radare2

radare2

Binary analysis skill for the radare2 CLI. The focus is on completing reconnaissance, analysis, locating, exporting, and lightweight modification directly with command-line tools, without relying on a GUI.

Scope

Use this skill first when the user has these intentions:

• Wants to use r2 / radare2 to analyze exe、dll、so、elf、apk、dex、wasm and other files
• Asks how to use rabin2、rasm2、radiff2、rahash2、rax2 How to use
• Needs command-line disassembly, viewing functions, viewing strings, viewing imports and exports, checking cross-references, or doing patches
• Needs to write radare2 batch commands,-c automation commands, or r2pipe scripts

If the user explicitly wants GUI reverse engineering, Hex-Rays-style pseudocode, or an IDA workflow, consider ida-reversefirst. If it is web JS reverse engineering, consider reverse-engineering。

First confirm the environment

Do not assume r2 is available first. Check first:

r2 -v
rabin2 -v

If it is not installed, then check common installation locations or prompt for installation.

Common Windows executables:

• radare2.exe
• rabin2.exe
• rasm2.exe
• radiff2.exe
• rahash2.exe
• rax2.exe
• r2pm.exe

Built-in resources

This skill comes with two resources. Reuse them first; do not assemble a duplicate set of commands each time.

scripts/recon.ps1

Standard reconnaissance script, suitable for doing a first round of general analysis. It outputs:

• Basic information
• Sections
• Imports
• Exports
• Strings
• Optional r2 -A automatic analysis summary

How to invoke:

powershell -File "<skill-root>\radare2\scripts\recon.ps1" -TargetPath "C:\path\to\sample.exe"

If you need to include r2 automatic analysis:

powershell -File "<skill-root>\radare2\scripts\recon.ps1" -TargetPath "C:\path\to\sample.exe" -RunAnalysis

references/cheatsheet.md

When you need more command details, common scenario templates, or to quickly recall syntax, read this cheat sheet instead of guessing from memory.

Known phenomena

Occasional .sdb missing warnings on Windows

When some PE files are being reconnoitered with rabin2 , warnings like the following may appear:

ERROR: Cannot find ...\share\format\dll\*.sdb

If the main output still returns normally, it usually does not affect the basic reconnaissance conclusions; just continue the analysis. Do not directly judge the analysis as failed because of this kind of incidental warning.

Basic principles

1. Reconnoiter first, dig deeper later

Do not start with full automatic analysis right away. First use lightweight commands to confirm the file type, architecture, entry point, strings, and import table, then decide whether to do aaa、aaaa or targeted analysis.

2. Prefer the minimum sufficient command

radare2 There are many

• commands, and users usually only need the shortest path:rabin2 -I
• View file information:rabin2 -z
• View strings:rabin2 -i / rabin2 -E
• View imports and exports:r2 <file> Interactive analysis: execute local commands after

3. Be cautious before modifying

If the user wants to patch a binary:

• By default, open read-only first:r2 <file>
• Only use write mode when modification is clearly needed:r2 -w <file> or in a session oo+
• Warn about the risks before modifying, to avoid accidentally overwriting the original file

Common workflows

Workflow 1: Quick reconnaissance

Suitable when you have just obtained a binary file.

Prefer running the built-in script directly:

powershell -File "<skill-root>\radare2\scripts\recon.ps1" -TargetPath "sample.exe"

If you only need the minimal manual commands, use:

rabin2 -I sample.exe
rabin2 -z sample.exe
rabin2 -i sample.exe
rabin2 -E sample.exe

Focus points:

• File format, bitness, architecture, platform
• Entry point address
• Suspicious strings: URLs, paths, errors, registry, command-line arguments
• Import functions: networking, files, cryptography, process injection, registry operations

Workflow 2: Interactive function analysis

r2 sample.exe

Commonly used after entering:

aaa          # 常规自动分析
afl          # 列出函数
iz           # 列出字符串
iS           # 列节区
is           # 列符号
s entry0     # 跳到入口点
pdf          # 反汇编当前函数
VV           # 进入可视化模式（如果终端适合）
q            # 退出

Note:

• Default priority aaa, don't start with the heavier aaaa
• If the sample is very large or analysis is slow, you can analyze only near the entry point, then manually expand

Workflow 3: Locating main / key logic

afl~main
afl~sym.
iz~http
iz~error
axt <addr>

Approach:

• Start with main, entry point, string references
• Use axt to find who references a certain string or address
• After finding the reference point, then s <addr>、pdf

Workflow 4: Hexadecimal and memory viewing

px 64        # 当前地址起 64 字节十六进制
pd 20        # 反汇编 20 条指令
psz          # 读取当前地址字符串
pxa          # 更友好的十六进制视图

Workflow 5: Binary patching

Use only when the user explicitly requests modifying the file:

r2 -w sample.exe

After entering, for example:

s 0x401000
wa nop
wa jmp 0x401050
wq

Common write operations:

• wa <asm>: write assembly
• wx <hex>: write raw bytes
• wq: write and exit

Before modifying, it's best to back up the original file first. If the user didn't mention backup, at least remind them once.

Workflow 6: Non-interactive automation

Suitable for one-time output results:

r2 -A -q -c "afl;iz;ii;q" sample.exe

Common parameters:

• -A: automatically analyze on startup
• -q: quiet mode
• -c: execute command string

If there are many commands, prioritize organizing them into a readable order; don't stuff in a super-long string that's hard to maintain.

It's more recommended to first use the built-in reconnaissance script as a base, then decide whether to add custom commands.

Common subtools

rabin2

Suitable for static information extraction:

rabin2 -I sample.exe   # 基本信息
rabin2 -S sample.exe   # 节区
rabin2 -s sample.exe   # 符号
rabin2 -i sample.exe   # 导入
rabin2 -E sample.exe   # 导出
rabin2 -z sample.exe   # 字符串
rabin2 -zz sample.exe  # 更详细字符串

rasm2

Suitable for quick assembly/disassembly:

rasm2 -d "9090"
rasm2 -a x86 -b 64 "xor eax, eax"

radiff2

Suitable for comparing two binaries:

radiff2 old.exe new.exe
radiff2 -C old.exe new.exe

rahash2

Suitable for computing hashes:

rahash2 -a md5 sample.exe
rahash2 -a sha256 sample.exe

rax2

Suitable for base and encoding conversion:

rax2 0x401000
rax2 4198400
rax2 -s hello

Recommended analysis order

When encountering an unknown sample, do it in this order:

1. rabin2 -I Check format, architecture, entry point
2. rabin2 -z Check strings
3. rabin2 -i Check import functions
4. If interactive analysis is needed, then enter r2
5. First aaa, then afl / iz / pdf
6. Gradually locate key functions through string references, import calls, and the entry flow

The advantage of this order is low noise, allowing you to build a sense of direction as quickly as possible.

Windows notes

• When there are spaces in the path, the command must be correctly quoted
• If the current terminal cannot find r2, it may be that PATH was just updated, open a new terminal and try again
• Some samples require administrator privileges to read, but by default do not actively elevate privileges unless the user explicitly needs it
• Before doing dynamic debugging on suspicious samples, first confirm the user's intent to avoid misoperation

Output style

When the user doesn't just want commands, but wants you to actually analyze a file:

• First give a summary of the reconnaissance results
• Then list the key evidence: strings, imports, functions, addresses
• Finally give next-step suggestions or continue deeper analysis

Don't just list commands without explaining why you're doing it.

Typical request examples

Example 1: Analyze an exe

User:帮我看看这个 exe 干了什么，用 radare2 就行

Handling method:

1. First use rabin2 -I/-z/-i
2. to determine whether it is necessary to enter r2
3. Use aaa、afl、pdf Dig deeper into the entry point and key string references

Example 2: Find where the string is called

User:这个报错字符串在哪个函数里触发的

Approach:

1. Use iz~关键字 to find the string address
2. Use axt <addr> to find references
3. Jump to the reference point s <addr> then pdf

Example 3: Change the jump

User:把这个 jne 改成 je

Approach:

1. First confirm the target address
2. Clearly state that write mode will be entered
3. Use wa je <target> or directly wx
4. After modifying, disassemble again to verify

Practices to avoid

• Do not treat radare2 as a tool with only aaa one command
• Do not open a user file in write mode without explaining the risk
• Do not draw conclusions before doing basic reconnaissance
• Do not mislead web JS reverse engineering into this skill; that is within the scope of reverse-engineering scope of

Reference materials

• Command quick reference:references/cheatsheet.md
• Standard reconnaissance script:scripts/recon.ps1

---

Routing context

Upstream entry: skills/SKILL.md(master control),routing.md Upstream alternative: ida-reverse/(upgrade to IDA when decompilation/pseudocode is needed) Downstream exit:

• Needs dynamic analysis → reverse-engineering/tools-dynamic.md（Frida/GDB）
• Needs deep decompilation → ida-reverse/
• After PAT finds an interesting string, cross-references are needed → ida-reverse/(IDA's xref is more powerful)

Sibling related modules: ida-reverse/(complementary: r2 reconnaissance is fast, IDA decompilation is deep)

---

On-Demand Bootstrap

This skill's entry script is connected to the unified bootstrap system. When radare2 is missing, it will not directly error out but will automatically try to install it.

Automation capability boundaries

Tool	Can be installed automatically	Installation method	Description
r2	✓	GitHub Release ZIP (w64)	Automatically download and extract to %USERPROFILE%\Tools\radare2\
rabin2	✓	Same as above (included in the radare2 distribution package)	—
rasm2	✓	Same as above	—
radiff2	✓	Same as above	—
rahash2	✓	Same as above	—
rax2	✓	Same as above	—

Bootstrap trigger point

• scripts/recon.ps1: when rabin2 or r2 is missing, automatically call bootstrap-reverse.ps1

When bootstrap fails

If automatic installation fails (no network, GitHub API rate limiting, etc.), the script will throw a clear error with a manual installation link.

Manual installation: from https://github.com/radareorg/radare2/releases download radare2-*-w64.zip, extract to %USERPROFILE%\Tools\radare2\ and ensure the bin\ directory is in PATH.