The Official Rizin Book

Description

This is a book about Rizin reverse engineering framework and it's originally based on the radare2 book Check the Github site to add new contents or fix typos: Github: https://github.com/rizinorg/book Online: https://book.rizin.re/ The Official Rizin Book Introduction Offline The Framework rizin rz-bin rz-asm Examples rz-hash Examples rz-diff rz-find rz-egg Examples rz-run Sample rz-run script Connecting a Program with a Socket Debugging a Program Redirecting the stdio into Another Terminal rz-ax Examples Downloading rizin Compilation and Portability Docker Windows Prerequisites Step-by-Step Install Visual Studio 2015 (or higher) Install Python 3 and Meson/Ninja via Conda Set Up Conda: Create a Python Environment for Rizin Install Meson + Ninja Install Git for Windows Get Rizin Code Compile Rizin Code Check That Rizin Runs From All Locations Android Prerequisites Step-by-step Download and extract the Android NDK Meson Create a cross-file for meson Compile with meson + ninja Move files to your android device and enjoy Basic Rizin Usage Command-line Options Common usage patterns Command Format Expressions Basic Debugger Session Contributing Rizin Book Configuration Colors Themes Configuration Variables Assembly Configuration asm.arch: string asm.bits: int asm.bytes: bool asm.cpu: string asm.platform: string asm.flags: bool asm.fcn.size: bool asm.lines.call: bool asm.lines.out: bool asm.offset: bool asm.os: string asm.pseudo: bool asm.sub.jmp: bool asm.sub.reg: bool asm.sub.rel: bool asm.sub.section: bool asm.sub.varonly: bool asm.syntax: string asm.tabs: int asm.tabs.once: bool asm.trace: bool Debug Configuration dbg.follow.child: bool Screen Configuration scr.color: int scr.seek: string scr.scrollbar: bool scr.utf8: bool scr.utf8.curvy: bool scr.wheel: bool General Configuration cfg.bigendian: bool cfg.fortunes: bool cfg.fortunes.file: string cfg.newtab: bool Stack Configuration stack.size: int Command Configuration cmd.repeat: bool Files RC Files System Your Home Target file Basic Commands Seeking Open file Seeking at any position Block Size Sections Mapping Files Print Modes Hexadecimal View Show Hexadecimal Words Dump (32 bits) 8 bits Hexpair List of Bytes Show Hexadecimal Quad-words Dump (64 bits) Date/Time Formats Basic Types High-level Languages Views Strings Print Memory Contents Disassembly Selecting Target Architecture Configuring the Disassembler Disassembly Syntax Print gadgets Flags Local flags Flag Zones Writing Data Write Over Zoom Yank/Paste Comparing Bytes SDB Usage example So what ? More Examples Dietline Autocompletion Emacs (default) mode Moving Deleting Killing and Yanking History Vi mode Entering command modes Moving Deleting and Yanking Visual Mode Navigation print modes aka panels Getting Help Visual Disassembly Navigation d as define Usage of the Cursor for Inserting/Patching... XREF Function Argument display Add a comment Type other commands Search The HUDS The "UserFriendly HUD" The "flag/comment/functions/.. HUD" Tweaking the Disassembly Visual Configuration Editor Examples asm.arch: Change Architecture && asm.bits: Word size in bits at assembler asm.pseudo: Enable pseudo syntax asm.syntax: Select assembly syntax (intel, att, masm...) asm.describe: Show opcode description Visual Assembler Visual Configuration Editor Visual Panels Concept Overview Commands Basic Usage Split Screen Window Mode Commands Edit Values Tabs Saving layouts Searching for Bytes Basic Search Configuring Search Options Pattern Matching Search Search Automation Searching Backwards Assembler Search Searching for AES Keys Disassembling Adding Metadata to Disassembly ESIL Using ESIL ESIL Commands ESIL Instruction Set ESIL Flags Syntax and Commands Arguments Order for Non-associative Operations Special Instructions Quick Analysis CPU Flags Variables Bit Arrays Arithmetic Bit Arithmetic Floating Point Unit Support Handling x86 REP Prefix in ESIL Usage Example: Unimplemented/Unhandled Instructions ESIL Disassembly Example: Introspection API HOOKS Data and Code Analysis Code Analysis Analyze functions Handcraft function Recursive analysis Configuration Control flow configuration Reference control Analysis ranges Jump tables Platform specific controls Visuals Analysis hints Managing variables Type inference Types Internal representation Structures Unions Function prototypes Calling Conventions Virtual Tables Syscalls Emulation Emulation in analysis loop Symbols Signatures Finding Best Matches zb Graph commands Ascii Art ** (e.g. agf) Interactive Ascii Art (e.g. agfv) Tiny Ascii Art (e.g. agft) Graphviz dot (e.g. agfd) JSON (e.g. agfj) Graph Modelling Language (e.g. agfg) SDB key-value (e.g. agfk) R2 custom graph commands (e.g. agf*) Web / image (e.g. agfw) CPU and platform profiles The motivation How it works CPU profiles Adding CPU profiles Platform profiles Adding platform profiles Scripting Loops Macros Aliases Rz-pipe Examples Python Haskell OCaml Rust Ruby Debugger Getting Started Small session in rizin debugger Migration from ida, GDB or WinDBG How to run the program using the debugger How do I attach/detach to running process ? (gdb -p) How to set args/environment variable/load a specific libraries for the debugging session of rizin How to script rizin ? How to list Source code as in gdb list ? shortcuts Equivalent of "set-follow-fork-mode" gdb command Common features Registers Memory Maps Heap Files Reverse Debugging Windows Messages macOS/iOS Sign rizin binary Debugging on MacOS over SSH Remote Access Capabilities Debugging with gdbserver WinDBG Kernel-mode Debugging (KD) Setting Up KD on Windows Serial Port Network Connecting to KD interface on rizin Serial Port Network Using KD WinDBG Backend for Windows (DbgEng) Using the plugin Tools Rz-ax Rz-find Rz-run Rz-bin — Show Properties of a Binary File Properties Identification Code Entrypoints Imports Exports Symbols (Exports) List Libraries Strings Program Sections Rz-diff Rz-Diff (binary and text diffing utility) Distance Myers algorithm: Levenshtein distance: Hexadecimal Diffing: File Type Based Diffing Diffing ASCII-text files: Diffing functions in binaries: Diffing classes in binaries: Commands Diffing entries in binaries Diffing fields in binaries: Diffing sections in binaries: Diffing strings in binaries: Diffing symbols in binaries: Rz-asm Assembler Visual mode Disassembler pd N pD N pda pi, pI Disassembler Configuration Rz-gg Compiling rz-gg example Tiny binaries Output format Syntax of the language Preprocessor Aliases Includes Hashbang Main Function definition Function signatures Function types Syscalls Libraries Core library Variables Arrays Tracing Pointers Virtual registers Math operations Return values Traps Inline assembly Labels Control flow Comments Rz-hash Hashing by blocks Hashing with rz-bin Obtaining hashes within rizin session Examples Plugins Types of plugins Listing plugins Notes IO plugins Implementing a new disassembly plugin Moving plugin into the tree Implementing a new analysis plugin Implementing a new format Create a folder with file format name in librz/bin/format Some Examples Write a debugger plugin More to come.. Implementing a new pseudo architecture Python plugins Implementing new format plugin in Python Debugging Testing the plugin Creating an rz-pm package of the plugin Crackmes IOLI CrackMes IOLI 0x00 IOLI 0x01 IOLI 0x02 IOLI 0x03 IOLI 0x04 0x04 IOLI 0x05 IOLI 0x06 IOLI 0x07 IOLI 0x08 IOLI 0x09 Avatao R3v3rs3 4 .rizin .first_steps .main .vmloop .instructionset .bytecode .outro hackthebox Find The Easy Pass identification Find the validation routine Fire up the debugger Bonus Rizin Reference Card Survival Guide Flags Flagspaces Information Print string Visual mode Searching Usable variables in expression Authors & Contributors The rizin book