search

nowsecure / r2frida

Radare2 and Frida better together.
MIT License
1.18k stars 121 forks source link

Static analysis apparently fails when running r2frida on Linux #521

Closed suidpit closed 8 months ago

suidpit commented 1 year ago

I'm trying to use r2frida to perform both static/dynamic analysis on a target process on Linux. However, all the commands that usually work with "plain" r2 seem to fail when using frida.

Example: image

It really seems I am making some mistakes with the API, but it seems the session is borked for some reason. r2 version: 5.8.8-667-g0ae85c519b r2frida latest.

nitanmarcel commented 11 months ago

r2frida is mostly used for dynamic analysis, what you can do is do the static analysis in r2 and seek to the symbol in r2frida. List your libraries and get the base offset of the library you want, and seek to the symbol with `s base_offset + offset.

then you can do af at the offset to reveal the method

as0ler commented 10 months ago

The latest build of radare2 and r2frida is running .:init by default which imports some dynamic information to the r2 session.

However, if you want to import symbols, you can run .:is*.

trufae commented 8 months ago

You may want to try it again, all those symbol and basic autoanalysis is done now by default, so i think the experience has improved since then. Closing the ticket but feel free to share some comments at any time