re-radare2

rizin/radare2 command-line analysis

When to use / when not to use

• Use: command-line/scripted analysis; low-memory (<4GB) or remote environments (GUI decompilers cannot run); quick disassembly and cross-references;pdf/V mode exploration; firmware/batch sample scripted analysis
• Use: SSH/CI environments without a GUI (rz is pure terminal,-q -c one-line batch processing)
• Don't use: when mature GUI decompilation and type propagation are needed (use [[re-ghidra]])
• Don't use: when only preliminary triage conclusions are needed ([[re-triage]])
• Don't use: when Windows user-mode debugging is the main task ([[re-x64dbg]] / [[re-windbg]] are handier; the rz debugger has limited capabilities on Windows)

Tool preparation

See [[re-analyze/platform-tips]] -- command-line tools suit remote/low-memory environments; the platform branch's Wine/QEMU user-mode emulation experience also applies.

rizin (active fork of radare2)

• macOS: brew install rizin
• Arch: pacman -S rizin
• Fedora/RHEL(EPEL 8+): dnf install rizin(packages available for Fedora's currently supported versions and EPEL 8/9/10); for EOL Fedora, check the distro repositories first, and if no package exists use the official release or rz-pm
• Debian/Ubuntu: repository has no rizin package,apt install rizin will fail-- switch to the official release binaries (GitHub rizinorg/rizin releases: static tar.xz / Windows zip / macOS pkg) or rz-pm
• Kali: apt install rizin(Kali's own repository has packages, provided the official Kali sources are used)
• Windows: the official release zip can be unzipped and used directly (rz-bin.exe）
• Verify: rizin -v、rz-bin -V
• Note: distro package status changes over time, check the target distro repositories before installing; success or failure is always determined by rizin -v . When other skills need rizin installation steps, reference this matrix here rather than copying distro commands individually.

radare2 compatibility layer (legacy command system)

• Linux: apt install radare2 / dnf install radare2 / pacman -S radare2
• macOS: brew install radare2
• Windows: choco install radare2
• Verify: r2 -v
• Note: rz and r2 commands are largely compatible (pdf/axt/V are the same), but plugin names and a few commands differ (noted below)

rz-ghidra decompiler plugin

• All platforms: rz-pm -ci rz-ghidra(rizin package management, requires network and a build toolchain)
• Verify: inside rizin, pdg @ main can output pseudo-C

Procedure

1. rizin -A fully automatic analysis：

   rizin -A sample
   

   Wait for the analysis-complete prompt (for large files, observe by paging with p ).-A is equivalent to aaa(full automatic analysis: functions/cross-references/string references). For shallow analysis only, use -a x86 and other on-demand parameters. Exit: q。

   • Enter interactive mode directly with no parameters and analyze later: aaa; lightweight version aa(functions + string references, first choice for large files)
   • Function list: afl; single-function info: afi @ main; manually define a function: af @ 0x401000

2. pdf disassemble function：

   [0x00001040]> pdf @ sym.main
   

   • When stripped, first find the entry: izz~entry or af @ 0x401000 manually define the function and then pdf @ 0x401000
   • pdf = print disassembly function；pd 20 = print 20 instructions;pdr print with references
   • When analysis noise is mixed in, use pdf @ <addr> | grep call to filter calls
   • Rename: afn 新名字 @ 地址; comment: CCu 注释 @ 地址

3. axt cross-references：

   [0x00001040]> axt @ 0x403000     # 谁引用 0x403000
   [0x00001040]> axf @ sym.main     # main 引用了谁
   

   String references: izz list all strings,axt @ str.<名称> Find reference points (strings already auto-named).

   • Locate chain: izz find key string → axt @ str.xxx → jump to referencing function s <地址> → pdf—same idea as [[re-ida]]'s Alt+T→x→F5

4. Visualization V mode：

   [0x00001040]> V
   

   • p switch view (disassembly/hex/graph)
   • s followed by address/symbol jump (s sym.main）；f define function;d disassembly toggle
   • Graph view (function flow): V press p to graph view, navigate with arrow keys—use for mapping control flow
   • Exit V: q; exit rizin: then q

5. Scripting and rz-ghidra decompilation：

   # 一行命令批处理
   rizin -q -c 'aaa; pdf @ sym.main; axt @ 0x403000; quit' sample
   

   # 反编译
   rz-pm -ci rz-ghidra
   rizin -c 'aaa; pdg @ sym.check' sample
   

   pdg = Ghidra-style pseudo-C output; without the plugin, fall back to pdf + manual reconstruction.

   • Script file: rizin -i script.r2 sample(or in interactive mode . script.r2); in the script, one command per line, ending withquit end

6. Debug mode (rz built-in debugger)：

   rizin -d ./sample            # 以调试模式启动
   rizin -d -p 1234             # attach pid
   

   [0x7f...]> db 0x401000       # 断点（db = debugger breakpoint，与 r2 相同）
   [0x7f...]> dc                # 继续（continue）
   [0x7f...]> ds / dso          # 单步 / 步过
   [0x7f...]> dr eax=0          # 改寄存器（绕过校验常用）
   [0x7f...]> px @ rsp          # 看栈内容
   [0x7f...]> drr               # 全部寄存器
   

   • Breakpoint table: db(lists with no arguments); delete breakpoint: db- 地址; conditional breakpoint: db 地址:条件(e.g. db 0x401000:eax==1）
   • For differences between debugging and gdb, see [[gotchas]]; for the gdb workflow, see [[re-gdb]]

7. Search and memory operations：

   [0x00001040]> /x 5548             # 十六进制搜索
   [0x00001040]> /v 0xdeadbeef       # 32 位值搜索（小端）
   [0x00001040]> /w "password"       # 字符串搜索
   [0x00001040]> /r sym.check        # 引用搜索（找谁引用了符号）
   [0x00001040]> wx 9090 @ 0x401000  # 写字节（NOP 补丁）
   [0x00001040]> px 32 @ 0x401000    # 读 32 字节
   

   • File info: rz-bin -I sample(architecture/entry/sections),rz-bin -z sample(strings),rz-bin -i sample(imports)—equivalent to r2's rabin2 -I/-z/-i

8. Projects and exporting：

   [0x00001040]> Ps project_name     # 保存项目（含分析结果与标注）
   [0x00001040]> Po project_name     # 打开项目
   [0x00001040]> Pj > out.json       # 导出 JSON 项目（供脚本二次处理）
   

   • Analysis annotations (renames/comments) persist with the project—next time Po resume directly

Cross-domain combinations

• [[re-binary-core]]: low-memory/command-line alternative for workflow step 5 (RE_DECOMPILER=radare2）
• [[re-firmware]]: batch scripted analysis of firmware ELF (no GUI environment)
• [[re-ctf]]: command-line quick attack for CTF challenges
• Connect with [[re-format-elf]] to read structures; switch to [[re-ghidra]] when GUI decompilation is needed
• Dynamic debugging scenarios complement [[re-gdb]] (gdb ecosystem/plugins are more complete, rz's built-in debugger is lightweight)

Common pitfalls and gotchas

• Without -A little info before: without analysis there are no function boundaries/no cross-references—first -A(or aaa), then look at symbols
• Large file analysis is slow: full aaa is extremely slow on huge firmware—use aa(lightweight) or aa~ limits, or only for the target section af @ addr manual analysis
• Command system r2/rz differences: online tutorials are mostly for radare2 (r2); rizin (rz) is largely compatible but plugin installation (r2pm→rz-pm) and a few command names differ—first rz? check help before executing
• pdf depends on function boundaries—when stripped, af define first, otherwise output is empty or misaligned
• Piped output with colors/pager breaks script parsing—for batch processing use e scr.color=0 to remove color (-2 only disables stderr warnings, does not remove color)
• For version differences, debugger and PIE address pitfalls, see [[gotchas]]