph to dot format, use the dot program to convert it to a .gif image and then try to find an already installed viewer on your system (xdg-open, open, ...) and display the graph there.

The extension of the output image can be set with the graph.extension config variable. Available extensions are png, jpg, gif, pdf, ps.

Note: for particularly large graphs, the most recommended extension is svg as it will produce images of much smaller size

If graph.web config variable is enabled, radare2 will try to display the graph using the browser (this feature is experimental and unfinished, and disabled by default.)

Scripting