radius2 - fast symbolic execution with r2

radius2 is a fast symbolic execution and taint analysis framework using radare2 that is focused on covering many different architectures and executable formats. It also strives to be easy to use and has a CLI tool that makes some reversing tasks as easy as adding a symbolic value and setting a string to reach or avoid. Reversing challenges can be solved as easily as the example below. ``` $ radius2 -p ais3 -A. flag -s flag 184 -X sorry

flag : "ais3{Itak3g00d_n0t3s}"

```

Building

Install radare2 with git clone https://github.com/radareorg/radare2.git radare2/sys/install.sh

Install radius2 with cargo install radius2 or include radius2 as a dependency using radius2 = "1.0.19"

Supported Architectures

• x86
• amd64
• ARM
• AArch64

"Supported" Architectures

radius2 also "supports" MIPS, PowerPC, and Gameboy but they are almost entirely untested. Additionally radius2 supports execution of cBPF and eBPF programs.

radius2 can execute Dalvik bytecode only involving static methods and variables.

Finally there is also a varying amount of support for 6502, 8051, AVR, h8300, PIC, RISCV, SH-4, V810, V850, Xtensa.

Also PCode can be translated to ESIL with r2ghidra with pdgp (currently broken, actually maybe fixed now) so potentially more archs could be supported that way.

Example

```rust use radius2::{Radius, Value};

fn main() { let mut radius = Radius::new("tests/r100"); let mut state = radius.callstate(0x004006fd); let addr: u64 = 0x100000; let flagval = state.symbolicvalue("flag", 12 * 8); state.memorywritevalue(&Value::Concrete(addr, 0), &flagval, 12); state.registers.set("rdi", state.concrete_value(addr, 64));

radius.breakpoint(0x004007a1);
radius.avoid(&[0x00400790]);
let mut new_state = radius.run(state, 1).unwrap();
let flag = new_state.evaluate_string(&flag_val).unwrap();
println!("FLAG: {}", flag);
assert_eq!(flag, "Code_Talkers");

} ```

radius2 CLI tool

radius2 can also be installed from crates.io and easily included in packages. radius2 also has a CLI tool that can be installed with cargo install radius2

``` radius2 1.0.19 Austin Emmitt (@alkalinesec) aemmitt@nowsecure.com A symbolic execution tool using r2 and boolector

USAGE: radius2 [FLAGS] [OPTIONS] --path

FLAGS: -V, --color Use color output --crash Execution stops on invalid memory access -h, --help Prints help information -j, --json Output JSON -z, --lazy Evaluate symbolic PC values lazily --no-sims Do not simulate imports --plugins Load r2 plugins -P, --profile Get performance and runtime information -M, --selfmodify Allow selfmodifying code (slower) -2, --stderr Show stderr output -0, --stdin Use stdin for target program -1, --stdout Show stdout output --strict Panic on invalid instructions and ESIL --version Prints version information -v, --verbose Show verbose / debugging output

OPTIONS: -a, --address