radare2

Open binary for analysis

$ r2 [binary]

$ r2 -w [binary]

$ r2 -s [0x1000] [binary]

$ r2 -d [binary]

$ r2 -A [binary]

$ r2 -n [binary]

$ r2 -d [pid]

$ r2 -qc "[pdf]" [binary]

r2 [-Adnw] [-s addr] [-c cmd] [options] file

radare2 (r2) is an open-source reverse engineering framework for binary analysis, debugging, and exploitation. It disassembles, analyzes, and patches binaries across many architectures and formats.
The tool operates through a command-line interface with hundreds of commands. Commands are typically short mnemonics: 'p' for print, 'a' for analyze, 's' for seek. Help is available by appending '?' to any command prefix.
Analysis identifies functions, strings, cross-references, and control flow. The 'aaa' command performs comprehensive analysis. Results populate databases queryable through commands.
Visual modes provide cursor-based navigation and graph views. Function graphs show control flow with block connections. Hex editing mode enables direct binary modification.
Debugging integrates natively, attaching to processes or launching programs. Breakpoints, stepping, register manipulation, and memory inspection work across supported platforms.
Scripting uses r2pipe for external automation (Python, JavaScript, etc.) or internal radare2 scripts. Extensive plugin API enables custom analysis.

-A

Analyze all referenced code.

Set architecture.

Set bit size (16, 32, 64).

Execute command.

Debug mode.

No analysis on load.

Open in write mode.

Seek to address.

Quiet mode, exit after -c commands.

Run script file.

Use project file.

Set configuration option.

~/.radare2rc

Startup configuration file executed on launch, containing default settings and commands to run automatically.

Runtime configuration variables controlling analysis depth, display format, and tool behavior. Use `e??` inside r2 to list all options.

Project files saving analysis state including function names, comments, and flags for resuming work on a binary.

pdf

Disassemble function.

List functions.

Analyze all.

Seek to address.

Enter visual mode.

Enter graph mode.

Print N bytes as hex.

Set breakpoint.

Continue execution.

Show registers.

Show help.

Quit.

Steep learning curve - command syntax takes time to master. Documentation can be sparse. Analysis may miss obfuscated code. Some features platform-specific. Memory usage grows with analysis depth. Competing with Ghidra/IDA on features.

radare2 was created by pancake (Sergi Alvarez) around 2006, evolving from the original radare. It grew from a hex editor to a full reverse engineering platform. The project emphasizes freedom, portability, and Unix philosophy. Despite its complexity, it has a dedicated community and is used in CTF competitions and security research.

objdump(1), gdb(1), ltrace(1), strace(1)