building a concrete alternative to ida 1 were sorry raxcity.com - PowerPoint PPT Presentation

Jeffrey (crowell) Crowell – Julien (jvoisin) Voisin Radare2 to the rescue! June 20, 2015 REcon 2015 – Montreal building a concrete alternative to ida

1 we’re sorry

∙ raxcity.com ∙ Shellphish ∙ Boston Key Party ∙ <redacted> ∙ dustri.org ∙ Knows some english 2 who are we? jvoisin crowell ∙ Work at Google ∙ Soon graduated

∙ ImmunityDBG ∙ WinDBG ∙ ∙ IDA Pro ∙ WineDBG ∙ Hopper ∙ OllyDBG 3 toolbag Amateur Professional ∙ IDA Pro

∙ ImmunityDBG ∙ WinDBG ∙ ∙ IDA Pro (pirated) ∙ WineDBG (pirated Windows) ∙ Hopper (probably not) ∙ OllyDBG (not maintained) 3 toolbag Amateur Professional ∙ IDA Pro ($5000)

∙ Created by Ilfak Guilfanov ∙ First DataRescue, then Hex-Rays ∙ Closed-source and expensive ∙ Lots of architectures are supported ∙ Decompilation! ∙ Awesome piece of software 4 ida pro

∙ Created by Ilfak Guilfanov ∙ First DataRescue, then Hex-Rays ∙ Closed-source and expensive ∙ Lots of architectures are supported ∙ Decompilation! ∙ Awesome piece of software 4 ida pro

∙ Created by Ilfak Guilfanov ∙ First DataRescue, then Hex-Rays ∙ Closed-source and expensive ∙ Lots of architectures are supported ∙ Decompilation! ∙ Awesome piece of software 4 ida pro

∙ Created by Ilfak Guilfanov ∙ First DataRescue, then Hex-Rays ∙ Closed-source and expensive ∙ Lots of architectures are supported ∙ Decompilation! ∙ Awesome piece of software 4 ida pro

∙ Created by Ilfak Guilfanov ∙ First DataRescue, then Hex-Rays ∙ Closed-source and expensive ∙ Lots of architectures are supported ∙ Decompilation! ∙ Awesome piece of software 4 ida pro

∙ Created by Ilfak Guilfanov ∙ First DataRescue, then Hex-Rays ∙ Closed-source and expensive ∙ Lots of architectures are supported ∙ Decompilation! ∙ Awesome piece of software 4 ida pro

radare2, cet inconnu

∙ 350k LoC under LGPL ∙ radare in 2006 ∙ forensics tool ∙ radare2 in 2009 ∙ written in pure C ∙ multi-purpose suite of tools 6 history

∙ 350k LoC under LGPL ∙ radare in 2006 ∙ forensics tool ∙ radare2 in 2009 ∙ written in pure C ∙ multi-purpose suite of tools 6 history

∙ 350k LoC under LGPL ∙ radare in 2006 ∙ forensics tool ∙ radare2 in 2009 ∙ written in pure C ∙ multi-purpose suite of tools 6 history

∙ 350k LoC under LGPL ∙ radare in 2006 ∙ forensics tool ∙ radare2 in 2009 ∙ written in pure C ∙ multi-purpose suite of tools 6 history

∙ radare in 2006 ∙ forensics tool ∙ radare2 in 2009 ∙ written in pure C ∙ multi-purpose suite of tools 6 history ∙ 350k LoC under LGPL

∙ radare in 2006 ∙ forensics tool ∙ radare2 in 2009 ∙ written in pure C ∙ multi-purpose suite of tools 6 history ∙ 350k LoC under LGPL

∙ likely packaged in your distribution ∙ install from source though ;-) ∙ more than 50 contributors for the latest release ∙ RSoC (+GSoC) 7 history

∙ likely packaged in your distribution ∙ install from source though ;-) ∙ more than 50 contributors for the latest release ∙ RSoC (+GSoC) 7 history

∙ likely packaged in your distribution ∙ install from source though ;-) ∙ more than 50 contributors for the latest release ∙ RSoC (+GSoC) 7 history

∙ likely packaged in your distribution ∙ install from source though ;-) ∙ more than 50 contributors for the latest release ∙ RSoC (+GSoC) 7 history

∙ ragg2 ∙ radiff2 ∙ rabin2 ∙ rafind2 ∙ rahash2 ∙ rarun2 ∙ rasm2 ∙ rax2 ∙ radare2 Compile programs into tiny binaries for x86-32/64 and arm. 8 r2tools

∙ ragg2 ∙ radiff2 ∙ rabin2 ∙ rafind2 ∙ rahash2 ∙ rarun2 ∙ rasm2 ∙ rax2 ∙ radare2 Binary diffing 8 r2tools

∙ ragg2 ∙ radiff2 ∙ rabin2 ∙ rafind2 ∙ rahash2 ∙ rarun2 ∙ rasm2 ∙ rax2 ∙ radare2 8 r2tools Binary program info extractor (think readelf )

∙ ragg2 ∙ radiff2 ∙ rabin2 ∙ rafind2 ∙ rahash2 ∙ rarun2 ∙ rasm2 ∙ rax2 ∙ radare2 Search for byte patterns in files 8 r2tools

∙ ragg2 ∙ radiff2 ∙ rabin2 ∙ rafind2 ∙ rahash2 ∙ rarun2 ∙ rasm2 ∙ rax2 ∙ radare2 Block based hashing utility 8 r2tools

∙ ragg2 ∙ radiff2 ∙ rabin2 ∙ rafind2 ∙ rahash2 ∙ rarun2 ∙ rasm2 ∙ rax2 ∙ radare2 Run programs in exotic environments 8 r2tools

∙ ragg2 ∙ radiff2 ∙ rabin2 ∙ rafind2 ∙ rahash2 ∙ rarun2 ∙ rasm2 ∙ rax2 ∙ radare2 Assembler/disassembler 8 r2tools

∙ ragg2 ∙ radiff2 ∙ rabin2 ∙ rafind2 ∙ rahash2 ∙ rarun2 ∙ rasm2 ∙ rax2 ∙ radare2 Base converter 8 r2tools

∙ ragg2 ∙ radiff2 ∙ rabin2 ∙ rafind2 ∙ rahash2 ∙ rarun2 ∙ rasm2 ∙ rax2 ∙ radare2 Combine everything together 8 r2tools

9 ∙ … ∙ GB/GBA/DS ∙ BIOS/TE ∙ DEX/JAVA ∙ Fatmach0/Mach0 ∙ ELF, ELF64 ∙ MZ/PE+/PE/COFF ∙ BIOS ∙ QNX ∙ Plan9 ∙ Web browser ∙ Smartwatch ∙ Android and iOS ∙ OSX ∙ *BSD ∙ GNU/Linux ∙ Windows ∙ XBOX platforms Runs on Handles

∙ 8051 ∙ arc ∙ arm ∙ avr ∙ brainfuck ∙ cr16 ∙ csr ∙ dalvik ∙ dcpu16 ∙ ebc ∙ gb ∙ h8300 10 architectures

∙ i4004 ∙ i8080 ∙ java ∙ LH5801 ∙ m68k ∙ malbolge ∙ mips ∙ msil ∙ msp430 ∙ nios2 ∙ powerpc ∙ rar 10 architectures

10 ∙ x86 ∙ 6502 ∙ psosvm ∙ snes ∙ propeller ∙ z80 ∙ xcore ∙ whitespace ∙ ART ∙ v850 ∙ tms320 ∙ sysz ∙ spc700 ∙ sparc ∙ sh architectures

r2 internals

∙ At it’s heart, a library. ∙ Swig/Valabind ∙ Build your own tools on top of radare2 12 r2 is a library

13 Bindings are boring, let’s call r2 instead! r2 is a library, with r2pipe included

3rd party (or 1st party) plugins ∙ … 14 r2 is pluggable ∙ r_asm , assembler and disassembler ∙ r_anal , code analysis (opcode, type, esil) ∙ r_reg , registers ∙ r_syscall , system calls ∙ r_debug , debugger ∙ r_io , io layer ∙ r_search , search engine

feature comparison

∙ R2 is like vim ∙ Just append ? everywhere 16 ida has a book, r2 is self-documented (and also has a book too) ∙ Combine intuitives commands

∙ Python ∙ NodeJS ∙ C ∙ Lua ∙ Lisp ∙ Vala ∙ Ruby ∙ Go ∙ Rust ∙ Perl ∙ OCaml ∙ … 17 ida has plugins, r2 has more bindings

∙ Debugger-compliant ∙ Minimap ∙ Interactive 18 ida has some graphs, r2 does too (but in ascii)

∙ name functions ∙ define code/data ∙ leave comments ∙ name stack variables ∙ mark structures ∙ use types ∙ define/modify functions 19 ida is clever but also interactive, so is r2 ∙ mark flags

20 ida has a nice gui, so does, well, err, mh, …

It’s not all that scary! ∙ Familiar vim keybindings. ∙ Communicate over r2pipe. 21 actually… ∙ Visual Mode - friendly enough? ∙ Web UI - The future of collaborative reversing!

∙ Ncurses-like ∙ Static ∙ Dynamic ∙ Analysis ∙ Try it, really. 22 ida has an old-school tui mode, r2 has a better one.

23 ida has no web-ui, r2 does.

∙ Classic features ∙ Visual mode too ∙ Several backends ∙ Tracing ∙ Remote 24 ida has a debugger, so does r2

∙ Functions detection ∙ Local var detection ∙ FLIRT integration ∙ (X)REF ∙ DWARF and PDB 25 ida has kick-ass analysis, r2 has some too ∙ zignatures

∙ ESIL ∙ RPN-ish ∙ Documented ∙ Emulation ∙ Decompilation ∙ Analysis 26 ida some internal il, r2 has an open one

∙ Regexp ROP hunter ∙ Mitigations detection ∙ Emulation ∙ Patterns ∙ Environment control 27 ida has plugins for pwnage, r2 put this in core

28 ida has plugins for bindiffing, r2 put this in core

summary

∙ GSoC ∙ Stabilization ∙ A fresh release ∙ Second edition of our RSoC ∙ ~1000 LoC modified per week 30 and now?

∙ Super-steep learning curve ∙ A lot of features ∙ Fast-moving target ∙ IDA is friendlier 31 current drawbacks

∙ Free-software ∙ Exotic arch support ∙ Active development ∙ A lot of features ∙ More and more users 32 current ��������

33 ∙ Magic lantern Do you? We do! ∙ … ∙ OverTheWire ∙ io from smashthestack ∙ Cool wargames ∙ … ∙ Coreboot ∙ Some top-notch ctf teams ∙ Some popular RE projects ∙ … ∙ IOActive ∙ AlienVault ∙ Anti-malware companies ∙ … ∙ Dragon Sector ∙ Shellphish who uses r2 currently?

33 ∙ Magic lantern Do you? We do! ∙ … ∙ OverTheWire ∙ io from smashthestack ∙ Cool wargames ∙ … ∙ Coreboot ∙ Some top-notch ctf teams ∙ Some popular RE projects ∙ … ∙ IOActive ∙ AlienVault ∙ Anti-malware companies ∙ … ∙ Dragon Sector ∙ Shellphish who uses r2 currently?

∙ Complete-emulation ∙ Decompilation ∙ A complete GUI ∙ What do you want? 34 and tomorrow?

Monoculture is bad. Question IDA supremacy 1 . 1 And don’t pirate it! 35 conclusion