mirror of
https://github.com/radareorg/radare2
synced 2026-08-22 20:23:32 -04:00
137 lines
No EOL
3.1 KiB
Groff
137 lines
No EOL
3.1 KiB
Groff
.Dd Jul 10, 2025
|
|
.Dt RASIGN2 1
|
|
.Sh NAME
|
|
.Nm rasign2
|
|
.Nd radare2 signature management tool
|
|
.Sh SYNOPSIS
|
|
.Nm rasign2
|
|
.Op Fl afjhqrvSm
|
|
.Op Fl A Op AAA
|
|
.Op Fl i Ar script.r2
|
|
.Op Fl o Ar sigs.sdb
|
|
.Op Fl s Ar signspace
|
|
.Op Fl c
|
|
.Op Ar file
|
|
.Sh DESCRIPTION
|
|
Generates, dumps, and manages zignature scripts for function identification and cataloging. Zignatures are Radare2 scripts that capture metadata associated with function signatures.
|
|
.Pp
|
|
Supports interpretation of FLIRT '.sig' files, execution of zignature scripts, and exporting signatures in various formats.
|
|
.Sh OPTIONS
|
|
.Bl -tag -width Fl
|
|
.It Fl a
|
|
Make signatures from all .o files in the provided .a file
|
|
.It Fl A Op AAA
|
|
Same as r2 -A, the more 'A's the more analysis is performed
|
|
.It Fl f
|
|
Interpret the file as a FLIRT .sig file and dump signatures
|
|
.It Fl h
|
|
Show help menu
|
|
.It Fl j
|
|
Show signatures in json
|
|
.It Fl i Ar script.r2
|
|
Execute this script in the r2 instance
|
|
.It Fl o Ar sigs.sdb
|
|
Add signatures to file, create if it does not exist
|
|
.It Fl q
|
|
Quiet mode
|
|
.It Fl r
|
|
Show output in radare commands
|
|
.It Fl S
|
|
Perform operation on sdb signature file ('-o -' to save to same file)
|
|
.It Fl s Ar signspace
|
|
Save all signatures under this signspace
|
|
.It Fl c
|
|
Add collision signatures before writing file
|
|
.It Fl v
|
|
Show version information
|
|
.It Fl m
|
|
Merge/overwrite signatures with same name
|
|
.El
|
|
.Sh ENVIRONMENT
|
|
.Pp
|
|
rasign2 does not use any environment variables.
|
|
.Sh EXAMPLES
|
|
.Pp
|
|
Generate signatures from a library file:
|
|
.Pp
|
|
$ rasign2 -o libc.sdb libc.so.6
|
|
.Pp
|
|
Perform deep analysis before generating signatures:
|
|
.Pp
|
|
$ rasign2 -AA -o enhanced_libc.sdb libc.so.6
|
|
.Pp
|
|
Output signatures in JSON format:
|
|
.Pp
|
|
$ rasign2 -j input_file
|
|
.Pp
|
|
Show signatures as radare2 commands:
|
|
.Pp
|
|
$ rasign2 -r input_file
|
|
.Pp
|
|
Merge new signatures into an existing file:
|
|
.Pp
|
|
$ rasign2 -m -o existing.sdb new_binary
|
|
.Pp
|
|
Extract signatures from a FLIRT .sig file:
|
|
.Pp
|
|
$ rasign2 -f flirt_signatures.sig
|
|
.Sh THE Z COMMAND IN RADARE2
|
|
.Pp
|
|
The 'z' command in radare2 is dedicated to the management of binary signatures, known as zignatures. Here are the key subcommands:
|
|
.Bl -tag -width Fl
|
|
.It Cm z
|
|
Show zignatures
|
|
.It Cm z.
|
|
Find matching zignatures in current offset
|
|
.It Cm zb
|
|
Search for best match
|
|
.It Cm zd
|
|
Diff current function and signature
|
|
.It Cm z*
|
|
Show zignatures in radare format
|
|
.It Cm zo
|
|
Manage zignature files
|
|
.It Cm zf
|
|
Manage FLIRT signatures
|
|
.It Cm z/
|
|
Search zignatures
|
|
.It Cm zc
|
|
Compare current zignspace zignatures
|
|
.It Cm zs
|
|
Manage zignspaces
|
|
.It Cm zi
|
|
Show zignatures matching information
|
|
.El
|
|
.Pp
|
|
These commands facilitate a robust workflow for binary analysis, enabling the identification of known functions and comparing binary similarities.
|
|
.Sh SUPPORTED ZIGNATURE METRICS
|
|
.Pp
|
|
Zignatures in radare2 can be created with various metrics:
|
|
.Bl -tag -width Fl
|
|
.It Cm a
|
|
Bytes pattern (masked)
|
|
.It Cm b
|
|
Raw bytes pattern
|
|
.It Cm c
|
|
Base64 comment
|
|
.It Cm n
|
|
Real function name
|
|
.It Cm g
|
|
Graph metrics (complexity, edges, basic blocks)
|
|
.It Cm o
|
|
Original offset
|
|
.It Cm r
|
|
References
|
|
.It Cm x
|
|
Cross references
|
|
.It Cm h
|
|
Basic block hashes
|
|
.It Cm v
|
|
Variables and arguments
|
|
.El
|
|
.Sh SEE ALSO
|
|
.Pp
|
|
.Xr radare2(1)
|
|
.Sh AUTHORS
|
|
.Pp
|
|
pancake <pancake@nopcode.org> |