radare2

Supporting material availability

This catalog copy contains the inline guidance below, but does not include the following supporting paths. They are external prerequisites, not bundled files:

• <support-root>/scripts/recon.ps1
• reverse-engineering/references/re-agent-workflow.md

Obtain the required material from the declared upstream source, or from a user-provided installation of that source. Resolve each path relative to that installation, inspect its contents, and verify any applicable license and execution prerequisites. Do not run a command or claim a referenced procedure was followed until its required file exists. Do not fabricate the missing scripts or treat an unrelated file with the same name as equivalent. Independent steps fully documented here can proceed within the user’s authorized scope; report any dependent step as unavailable.

radare2

When to Use

• Quick terminal-based analysis of a binary without a heavy IDE.
• Scriptable disassembly, diffing, or small binary patches.

Binary analysis skills for the radare2 CLI. The focus is on completing reconnaissance, analysis, locating, exporting, and lightweight modification directly with command-line tools, without relying on a GUI.

Scope of Application

This skill should be used with priority when the user has these intentions:

• Wants to use r2 / radare2 to analyze exe、dll、so、elf、apk、dex、wasm and other files
• Asks how to use rabin2、rasm2、radiff2、rahash2、rax2 How to use
• Needs command-line disassembly, viewing functions, viewing strings, viewing imports and exports, checking cross-references, or doing patches
• Needs to write radare2 batch commands,-c automation commands, or r2pipe scripts

If the user explicitly wants GUI reverse engineering, Hex-Rays-style pseudocode, or an IDA workflow, prioritize ida-reverse. If it is web JS reverse engineering, prioritize reverse-engineering。

First confirm the environment

Do not assume r2 is available at first. Check first:

r2 -v
rabin2 -v

If it is not installed, then check common installation locations or prompt for installation.

Common Windows executables:

• radare2.exe
• rabin2.exe
• rasm2.exe
• radiff2.exe
• rahash2.exe
• rax2.exe
• r2pm.exe

Built-in Resources

This skill comes with two resources; reuse them with priority instead of assembling a duplicate set of commands from scratch every time.

scripts/recon.ps1

Standard reconnaissance script, suitable for doing a first round of overview analysis. It outputs:

• Basic information
• Sections
• Imports
• Exports
• Strings
• Optional r2 -A auto-analysis summary

How to invoke:

powershell -File "<skill-root>\radare2\scripts\recon.ps1" -TargetPath "C:\path\to\sample.exe"

If you need to include r2 auto-analysis:

powershell -File "<skill-root>\radare2\scripts\recon.ps1" -TargetPath "C:\path\to\sample.exe" -RunAnalysis

references/cheatsheet.md

When you need more command details, templates for common scenarios, or to quickly recall syntax, read this cheat sheet instead of guessing from memory.

Known Phenomena

Occasional .sdb missing warning on Windows

For some PE files, during rabin2 reconnaissance, a warning similar to the following may appear:

ERROR: Cannot find ...\share\format\dll\*.sdb

If the main output still returns normally, it usually does not affect the basic reconnaissance conclusions; just continue the analysis. Do not directly conclude that the analysis failed because of this kind of incidental warning.

Basic Principles

1. Reconnaissance first, deep dive later

Do not start with full automated analysis right away. First use lightweight commands to confirm the file type, architecture, entry point, strings, and import table, then decide whether to do aaa、aaaa or targeted analysis.

2. Prefer the minimal sufficient command

radare2 There are a great many commands, and users usually only need the shortest path:

• View file information:rabin2 -I
• View strings:rabin2 -z
• View imports and exports:rabin2 -i / rabin2 -E
• Interactive analysis: execute local commands afterr2 <file> then execute local commands

3. Be cautious before modifying

If the user wants to patch a binary:

• By default, open read-only first:r2 <file>
• Only use write mode when modification is explicitly needed:r2 -w <file> or in a session oo+
• Before modifying, explain the risks first to avoid unintentionally overwriting the original file

Common Workflows

Workflow 1: Quick Reconnaissance

Suitable when you have just obtained a binary file.

Hard Gate (MUST — entering Workflow 2 and beyond is prohibited if not satisfied)

For binaries with an import table such as PE/ELF/Mach-O,MUST first complete the import table check and record it as Evidence before proceeding to function-level analysis or dynamic steps:

1. Execute rabin2 -i <sample>(or recon.ps1 imports section in the output); DLL/SYS additionally MUST rabin2 -E and record E-exports
2. Write the complete/categorized import table results into Evidence (recommended id:E-imports or E-triage-imports), at minimum including:
   • reproduction command (repro_command）
   • Key import category summary: network / file / cryptography / process injection / registry / other suspicious APIs
   • If the import table is empty, parsing fails, or the tool errors: still MUST record the failure symptom and raw output as Evidence,must not silently skip
   • Import table is "too clean" (only basic DLLs): MUST note suspicion of dynamic loading, SHOULD switch to dynamic API capture
3. .NET, etc. without a traditional IAT: MUST use equivalent anchors (dnSpy/IL/metadata summary) written into the same Evidence semantic slot; empty passes are prohibited
4. Packed sample IAT repair: use ImportREC (or equivalent) for x86, Scylla (or equivalent) for x64. If repair fails, MUST record E-iat-repair-fail then switch to dynamic API breakpoints;prohibitedendlessly grinding on the static IAT (see reverse-engineering/references/re-agent-workflow.md §1.2）
5. When the user explicitly requests "redo import table check / recheck import table / redo IAT": MUST redo the named step itself (when blocked, first go through the feasibility gate: explain the prerequisites + ask for confirmation; if forced, mark quality=unreadable),prohibited from substituting unrelated steps to feign completion

Before recording Evidence for the import table (or a legitimate equivalent anchor / IAT failure bypass): MUST NOT claim "basic reconnaissance complete", MUST NOT enter workflow 2+ deep-dive conclusions.

Prefer running the built-in script directly:

powershell -File "<skill-root>\radare2\scripts\recon.ps1" -TargetPath "sample.exe"

If only the manual minimal command is needed, use:

rabin2 -I sample.exe
rabin2 -z sample.exe
rabin2 -i sample.exe
rabin2 -E sample.exe

Focus areas:

• File format, bitness, architecture, platform
• Entry point address
• Suspicious strings: URLs, paths, error messages, registry, command-line arguments
• Imported functions: network, file, cryptography, process injection, registry operations (MUST be recorded as Evidence, see the hard gate above）

Workflow 2: Interactive function analysis

r2 sample.exe

Commonly used after entering:

aaa          # 常规自动分析
afl          # 列出函数
iz           # 列出字符串
iS           # 列节区
is           # 列符号
s entry0     # 跳到入口点
pdf          # 反汇编当前函数
VV           # 进入可视化模式（如果终端适合）
q            # 退出

Note:

• Default preference aaa, do not start with the heavier aaaa
• If the sample is very large or analysis is very slow, you can analyze only near the entry point, then manually expand

Workflow 3: Locate main / key logic

afl~main
afl~sym.
iz~http
iz~error
axt <addr>

Approach:

• Start from main, entry point, and string references
• Use axt to find who references a certain string or address
• After finding the reference point, then s <addr>、pdf

Workflow 4: Hex and memory viewing

px 64        # 当前地址起 64 字节十六进制
pd 20        # 反汇编 20 条指令
psz          # 读取当前地址字符串
pxa          # 更友好的十六进制视图

Workflow 5: Binary patch

Use only when the user explicitly requests modifying the file:

r2 -w sample.exe

For example, after entering:

s 0x401000
wa nop
wa jmp 0x401050
wq

Common write operations:

• wa <asm>: write assembly
• wx <hex>: write raw bytes
• wq: write and exit

It is best to back up the original file before modification. If the user did not mention backup, remind them at least once.

Workflow 6: Non-interactive automation

Suitable for one-time output of results:

r2 -A -q -c "afl;iz;ii;q" sample.exe

Common parameters:

• -A: automatically analyze on startup
• -q: quiet mode
• -c: execute command string

If there are many commands, prioritize arranging them into a readable order; do not stuff them into an overlong string that is hard to maintain.

It is more recommended to first use the built-in reconnaissance script as a foundation, then decide whether custom commands need to be added.

Common sub-tools

rabin2

Suitable for static information extraction:

rabin2 -I sample.exe   # 基本信息
rabin2 -S sample.exe   # 节区
rabin2 -s sample.exe   # 符号
rabin2 -i sample.exe   # 导入
rabin2 -E sample.exe   # 导出
rabin2 -z sample.exe   # 字符串
rabin2 -zz sample.exe  # 更详细字符串

rasm2

Suitable for quick assembly/disassembly:

rasm2 -d "9090"
rasm2 -a x86 -b 64 "xor eax, eax"

radiff2

Suitable for comparing two binaries:

radiff2 old.exe new.exe
radiff2 -C old.exe new.exe

rahash2

Suitable for calculating hashes:

rahash2 -a md5 sample.exe
rahash2 -a sha256 sample.exe

rax2

Suitable for base and encoding conversion:

rax2 0x401000
rax2 4198400
rax2 -s hello

Recommended analysis order

When encountering an unknown sample, proceed in this order:

1. rabin2 -I Check the format, architecture, and entry point
2. rabin2 -z Check the strings
3. rabin2 -i Check the imported functions — MUST + Evidence (hard gate, see Workflow 1)
4. If interactive analysis is needed, then enter r2(only if the Evidence from step 3 has been persisted to disk)
5. First aaa, then afl / iz / pdf
6. Gradually locate key functions through string references, import calls, and the entry flow

The advantage of this order is low noise, allowing you to establish a sense of direction as quickly as possible. Step 3 is not an optional optimization; it is a hard gate before entering deep analysis.

Windows considerations

• When there are spaces in the path, the command must be quoted correctly
• If the current terminal cannot find r2, it may be that PATH was just updated; open a new terminal and try again
• Some samples require administrator privileges to read, but by default do not proactively elevate privileges unless the user explicitly needs it
• Before dynamically debugging a suspicious sample, first confirm the user's intent to avoid misoperation

Output style

When the user does not just want commands, but wants you to actually analyze a file:

• First give a summary of the reconnaissance results
• Then list the key evidence: strings, imports, functions, addresses
• Finally give next-step suggestions or continue deeper analysis

Do not just list commands without explaining why to do so.

Typical request examples

Example 1: Analyze an exe

User:帮我看看这个 exe 干了什么，用 radare2 就行

Handling method:

1. First use rabin2 -I/-z/-i
2. determine whether it is necessary to enter r2
3. Use aaa、afl、pdf to deeply dig into the entry and key string references

Example 2: Find where a string is called

User:这个报错字符串在哪个函数里触发的

Handling method:

1. Use iz~关键字 to find the string address
2. Use axt <addr> to find references
3. Jump to reference point s <addr> after pdf

Example 3: Change the jump

User:把这个 jne 改成 je

Handling method:

1. First confirm the target address
2. Clearly inform that you are about to enter write mode
3. Use wa je <target> or directly wx
4. After modification, disassemble again to verify

Practices to avoid

• Do not treat radare2 as only having aaa as a single-command tool
• Do not directly open a user's file in write mode without explaining the risk
• Do not draw conclusions before basic reconnaissance has been done
• It is forbidden to skip the import table check（rabin2 -i / recon imports): if it is not written into Evidence, you must not proceed to the next step; when the user asks to redo the import table, it is forbidden to switch to other steps
• It is forbidden to keep grinding statically after IAT repair fails: Record E-iat-repair-fail Post-transfer dynamics; prohibit using only ImportREC for 64-bit samples
• Do not misdirect web JS reverse engineering to this skill; that is the scope of reverse-engineering scope

Reference materials

• Command quick reference:references/cheatsheet.md
• Standard reconnaissance script:scripts/recon.ps1

radare2-skills ecosystem

The radare2-skills project (radareorg/radare2-skills) provides a more complete ecosystem of tools and workflows:

• r2xsql: SQL query binary import table / strings / functions
• r2mcp / r2http: MCP tools and HTTP stateful command channel
• radius2: symbolic execution, symbolic dynamic analysis
• r2pm: plugin management, extensions
• decompiler plugins: radare2 plugin mechanism

Usage strategy：

• When the user mentions r2xsql、r2mcp、r2http、radius2、r2pm、rabin2、rasm2、radiff2、rahash2、rax2 , prioritize routing to this skill (radare2/SKILL.md)
• These tools are only ecosystem accelerators,cannot bypass: authorization gate,tool-index validation, Evidence import, write mode confirmation
• Provide a minimal reproducible command example:
  • r2xsql -s <file> -q "SELECT ..."
  • curl.exe -sS --data-binary 'aaa' http://127.0.0.1:9393/cmd
  • radius2 -p <binary> ...
  • r2pm -ci <plugin>

This skill maintains the original hard gates and evidence chain integrity, and does not allow skipping any authorization or Evidence steps.

---

Routing context

Upstream entry: skills/SKILL.md(master control),routing.md Upstream alternative: ida-reverse/(upgrade to IDA when decompilation/pseudocode is needed) Downstream exit:

• needs dynamic analysis → reverse-engineering/tools-dynamic.md（Frida/GDB）
• needs deep decompilation → ida-reverse/
• after PAT finds interesting strings and cross-references are needed → ida-reverse/(IDA's xref is more powerful)

Peer-related modules: ida-reverse/(complementary: r2 reconnaissance is fast, IDA decompilation is deep)

On-Demand Bootstrap

This skill's entry script is already connected to the unified bootstrap system. When radare2 is missing, it will not directly report an error; instead, it will automatically attempt installation.

Automation capability boundaries

Tools	Can be automatically installed	Installation method	Description
r2	✓	GitHub Release ZIP (w64)	automatically download and extract to %USERPROFILE%\Tools\radare2\
rabin2	✓	same as above (included in the radare2 distribution package)	—
rasm2	✓	same as above	—
radiff2	✓	same as above	—
rahash2	✓	same as above	—
rax2	✓	same as above	—

Bootstrap trigger point

• scripts/recon.ps1: when missing rabin2 or r2 , automatically call bootstrap-reverse.ps1

When bootstrap fails

If automatic installation fails (network unavailable, GitHub API rate limiting, etc.), the script will throw a clear error and include a manual installation link.

Manual installation: from https://github.com/radareorg/radare2/releases download radare2-*-w64.zip, extract to %USERPROFILE%\Tools\radare2\ and ensure the bin\ directory is in PATH.

Task completion self-check (MUST pass before claiming completion)

• Did I execute every step in the workflow (rather than only reading it)?
• Has the import table check been executed and written to Evidence (E-imports / E-triage-imports or the .NET equivalent)? Do DLL/SYS contain E-exports?
• Was IAT repair failure recorded as E-iat-repair-fail and switched to dynamic? Did redo requests return to the same step?
• Did I base this on tool-index and use the real tool paths?
• Did I produce reproducible evidence (commands/scripts/screenshots/reports)?
• Have I completed and written back the Checklist items required by RULES?

Limitations

• Steep learning curve; terse commands reward experienced users.
• High-level decompilation needs r2ghidra/pdc plugins for readability.

Adapted from zhaoxuya520/reverse-skill (MIT).