Skip to content

Commit

Permalink
Plugins chapter fixes
Browse files Browse the repository at this point in the history
  • Loading branch information
XVilka committed Jul 30, 2018
1 parent 5712cc2 commit b7dc9ef
Show file tree
Hide file tree
Showing 8 changed files with 211 additions and 149 deletions.
6 changes: 3 additions & 3 deletions SUMMARY.md
Original file line number Diff line number Diff line change
Expand Up @@ -93,14 +93,14 @@
* [Rahash2](rahash2/intro.md)
* [Rahash Tool](rahash2/rahash_tool.md)
* [Plugins](plugins/intro.md)
* [Issues](plugins/debug.md)
* [Testing](plugins/testing.md)
* [Development](plugins/debug.md)
* [IO plugins](plugins/ioplugins.md)
* [Asm plugins](plugins/dev-asm.md)
* [Analysis plugins](plugins/dev-anal.md)
* [Bin plugins](plugins/dev-bin.md)
* [Other plugins](plugins/dev-other.md)
* [Python plugins](plugins/python.md)
* [Debugging](plugins/debug.md)
* [Testing](plugins/testing.md)
* [Architectures](arch/intro.md)
* [8051](arch/8051.md)
* [Crackmes](crackmes/intro.md)
Expand Down
1 change: 0 additions & 1 deletion plugins/debug.md
Original file line number Diff line number Diff line change
@@ -1,4 +1,3 @@

# Debugging

It is common to have an issues when you write a plugin, especially if you do this for the first
Expand Down
2 changes: 0 additions & 2 deletions plugins/dev-asm.md
Original file line number Diff line number Diff line change
Expand Up @@ -17,6 +17,4 @@ https://github.com/radare/radare2/commit/933dc0ef6ddfe44c88bbb261165bf8f8b531476
Implement RAnal plugin:
https://github.com/radare/radare2/commit/ad430f0d52fbe933e0830c49ee607e9b0e4ac8f2

## Write a disassembler plugin with another programming language


69 changes: 35 additions & 34 deletions plugins/intro.md
Original file line number Diff line number Diff line change
Expand Up @@ -7,49 +7,50 @@ support for different targets.
This section aims to explain what are the plugins, how to write them and use them

## Types of plugins

$ ls libr/*/p | grep : | awk -F / '{ print $2 }'
anal # analysis plugins
asm # assembler/disassembler plugins
bin # binary format parsing plugins
bp # breakpoint plugins
core # core plugins (implement new commands)
crypto # encrypt/decrypt/hash/...
debug # debugger backends
egg # shellcode encoders, etc
fs # filesystems and partition tables
io # io plugins
lang # embedded scripting languages
parse # disassembler parsing plugins
reg # arch register logic
```
$ ls libr/*/p | grep : | awk -F / '{ print $2 }'
anal # analysis plugins
asm # assembler/disassembler plugins
bin # binary format parsing plugins
bp # breakpoint plugins
core # core plugins (implement new commands)
crypto # encrypt/decrypt/hash/...
debug # debugger backends
egg # shellcode encoders, etc
fs # filesystems and partition tables
io # io plugins
lang # embedded scripting languages
parse # disassembler parsing plugins
reg # arch register logic
```

## Listing plugins

Some r2 tools have the `-L` flag to list all the plugins associated to the
functionality.

rasm2 -L # list asm plugins
r2 -L # list io plugins
rabin2 -L # list bin plugins
rahash2 -L # list hash/crypto/encoding plugins

```
rasm2 -L # list asm plugins
r2 -L # list io plugins
rabin2 -L # list bin plugins
rahash2 -L # list hash/crypto/encoding plugins
```
There are more plugins in r2land, we can list them from inside r2, and this is
done by using the `L` suffix.

Those are some of the commands:

L # list core plugins
iL # list bin plugins
dL # list debug plugins
mL # list fs plugins
ph # print support hash algoriths

```
L # list core plugins
iL # list bin plugins
dL # list debug plugins
mL # list fs plugins
ph # print support hash algoriths
```
But also using the `?` value in the associated eval vars.

e asm.arch=? # list assembler/disassembler plugins
e anal.arch=? # list analysis plugins

```
e asm.arch=? # list assembler/disassembler plugins
e anal.arch=? # list analysis plugins
```
## Notes

Note some of those inconsistencies must be discussed and reviewed in order
to make that easier to remember and more generic.
Note there are some inconsistencies that most likely will be fixed in the future radare2 versions.

79 changes: 46 additions & 33 deletions plugins/ioplugins.md
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
## IO plugins
# IO plugins

All access to files, network, debugger, etc. is wrapped by an IO abstraction layer that allows radare to treat all data as if it were just a file.

Expand All @@ -7,38 +7,51 @@ IO plugins are the ones used to wrap the open, read, write and 'system' on virtu
So, when radare reads a block of bytes, it is the task of an IO plugin to get these bytes from any place and put them into internal buffer. An IO plugin is chosen by a file's URI to be opened. Some examples:

* Debugging URIs

$ r2 dbg:///bin/ls<br />
$ r2 pid://1927

```
$ r2 dbg:///bin/ls<br />
$ r2 pid://1927
```
* Remote sessions

$ r2 rap://:1234<br />
$ r2 rap://<host>:1234//bin/ls

```
$ r2 rap://:1234<br />
$ r2 rap://<host>:1234//bin/ls
```
* Virtual buffers

$ r2 malloc://512<br />
shortcut for
$ r2 -

```
$ r2 malloc://512<br />
shortcut for
$ r2 -
```
You can get a list of the radare IO plugins by typing `radare2 -L`:

$ r2 -L
rw_ zip Open zip files apk://foo.apk//MANIFEST or zip://foo.apk//theclass/fun.class, show files with: zip://foo.apk/, open all files with zipall:// (BSD)
rwd windbg Attach to a KD debugger (LGPL3)
rw_ sparse sparse buffer allocation (sparse://1024 sparse://) (LGPL3)
rw_ shm shared memory resources (shm://key) (LGPL3)
rw_ self read memory from myself using 'self://' (LGPL3)
rw_ rap radare network protocol (rap://:port rap://host:port/file) (LGPL3)
rwd ptrace ptrace and /proc/pid/mem (if available) io (LGPL3)
rw_ procpid /proc/pid/mem io (LGPL3)
rw_ mmap open file using mmap:// (LGPL3)
rw_ malloc memory allocation (malloc://1024 hex://cd8090) (LGPL3)
r__ mach mach debug io (unsupported in this platform) (LGPL)
rw_ ihex Intel HEX file (ihex://eeproms.hex) (LGPL)
rw_ http http get (http://radare.org/) (LGPL3)
rw_ gzip read/write gzipped files (LGPL3)
rwd gdb Attach to gdbserver, 'qemu -s', gdb://localhost:1234 (LGPL3)
r_d debug Debug a program or pid. dbg:///bin/ls, dbg://1388 (LGPL3)
rw_ bfdbg BrainFuck Debugger (bfdbg://path/to/file) (LGPL3)
```
$ r2 -L
rw_ ar Open ar/lib files [ar|lib]://[file//path] (LGPL3)
rw_ bfdbg BrainFuck Debugger (bfdbg://path/to/file) (LGPL3)
rwd bochs Attach to a BOCHS debugger (LGPL3)
r_d debug Native debugger (dbg:///bin/ls dbg://1388 pidof:// waitfor://) (LGPL3) v0.2.0 pancake
rw_ default open local files using def_mmap:// (LGPL3)
rwd gdb Attach to gdbserver, 'qemu -s', gdb://localhost:1234 (LGPL3)
rw_ gprobe open gprobe connection using gprobe:// (LGPL3)
rw_ gzip read/write gzipped files (LGPL3)
rw_ http http get (http://rada.re/) (LGPL3)
rw_ ihex Intel HEX file (ihex://eeproms.hex) (LGPL)
r__ mach mach debug io (unsupported in this platform) (LGPL)
rw_ malloc memory allocation (malloc://1024 hex://cd8090) (LGPL3)
rw_ mmap open file using mmap:// (LGPL3)
rw_ null null-plugin (null://23) (LGPL3)
rw_ procpid /proc/pid/mem io (LGPL3)
rwd ptrace ptrace and /proc/pid/mem (if available) io (LGPL3)
rwd qnx Attach to QNX pdebug instance, qnx://host:1234 (LGPL3)
rw_ r2k kernel access API io (r2k://) (LGPL3)
rw_ r2pipe r2pipe io plugin (MIT)
rw_ r2web r2web io client (r2web://cloud.rada.re/cmd/) (LGPL3)
rw_ rap radare network protocol (rap://:port rap://host:port/file) (LGPL3)
rw_ rbuf RBuffer IO plugin: rbuf:// (LGPL)
rw_ self read memory from myself using 'self://' (LGPL3)
rw_ shm shared memory resources (shm://key) (LGPL3)
rw_ sparse sparse buffer allocation (sparse://1024 sparse://) (LGPL3)
rw_ tcp load files via TCP (listen or connect) (LGPL3)
rwd windbg Attach to a KD debugger (windbg://socket) (LGPL3)
rwd winedbg Wine-dbg io and debug.io plugin for r2 (MIT)
rw_ zip Open zip files [apk|ipa|zip|zipall]://[file//path] (BSD)
```
2 changes: 1 addition & 1 deletion plugins/python.md
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
### Python
# Python plugins

At first, to be able to write a plugins in Python for radare2 you need to install
r2lang plugin. If you're going to use Python 2, then use `r2pm -i lang-python2`, otherwise (and recommended) - install the Python 3 version: `r2pm -i lang-python3`.
Expand Down
91 changes: 57 additions & 34 deletions rahash2/intro.md
Original file line number Diff line number Diff line change
@@ -1,40 +1,63 @@
# Obtaining Hashes within Radare2 Session

To calculate a checksum of current block when running radare2, use the 'ph' command. Pass an algorithm name to it as a parameter. An example session:

$ radare2 /bin/ls
[0x08049790]> bf entry0
[0x08049790]> ph md5
d2994c75adaa58392f953a448de5fba7

To calculate a checksum of current block when running radare2, use the `ph` command. Pass an algorithm name to it as a parameter. An example session:
```
$ radare2 /bin/ls
[0x08049790]> bf entry0
[0x08049790]> ph md5
d2994c75adaa58392f953a448de5fba7
```
You can use all hashing algorithms supported by `rahash2`:

[0x00404890]> ph?
md5
sha1
sha256
sha384
sha512
crc16
crc32
md4
xor
xorpair
parity
entropy
hamdist
pcprint
mod255
xxhash
adler32
luhn
```
[0x00404890]> ph?
[0x00000000]> ph?
md5
sha1
sha256
sha384
sha512
md4
xor
xorpair
parity
entropy
hamdist
pcprint
mod255
xxhash
adler32
luhn
crc8smbus
crc15can
crc16
crc16hdlc
crc16usb
crc16citt
crc24
crc32
crc32c
crc32ecma267
crc32bzip2
crc32d
crc32mpeg2
crc32posix
crc32q
crc32jamcrc
crc32xfer
crc64
crc64ecma
crc64we
crc64xz
crc64iso
```

The `ph` command accepts an optional numeric argument to specify length of byte range to be hashed, instead of default block size. For example:
```
[0x08049A80]> ph md5 32
9b9012b00ef7a94b5824105b7aaad83b
[0x08049A80]> ph md5 64
a71b087d8166c99869c9781e2edcf183
[0x08049A80]> ph md5 1024
a933cc94cd705f09a41ecc80c0041def
```

[0x08049A80]> ph md5 32
9b9012b00ef7a94b5824105b7aaad83b
[0x08049A80]> ph md5 64
a71b087d8166c99869c9781e2edcf183
[0x08049A80]> ph md5 1024
a933cc94cd705f09a41ecc80c0041def
[0x08049A80]>
Loading

0 comments on commit b7dc9ef

Please sign in to comment.