radare2

Analyze binaries with radare2 CLI for disassembly, strings, imports, and patching.

21|8|Updated Aug 3, 2026
One-click install
npx skills add https://github.com/chengzongcai/reverse-skill-backup --skill radare2-chengzongcai
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: radare2
Source: https://github.com/chengzongcai/reverse-skill-backup/tree/main/skills/radare2
Command: npx skills add https://github.com/chengzongcai/reverse-skill-backup --skill radare2-chengzongcai

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) components.

What problem does it solve? Reverse engineering binaries from the command line often means guessing the right radare2 commands and flags. This Skill provides a repeatable workflow for reconnaissance, function analysis, string cross-referencing, and binary patching with r2, rabin2, rasm2, radiff2, rahash2, and rax2 on PE, ELF, Mach-O, DEX, and WASM files. ## Core Features & Use Cases - Standard Recon Script: Run the bundled recon script to get file info, sections, imports, exports, and strings in one pass, with optional r2 auto-analysis. - Interactive Analysis Workflows: Guided command sequences for locating main, tracing string references with axt, disassembling functions with pdf, and hex inspection. - Binary Patching & Diffing: Safe write-mode patching with wa/wx, plus binary comparison via radiff2 and hashing via rahash2. - Use Case: You receive a suspicious sample.exe. Run the recon script to identify architecture, entry point, suspicious strings, and network-related imports, then jump into r2 to disassemble the functions referencing those strings. ## Quick Start Ask the AI to analyze a binary file with radare2, for example: use radare2 to inspect sample.exe and tell me what it does.

Frequently Asked Questions about radare2

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I analyze an exe file with radare2 from the command line?▼

Start with rabin2 -I for file info, rabin2 -z for strings, and rabin2 -i for imports. Then open the file with r2, run aaa for auto-analysis, and use afl to list functions and pdf to disassemble them.

How to find which function references a string in radare2?▼

Use iz~keyword to locate the string's address, then run axt <addr> to find cross-references pointing to it. Jump to the referencing address with s <addr> and disassemble the surrounding function with pdf.

radare2 vs IDA for reverse engineering, which should I use?▼

radare2 is suited for fast CLI reconnaissance, scripting, and lightweight patching without a GUI. IDA is preferable when you need Hex-Rays style pseudocode decompilation and richer cross-reference visualization.

Does radare2 work on Windows, Linux, and macOS?▼

Yes, radare2 runs on all three platforms and analyzes PE, ELF, Mach-O, DEX, and WASM files. On Windows it can be auto-installed from the GitHub release ZIP into the user Tools directory.

How do I patch a binary with radare2 without corrupting it?▼

Open the file in write mode with r2 -w only after confirming the target address, then use wa to write assembly or wx to write raw bytes. Back up the original file first and re-disassemble afterward to verify the change.

Why does rabin2 show an sdb file missing error on Windows?▼

This warning about missing format dll sdb files is a known cosmetic issue on some Windows installs. If the main output still returns normally, the reconnaissance results are valid and analysis can continue.