Friday, September 16, 2016

Reverse 3NG1N33R1NG [Playing with Radare2 .. OK Bokken)

IDA is a expensive, but its superb... superb is an understatement , however I am not coughing up 2700Euros for that , after all many of my students cant afford this, and am really loving the learning curve that radare2 comes with.

So what is radare2 > OpenSource IDA replacement (well for me that is)

its a huge library of reverse engineering tools, however Radare2 lacked a major component , GUI hence the steep learning curve, I am willing to look at multiple GUI methods, however I have been in love with Bokken , an option for GUI in the radare2 framework.

I will explore more options as I go on, including the visual mode and WebUI:

BOKKEN:









Installation

Bokken has some issues, its still under development (personally i maintain my own bit as much as i can, I have yet to push all my changes (forbid as i am still going through most of this code)

Installation on MacOSX (El-Captian soon moving to Siera (this will be an issue but i will see through ti :) ... )

simple:

brew install bokken
(installs bokken 1.8 last release)

Error: os.getenv("DISPLAY").strip()

When i try to start bokken, i fix this by installing  XQuartz to handle $DISPLAY

another Error:  from PIL import Image - ImportError: No module named PIL
When try to start bokken again, I fix this by installing pillow via pip (check if installed with pip freeze | grep pillow) install by:sudo pip install pillow

I manage to start get bokken running (see first image, however, when trying to load a file, i meet this error)

Error: ValueError: invalid literal for int() with base 10:

This seems that theres an issue, I look at the code (I will be fixing this and pushing it to my github, for now i just commented the code to work from a standpoint that entry points aren't calculated, this will be fixed soon from my end and pushed out , for now, am just looking around and having too much fun :)


If you have questions, kindly reach out :)


ARCHIVED

:) No longer posting, all articles should be treated as archived and outdated