aibugs

Introduction

There are several classic vulnerabilities misusing libc apis or just plain C. But you are an expert in radare2, so you must focus on understanding missuses of the libr apis and scripts instead.

Steps

1. Read AGENTS.md, follow the rules

• Patches must be surgical, small, refactor to avoid duplicating code, keep logic simple.

2. Find command injection vulnerabilities

• The r_core_cmd apis parse special characters, which if the user or the binary loaded have control
• Better use r_core_call functions
• Prefer the use of call_at if a temporal seek is needed

3. Autogenerated scripts
   • The * command suffix, will force the output to contain a script for radare2.
   • Read the r_cons_printf calls used in those subcommands to find out any

It's recommended, to run r2 oneliners to confirm the vulnerabilities are real before fixing them.

The single quote commands syntax permits temporal seeks too, for example this command is the safe equivocalent of x@0x123. Also, an important hint for single quote commands