Radare2

Installation

sudo apt install radare2

Basic Syntax

r2 [options] <binary>

Quick Facts

Tool Overview

Radare2 is a free, open-source command-line framework for reverse engineering and binary analysis. It was created in 2010 by the radareorg project and has grown into one of the most powerful and widely used reverse engineering toolkits in the cybersecurity community. Unlike GUI-heavy tools such as Ghidra or IDA Pro, Radare2 is designed from the ground up as a terminal-native application, which makes it fast, lightweight, scriptable, and perfect for headless servers, SSH sessions, and automated analysis pipelines.

At its core, Radare2 bundles four major capabilities into one toolkit: a multi-architecture disassembler that converts machine code back into human-readable assembly, a built-in debugger for stepping through live program execution, a full-featured hex editor for byte-level inspection and patching, and a scripting engine (r2pipe) that exposes the entire toolkit to Python, Ruby, Node.js, Go, and Lua programs. This combination lets a single tool handle the full reverse engineering workflow without switching applications.

Radare2 supports over 30 processor architectures — including x86, x86-64, ARM, ARM64, MIPS, RISC-V, PowerPC, and SPARC — and every major executable format: ELF (Linux), PE (Windows), Mach-O (macOS and iOS), DEX (Android), Java class files, WebAssembly, and raw firmware blobs. This breadth makes it a go-to tool for malware analysts examining Windows PE files, firmware researchers dissecting embedded device images, and CTF players tackling obscure architecture challenges.

The tool is widely used for CTF competitions, quick binary triage, automated malware analysis, binary patching, exploit development, and embedded system research. Its lightweight design means it starts instantly and runs comfortably on minimal hardware, making it ideal for the Kali Linux environment where resources may be constrained. Whether you are a beginner learning your first disassembly commands or an experienced researcher building automated analysis pipelines, Radare2 provides the depth and flexibility to support your workflow.

Common Commands

Step-by-Step Guide

1. 1Open the target binary with auto-analysis using 'r2 -A ./program' so Radare2 identifies functions, strings, and cross-references automatically.
2. 2List all discovered functions with 'afl' to get an overview of the program's structure, then seek to interesting ones with 's sym.main'.
3. 3Disassemble the main function with 'pdf @ main' to read its assembly instructions and understand the program's entry logic.
4. 4Extract strings with 'iz' to find hardcoded file paths, URLs, passwords, or flags that reveal what the binary does.
5. 5Trace cross-references with 'axt' to see which functions call a given import, helping you map data flow through the program.
6. 6Enter visual mode with 'VV' to navigate the control-flow graph interactively, following branches and loops visually.
7. 7Debug the binary live with 'r2 -d ./program', set breakpoints with 'db', and step through execution with 'ds' and 'dc'.
8. 8Save your analysis project with 'P myproject' so you can resume work later without re-analyzing from scratch.

Warnings

• The command structure is dense and relies heavily on single-character and double-character mnemonics — plan to spend time learning the basics.
• Always run 'r2 -A' (or 'aaa' inside a session) before exploring; without analysis most listing commands return empty results.
• Only analyze and debug executables you own or have explicit written permission to investigate. Reverse engineering software you do not own may violate license agreements or law.
• When debugging unknown binaries, use an isolated virtual machine to avoid accidental execution of malicious code on your host system.

Use Cases

Key Features

• Multi-Architecture Disassembler: Supports 30+ CPU architectures including x86, ARM, MIPS, RISC-V, and PowerPC for analyzing any binary.
• Built-in Debugger: Debug binaries locally or remotely with breakpoints, single-stepping, and register inspection.
• Full Hex Editor: Byte-level inspection and patching with read, write, search, and compare capabilities.
• Visual Graph Mode: Interactive ASCII-art control-flow graph for navigating function logic visually in the terminal.
• Multi-Format Support: Handles ELF, PE, Mach-O, DEX, Java class files, WebAssembly, and raw firmware blobs.
• r2pipe Scripting: Control Radare2 from Python, Ruby, Node.js, Go, and Lua for fully automated analysis pipelines.
• Cross-Reference Analysis: Map which functions call which imports and symbols to trace data flow through the program.
• Binary Patching: Modify compiled binaries by writing hex bytes or assembly instructions directly to any address.
• Project Management: Save and restore analysis sessions with named projects to avoid re-analyzing large binaries.
• Lightweight & Fast: Starts instantly and uses minimal RAM, making it ideal for headless servers and SSH sessions.

Best Practices

• Always open binaries with 'r2 -A' to trigger automatic analysis — without it, function and string listings return empty results:
• Start every session by running 'afl' to get a function overview, then 'ii' for imports and 'iz' for strings to build a mental map before diving into disassembly:
• Use visual graph mode ('VV') to understand control flow — it is far easier to follow branches visually than reading flat linear disassembly:
• Rename identified functions with 'afn descriptive_name @ addr' as you work, so your analysis accumulates meaningful labels instead of raw addresses:
• Add comments at key instructions with 'CC your note @ addr' to document your reasoning and findings for future reference:
• Save analysis projects with 'P projectname' after significant work so you can resume without re-analyzing from scratch:
• Use 'axt' to trace cross-references before diving into a function — knowing who calls it provides critical context for understanding its purpose:
• When analyzing malware, always work in an isolated VM with snapshots and no network access to production systems:
• Combine static analysis ('pdf', 'iz', 'ii') with dynamic debugging ('db', 'ds', 'dr') — static shows structure, dynamic reveals actual runtime behavior:
• Use r2pipe scripts for repetitive tasks like batch analysis of multiple binaries, automated string extraction, or cross-reference mapping:
• Keep Radare2 updated to the latest version for new architecture support, bug fixes, and analysis improvements:
• Learn the command structure systematically — commands are grouped by first letter (a=analysis, p=print, s=seek, /=search, d=debug) which helps discovery:
• Use 'izz' instead of 'iz' when searching for strings in all sections including code, not just data sections:
• When patching binaries, always work on a copy of the original file and use 'r2 -w' to enable write mode:
• Combine Radare2 with complementary tools: Ghidra for decompilation, Binwalk for firmware extraction, and Frida for runtime instrumentation:

Common Errors

Related Tools

Frequently Asked Questions

Tags

Output Explanation

Radare2 presents an interactive terminal interface. After running 'afl' you see a numbered table of functions with their addresses, sizes, and names — for example '0x00400546  12  main'. The 'pdf' command outputs a vertical block of assembly instructions with address prefixes, opcodes, and operand annotations. Hex dumps ('px') display raw bytes in a classic offset-hex-ASCII layout. Visual mode ('VV') replaces the terminal with an interactive ASCII-art control-flow graph where nodes represent basic blocks and arrows show jump targets. All output is text-based, which makes it easy to copy, grep, or pipe into other tools.