radareorg/r2pm

Radare2 cross platform package manager

r2pm: radare2 package manager

This tool is a cross platform package manager for the reverse engineering framework radare2.

It is a rewrite in Go of the original Shell r2pm script.

This tool is still a work in progress.

CI	Badges/URL
GithubCI
TravisCI
Dependabot
Sourcehut

Package example

The official database is available here.

name: r2dec
type: git
repo: https://github.com/wargio/r2dec-js
desc: "[r2-r2pipe-node] an Experimental Decompiler"

install:
  - make -C p

uninstall:
  - make -C p uninstall

r2pm's Issues

Bundle Busybox (Idea)

Right now, all commands are just run without any shell and manually calling a shell in a build script would break Windows compatibility, so I think it could be extremely convenient to have r2pm always use a shell and some basic unix tools that it provides by itself, which could be done by bundling Busybox.

This is a port for Windows: https://frippery.org/busybox/ I didn't try it myself, but doesn't look bad.

doesnt build

pmb:r2pm pancake$ make
go build
go: finding github.com/kr/pretty v0.1.0
go: finding github.com/urfave/cli v1.21.0
go: finding golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7
go: finding gopkg.in/check.v1 v1.0.0-20180628173108-788fd7840127
go: finding gopkg.in/yaml.v2 v2.2.2
go: finding github.com/kr/text v0.1.0
go: finding github.com/BurntSushi/toml v0.3.1
go: finding gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405
go: finding github.com/kr/pty v1.1.1
go: downloading github.com/urfave/cli v1.21.0
go: downloading golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7
go: downloading gopkg.in/yaml.v2 v2.2.2
go: extracting golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7
go: extracting github.com/urfave/cli v1.21.0
go: extracting gopkg.in/yaml.v2 v2.2.2
go build -o libr2pm.so -buildmode=c-shared ./lib
# runtime/cgo
cgo-builtin-prolog:1:10: fatal error: 'stddef.h' file not found
#include <stddef.h> /* for ptrdiff_t and size_t below */
         ^~~~~~~~~~
1 error generated.
make: *** [libr2pm.so] Error 2
pmb:r2pm pancake$

Support for git tags/releases

See radareorg/radare2#17178

Detailed description

When using r2 from non-git (release builds), installing packages can result in build problems. This PR aims to enable r2pm with the ability to pick the right commit from the tagged version from 3rd party repos if available.

Afaik this is done by r2ghidra-dec and r2dec-js, it may be good to define a different tag name than just the r2 version string, otherwise it will confuse users with the version of the decompiler and the version of the r2 required to build. Suggestion is to use r2- as prefix in the 3rd party repos.

Test plan

Get r2-4.4 and type the following command:

$ r2pm install r2ghidra-dec

r2pm doesn't works if Cmake's default generator isn't make

Describe the issue
r2pm doesn't build packages if the cmake's default generator isn't make.

How to reproduce?
Simply setting cmake's default generator to anything else than makefiles. Eg: Having CMAKE_GENERATOR=Ninja

Expected behavior
Still building the file using the default generator.

Possible fix
Using cmake --build . instead of make or forcing cmake to use make

I use window 10, and how can I install r2pm for now?

I use window 10, and how can I install r2pm for now?

Add dependabot

See:

• https://dependabot.com/go
• https://dependabot.com/docs/config-file/

It checks the dependencies automatically and sends PRs to the repo. Go language is supported.

Error when doing r2pm ls and init was not called

When I type ./r2pm ls right after building, I get

.local/share/RadareOrg/r2pm/r2pm-db/db: no such file or directory

Maybe it would be good to add a global check to make sure the local r2pm-db is not broken

Create a Makefile

Create a Makefile

Idea for plugin directories

Old r2pm installs r2 plugins directly in the global plugin directory.

What if new r2pm would install packages only in a self-contained directory and then can give you a list of paths for LIBR_PLUGINS, so r2 can find all the plugins? Of course this implies that r2 has to either query r2pm for the paths itself or you have to manually run r2 with env vars given by r2pm.

This would make it more transparent to the user where files from a package are installed.
And if you have a binary package (e.g. for Windows), it would be enough to unpack it and set the paths.
Also, for Cutter plugins, r2pm would not need to know where Cutter is installed and gets its plugins from, but only Cutter needs to know where r2pm is.

Once it is usable update the documentation in r2book

See these files:

• https://github.com/radare/radare2book/blob/master/tools/r2pm/intro.md
• https://github.com/radare/radare2book/blob/master/plugins/r2pm.md

Add "Nightly"/git master install radare2

To grab the binaries from AppVeyor. You didn't address my comment in that PR: #46

https://github.com/radareorg/radare2-release/blob/master/build.sh#L502

Add Azure Pipelines

You can add Azure Pipelines YAML file, I enabled it for the repository

Originally posted by @XVilka in #40 (comment)

Support plugin categories (or tags)

For example, be able to sort/list the packages with categories like asm, anal, io, core, debug, etc kinds of the radare2 plugins provided. Also the r2pipe and something else.

Another approach could be to associate tags instead, e.g. asm, python, so it will be known that this plugin implements disassembly plugin in Python, and so on.

@radare @xarkes @ITAYC0HEN @thestr4ng3r what do you think?

Support for "update" and "updateall" commands

• update
• updateall

Make r2pm list packages related to plugins only

imagine rasm2 -L was able to extend the listing with r2pm's output when the arch you need is not there. same goes for rabin2 -L and others. Basically this means integrgating the pkg manager within r2

Add Appveyor

Add Appveyor for Windows binaries for r2pm.

Simple dependency support

Allow to set the dependency following something like these rules

depends: qwe
depends: qwe < 0.4
depends: qwe <= 0.5
depends: qwe > 1.4.5
depends: qwe >= 1.5.6
depends: 5.5 > qwe <= 8.0

OpenBSD and C build

go: extracting github.com/urfave/cli v1.21.0
go build -o libr2pm.so -buildmode=c-shared ./lib
-buildmode=c-shared not supported on openbsd/amd64
gmake: *** [Makefile:20: libr2pm.so] Error 1

Support all command available in original shell script

Checkilist for progress of development:

• -i,info show information about a package
• -i,install install package in your home (pkgname=all)
• -gi,global-install install package system-wide
• -gu,global-uninstall uninstall pkg from systemdir
• -u,uninstall r2pm -u baleful (-uu to force)
• -l,list list installed pkgs
• -r,run [cmd ...args] run shell command with R2PM_BINDIR in PATH
• -s,search [] search in database
• -t,test FX,XX,BR BID check in Travis regressions
• -v,version show version
• -h,help show this message
• -H variable show value of given variable
• -c,clean ([git/dir]) clear source cache (GITDIR)
• -ci (pkgname) clean install of given package
• -cp clean the user's home plugin directory
• -d,doc [pkgname] show documentation for given package
• -w what/where is installed
• init | update .. initialize/update database
• cd [git/dir] cd into given git (see 'r2pm ls')
• ls ls all cloned git repos in GITDIR
• suicide self remove all (home + system) installations of r2
• cache cache contents of r2 -H to make r2pm r2-independent

Add TravisCI

Add TravisCI for OSX and Linux builds

Add the ability to install/update radare2 and Cutter themselves

For we can push r2pm binaries to choco or whenever else, and r2pm will check the github/appveyor/whatever for available source or binary packages of those.

To make it something like rustup

Deploy Codecov

https://github.com/codecov/example-go

missing "db.json"

I run :

go run r2pm.go -s r2frida

it return :

Could not read database file C:\Users\cx\AppData\Roaming/db.json. Did you initialize r2pm? 

so, where is the db.json ?

r2pm-go on OSX

Currently it doesn't work on OSX.

Add builds.sr.ht

Add builds.sr.ht support for *BSD builds

Radare2 Plugin and snippets hub

A simple page built on top of the r2pm database allowing to navigate through the packages, maybe show description and dependencies for every package, along with versions and links.

Something of likes

• Hackage
• Opam
• etc

Support for binary packages

Mostly for Windows and OS X

Option to install old versions of packages for compatability

Issues like r2ghidra-dec/76 seem to happen all the time. Because r2pm installs packages from git master, and those packages are usually made to be compatible with the latest radare2 master, it seems that r2pm can really only be considered secure and compatible when used with radare2 from git.

As a result, those who are using the latest stable (or older) release of radare2—which I am sure is a massive portion of the userbase—are left with plenty of packages that either won't compile or could even possibly have bugs to be discovered later on. As an example, I currently can't install r2ghidra-dec under radare2 4.3.1 because a function was renamed in r2 upstream three days ago, and the r2ghidra devs responded very quickly with the refactor.

Not exactly sure what the best idea would be here. Packages often don't create tagged releases, and if they did, they might not align well with Radare2 releases. Perhaps it would be a good idea if we were to create an r2pm -ii <pkg> command that would checkout R2PM_GIT to the date that r2 says it was built under r2 -v. This could be implemented with git rev-list.

A caveat against the above idea is that a stable release of r2 could've definitely been built after the release date, and some changes may have happened in between. To resolve that, I imagine that we would have to use the output of r2 -qv and some git magic to figure out the date the last commit of that tag was pushed, then checkout packages to that date. I would guess that this would work something like 99 % of the time, and would only fail if a last-minute change was pushed to the r2 repo before the tagged version and plugin creators didn't respond in time.

Anyway, it seems like a complicated mess—ideally, I think plugin creators could just make tagged releases that correspond to radare2 versions. Is that something we'd want to enforce/suggest?

Edit: the simplest solution I can think of right now, which leaves some work to the user, would just be to create a --commit=1234abcd option on installation that could be passed to git during/after the cloning process. Users would have to figure out what commit works for their version of radare2.

Supply simple radare2 plugin channeling commands to r2pm

Like in Julia language, to look something like:
R2pm should have its own REPL mode, which can be entered from the radare2 shell by pressing ]. To get back to the radare2 shell press backspace or ^C.
It will then change the command prompt:

pkg>

Good example how to provide such a command is yara plugin - it installs new command in radare2: https://github.com/radare/radare2-extras/blob/master/yara/yara/core_yara.c
So installing r2pm will install the radare2 plugin, which radare2 will automatically load and will provide this command for using directly from the r2 shell.

Migrated from here radareorg/radare2#14372

/cc @radare @Maijin @xarkes @qbarrand

Swap cmd.exec for go-git

See https://stackoverflow.com/questions/45342640/golang-git-pulling-a-repo/45342748#45342748