Skip to main content

54. Solving CTF Binaries with Radare2

Radare2 (r2) is a powerful open-source reverse-engineering framework that has become essential for players tackling CTF binary-exploitation challenges. While Ghidra and IDA Pro offer polished GUIs, radare2's command-line interface and scripting capabilities provide incredible flexibility for fast analysis.

Why Radare2?​

First, it is completely free and open source. Second, it runs across many platforms and architectures. Third, once you learn its command syntax, you can analyze binaries faster than by clicking through GUI menus. The learning curve is steep, but worthwhile.

Installation​

Installation is simple on most systems:

# Ubuntu/Debian
sudo apt install radare2

# macOS
brew install radare2

# Build from source
git clone https://github.com/radareorg/radare2
cd radare2
sys/install.sh

Essential Commands​

Radare2's command structure follows patterns. These are the basics needed for CTF challenges.

Analysis commands start with a:

  • aa - Analyze everything
  • aaa - Analyze more
  • aaaa - Analyze all the things (time-consuming)

Print commands start with p:

  • pdf @ main - Print the disassembly of the main function
  • px 100 - Print 100 bytes in hexadecimal
  • ps @ address - Print the string at an address

Seek commands start with s:

  • s main - Seek to the main function
  • s 0x08048000 - Seek to a specific address

Information commands start with i:

  • ii - List imports
  • iz - Strings in the data section
  • izz - All strings in the binary

Common CTF Workflow​

When you download a binary challenge, approach it like this:

r2 -A binary_name

The -A flag automatically runs analysis. Once inside:

  1. Check basic information: Use i to inspect the file type, architecture, and protections.
  2. Find interesting strings: Run izz and look for flags, hints, and suspicious data.
  3. Find main: Enter s main, then inspect its disassembly with pdf. Pay attention to function calls, comparisons, and jumps.
  4. Follow function calls: If you see a call such as call sym.check_password, seek with s sym.check_password and disassemble it with pdf.
  5. Set breakpoints: If dynamic analysis is needed, set a breakpoint with db address.

Visual Mode​

Radare2's visual mode is underrated. Press V to enter visual mode, then:

  • Press p to cycle through views
  • Use VV to display a graph view of function flow
  • Press q to return to the command line

The graph view (VV) is especially useful for understanding complex control flow in CTF challenges.

Practical Example​

Suppose you have a “password checker” binary:

r2 -A password_checker
[0x00001060]> izz | grep -i flag
[0x00001060]> s main
[0x00001060]> pdf

Look for comparison operations (cmp, test), string operations (strcmp, strncmp), and encoding functions. CTF challenges often hide the flag in plain sight or use simple XOR encoding that is clearly visible in the disassembly.

Advanced Features​

Emulation: Use aezi to emulate and analyze instructions one by one.

Patching: The w commands can modify a binary. For example, wx 9090 writes NOPs (0x90) at the current location.

Scripting: Radare2 supports r2pipe for Python, allowing analysis tasks to be automated.

Debugging: Run debug mode with r2 -d binary, continue with dc, step with ds, and inspect registers with dr.

CTF Tips​

  • Always launch with -A for automatic analysis
  • Append ? to a command for help; for example, p? displays all print commands
  • Search with the / command—try /flag or /password
  • Do not forget dynamic analysis—sometimes you need to run the binary directly
  • Check for anti-debugging tricks with ii (imports)—look for functions such as ptrace

Learning Resources​

The official radare2 book, available free online, is comprehensive. Practice CTFs on pwnable.kr or HackTheBox. Start with easy reverse-engineering challenges and increase the difficulty gradually.

Closing Thoughts​

Radare2 may be intimidating at first, but it is indispensable for CTF binary challenges. After a few competitions, the command-line interface becomes natural, and you gain flexibility that outweighs the initial learning investment. Used alongside pwntools and GDB, it forms a solid binary-exploitation toolkit.

Remember: every command has help (?), and you can always build from the basics. Happy hacking!