Unable to identify Xrefs in non-stripped x86 Binary

[archcloudlabs]

Work environment

Questions	Answers
OS/arch/bits (mandatory)	Arch Linux x86_64
File format of the file you reverse (mandatory)	ELF
Architecture/bits of the file (mandatory)	x86/32
r2 -v full output, not truncated (mandatory)	radare2 4.0.0-git 22952 @ linux-x86-64 git.3.9.0-119-gcb1f67ee8 commit: cb1f67e build: 2019-10-05__17:25:55

Expected behavior

r2 to identify xrefs to a string in an unstripped 32-bit binary.

Actual behavior

r2 does not identify xrefs to strings in an unstripped 32-bit binary, but does
when the same binary is compiled for 64-bit.

Steps to reproduce the behavior

r2 dungeones_and_hackers-lvl-1-32bit
aaa
s 0x00002a92; (identify you win string via: iz | grep -i 'you win')
V; (visual mode) 
p; (switch to linear disassembly view)
x; no xrefs will be shown for the 32-bit binary, but will be for the 64-bit binary.

Additional Logs, screenshot

32-bit Showing No Xrefs

s, source-code, configuration dump, ...

64-bit Showing Xrefs

Drag and drop zip archives containing the Additional info here, don't use external services or link.

Both binaries are attached and source code is available here.

• dungeons_and_hackers_binaries.tar.gz

[radare]

Same as #13356

…

On 6 Oct 2019, at 00:06, Jared ***@***.***> wrote: Work environment Questions Answers OS/arch/bits (mandatory) Arch Linux x86_64 File format of the file you reverse (mandatory) ELF Architecture/bits of the file (mandatory) x86/32 r2 -v full output, not truncated (mandatory) radare2 4.0.0-git 22952 @ linux-x86-64 git.3.9.0-119-gcb1f67ee8 commit: cb1f67e build: 2019-10-05__17:25:55 Expected behavior r2 to identify xrefs to a string in an unstripped 32-bit binary. Actual behavior r2 does not identify xrefs to strings in an unstripped 32-bit binary, but does when the same binary is compiled for 64-bit. Steps to reproduce the behavior r2 dungeones_and_hackers-lvl-1-32bit aaa s 0x00002a92; (identify you win string via: iz | grep -i 'you win') V; (visual mode) p; (switch to linear disassembly view) x; no xrefs will be shown for the 32-bit binary, but will be for the 64-bit binary. Additional Logs, screenshot 32-bit Showing No Xrefs s, source-code, configuration dump, ... 64-bit Showing Xrefs Drag and drop zip archives containing the Additional info here, don't use external services or link. Both binaries are attached and source code is available here dungons_and_hackers_binaries.tar.gz — You are receiving this because you are subscribed to this thread. Reply to this email directly, view it on GitHub, or mute the thread.

[radare]

Same as #8900

…

On 6 Oct 2019, at 00:06, Jared ***@***.***> wrote: Work environment Questions Answers OS/arch/bits (mandatory) Arch Linux x86_64 File format of the file you reverse (mandatory) ELF Architecture/bits of the file (mandatory) x86/32 r2 -v full output, not truncated (mandatory) radare2 4.0.0-git 22952 @ linux-x86-64 git.3.9.0-119-gcb1f67ee8 commit: cb1f67e build: 2019-10-05__17:25:55 Expected behavior r2 to identify xrefs to a string in an unstripped 32-bit binary. Actual behavior r2 does not identify xrefs to strings in an unstripped 32-bit binary, but does when the same binary is compiled for 64-bit. Steps to reproduce the behavior r2 dungeones_and_hackers-lvl-1-32bit aaa s 0x00002a92; (identify you win string via: iz | grep -i 'you win') V; (visual mode) p; (switch to linear disassembly view) x; no xrefs will be shown for the 32-bit binary, but will be for the 64-bit binary. Additional Logs, screenshot 32-bit Showing No Xrefs s, source-code, configuration dump, ... 64-bit Showing Xrefs Drag and drop zip archives containing the Additional info here, don't use external services or link. Both binaries are attached and source code is available here dungons_and_hackers_binaries.tar.gz — You are receiving this because you are subscribed to this thread. Reply to this email directly, view it on GitHub, or mute the thread.

[radare]

Same as #6283

…

On 6 Oct 2019, at 00:06, Jared ***@***.***> wrote: Work environment Questions Answers OS/arch/bits (mandatory) Arch Linux x86_64 File format of the file you reverse (mandatory) ELF Architecture/bits of the file (mandatory) x86/32 r2 -v full output, not truncated (mandatory) radare2 4.0.0-git 22952 @ linux-x86-64 git.3.9.0-119-gcb1f67ee8 commit: cb1f67e build: 2019-10-05__17:25:55 Expected behavior r2 to identify xrefs to a string in an unstripped 32-bit binary. Actual behavior r2 does not identify xrefs to strings in an unstripped 32-bit binary, but does when the same binary is compiled for 64-bit. Steps to reproduce the behavior r2 dungeones_and_hackers-lvl-1-32bit aaa s 0x00002a92; (identify you win string via: iz | grep -i 'you win') V; (visual mode) p; (switch to linear disassembly view) x; no xrefs will be shown for the 32-bit binary, but will be for the 64-bit binary. Additional Logs, screenshot 32-bit Showing No Xrefs s, source-code, configuration dump, ... 64-bit Showing Xrefs Drag and drop zip archives containing the Additional info here, don't use external services or link. Both binaries are attached and source code is available here dungons_and_hackers_binaries.tar.gz — You are receiving this because you are subscribed to this thread. Reply to this email directly, view it on GitHub, or mute the thread.