Using the "rabin2" Command to Get Information about Binary Files (with examples)

Introduction

Binary files, such as ELF, PE, Java CLASS, and Mach-O, contain crucial information about the structure and functionality of a program. Extracting this information can help with various tasks, including reverse engineering, program analysis, and software maintenance. The “rabin2” command, which comes bundled with the “radare2” framework, is a powerful tool that allows users to obtain detailed information about binary files.

In this article, we will explore different use cases of the “rabin2” command by providing code examples for each case. We will also explain the motivation behind each use case, the purpose of the command arguments, and provide example outputs.

Use Case 1: Display General Information about a Binary

rabin2 -I path/to/binary

Motivation: When working with a binary file, it is often important to gather general information about the binary, such as the architecture, type, and endianness. This information can help determine compatibility, identify potential issues, and guide subsequent analysis tasks.

Explanation: The -I argument is used to instruct the “rabin2” command to display general information about the binary file specified by path/to/binary.

Example Output:

arch     x86
bits     64
canary   false
class    ELF
endian   little
...

Use Case 2: Display Linked Libraries

rabin2 -l path/to/binary

Motivation: Binary files often rely on external libraries to access resources and provide additional functionality. Knowing which libraries a binary depends on can be vital for troubleshooting, understanding system requirements, and ensuring the availability of necessary dependencies.

Explanation: The -l argument instructs “rabin2” to display the linked libraries of the binary file at path/to/binary.

Example Output:

libpthread.so.0
libc.so.6
libm.so.6
...

Use Case 3: Display Imported Symbols from Libraries

rabin2 -i path/to/binary

Motivation: Symbols represent functions, variables, and other entities that are used or referenced in the binary. By examining imported symbols, one can gain insights into the binary’s functionality, identify dependencies, and understand how different components interact.

Explanation: The -i argument instructs “rabin2” to display the symbols imported from libraries by the binary file located at path/to/binary.

Example Output:

imp._GLOBAL_OFFSET_TABLE_
imp.puts
imp.strlen
...

Use Case 4: Display Strings Contained in the Binary

rabin2 -z path/to/binary

Motivation: Strings embedded in a binary can hold valuable information, such as error messages, configuration details, or cryptographic material. By extracting and examining these strings, analysts can gain insights into the binary’s design, purpose, and potential vulnerabilities.

Explanation: The -z argument is used to tell “rabin2” to display the strings contained within the binary file located at path/to/binary.

Example Output:

/dev/urandom
cannot create shared memory segment
There has been an error
...

Use Case 5: Display Output in JSON Format

rabin2 -j -I path/to/binary

Motivation: JSON is a widely-used data interchange format that is easy to parse and manipulate. By obtaining the output of “rabin2” in JSON format, users can easily process the information programmatically, integrate it with other tools, or perform automated analysis tasks.

Explanation: The -j argument is used to specify that the output of “rabin2” should be presented in JSON format. It is combined with the -I argument, which instructs “rabin2” to display general information about the binary file located at path/to/binary.

Example Output:

{
  "arch": "x86",
  "bits": 64,
  "canary": false,
  "class": "ELF",
  "endian": "little",
  ...
}

Conclusion

The “rabin2” command provides a convenient way to extract comprehensive information from binary files. By utilizing its various arguments, users can obtain general information about the binary, identify linked libraries and imported symbols, extract strings embedded within the binary, and even obtain the output in JSON format for further analysis and automation. Understanding how to use “rabin2” effectively can greatly enhance program analysis and reverse engineering tasks.