Analyze binaries with radare2 CLI for reverse engineering

radare2 is a skill for driving the radare2 CLI for binary reconnaissance, disassembly, analysis, function locating, export and lightweight patching (r2/rabin2/rasm2/radiff2) without a GUI. It applies when analyzing exe/dll/so/elf/apk/dex/wasm files from the command line, asking how rabin2/rasm2/radiff2/rahash2/rax2 work, or writing batch -c automation or r2pipe scripts. If the user wants GUI reversing or Hex-Rays-style pseudocode, it defers to an IDA-focused skill; for web JS reverse engineering, it defers to a general reverse-engineering skill.

It first confirms the environment rather than assuming r2 is available (r2 -v, rabin2 -v), and ships two built-in resources it reuses rather than re-composing commands each time: scripts/recon.ps1, a standard first-pass recon script outputting basic file info, sections, imports, exports, strings and an optional r2 -A auto-analysis summary; and references/cheatsheet.md, a command quick-reference. A known benign quirk: some PE files trigger a .sdb format-database warning during rabin2 recon that does not usually affect the main output or invalidate the recon conclusion.

Its core principles: reconnaissance before deep analysis (confirm file type, architecture, entry point, strings and imports with lightweight commands before running full auto-analysis); minimal-sufficient commands (rabin2 -I for file info, rabin2 -z for strings, rabin2 -i/-E for imports/exports); and caution before modification (open read-only by default, only switch to write mode r2 -w when a change is explicitly requested, and warn before risking an overwrite). A hard gate before workflow 2+: on PE/ELF/Mach-O binaries, the import table must be checked (rabin2 -i, plus rabin2 -E for DLL/SYS exports) and recorded as evidence - including the command, a categorized summary (network/file/crypto/process-injection/registry/other), and any failure or empty result - before claiming basic recon is complete or moving to function-level analysis; a suspiciously clean import table should be flagged for dynamic API tracing instead; on a packed sample where IAT repair fails (ImportREC on x86, Scylla on x64), the rule is to record that failure and pivot to dynamic API breakpoints rather than keep retrying static IAT repair indefinitely.

Six workflows: quick recon (the built-in script, or manual rabin2 -I/-z/-i/-E); interactive function analysis (r2 <file> then aaa, afl, iz, iS, is, s entry0, pdf); locating main or key logic (afl~main, iz~http/~error to find string references, axt <addr> to find who references them); hex and memory viewing (px, pd, psz, pxa); binary patching, only when explicitly requested, opening in write mode (r2 -w) and using wa/wx/wq, with a reminder to back up the original file first; and non-interactive automation for one-shot output (r2 -A -q -c "afl;iz;ii;q"). A recommended analysis order for an unknown sample: file info, strings, imports (the hard evidence gate), then interactive aaa/afl/pdf, then follow string and import references to key functions.

Its named sub-tools: rabin2 for static extraction (info, sections, symbols, imports, exports, strings), rasm2 for quick assembly/disassembly, radiff2 for comparing two binaries, rahash2 for hashing, and rax2 for base/encoding conversion. It also routes ecosystem tools from the radare2-skills project to this same skill when mentioned: r2xsql (SQL queries over a binary's imports/strings/functions), r2mcp/r2http (MCP and stateful HTTP command channels), radius2 (symbolic execution) and r2pm (plugin management) - noting these accelerate the workflow but do not bypass the authorization gate, tool-index verification, or the import-table evidence requirement.

On Windows it notes to quote paths containing spaces, to open a new terminal if PATH was just updated, to avoid elevating privileges unless explicitly needed, and to confirm intent before dynamic debugging of a suspicious sample. Its entry script is wired into a unified bootstrap system: a missing r2/rabin2 triggers an automatic download-and-install attempt from the official GitHub release rather than an immediate error, falling back to a manual install link if that fails.

Use it for quick terminal-based analysis of a binary without a heavy IDE, or for scriptable disassembly, diffing or small binary patches. Prefer an IDA-focused skill for GUI reversing or decompiled pseudocode, and a general reverse-engineering skill for web JS analysis; radare2 has a steep learning curve and needs plugins like r2ghidra for readable high-level decompilation.

Input is a binary file (exe/dll/so/elf/apk/dex/wasm). Output is a documented recon summary (format, architecture, entry point, strings, imports/exports with evidence), located functions or string cross-references, and, when explicitly requested, a patched binary.

It complements an IDA-focused skill for deeper decompilation and a dynamic-analysis skill (Frida/GDB) for runtime tracing, and routes radare2-skills ecosystem tools (r2xsql, r2mcp, r2http, radius2, r2pm) to itself when the user names them.

It suits reverse engineers who want fast, scriptable, command-line binary analysis without opening a full IDE.