Analyze binaries with radare2 CLI for reverse engineering

This skill drives command-line binary analysis with the radare2 toolset - r2, rabin2, rasm2, radiff2, rahash2, rax2 - for quick, scriptable work on exe/dll/so/elf/apk/dex/wasm files without a GUI. It starts by confirming the tooling is actually installed (r2 -v, rabin2 -v) rather than assuming, and ships a built-in recon.ps1 script that produces a first-pass report (file info, sections, imports, exports, strings, optional r2 -A auto-analysis) so the same ad hoc command set isn't rebuilt each time. Before any function-level or dynamic analysis, it enforces a hard gate: the import table must be pulled (rabin2 -i, plus rabin2 -E for DLL/SYS exports) and written down as evidence, including a categorized summary (network/file/crypto/process-injection/registry/other) - an empty or failed import table still has to be logged, never silently skipped, and a packed sample's IAT repair failure gets logged and routed to dynamic API breakpoints instead of endless static retries. It follows a fixed escalation: light recon first (format, architecture, entry point, strings, imports), then aaa auto-analysis and afl/iz/pdf to explore functions and strings, then axt cross-references to trace where a string or address is used. Binary patching (r2 -w, wa/wx/wq) is opened read-only by default and only switches to write mode on explicit request, with a reminder to back up the original file first.

Use it for fast, terminal-based triage or scriptable disassembly, diffing, or light patching of a binary, or when the user asks specifically about rabin2/rasm2/radiff2/rahash2/rax2 usage, batch -c commands, or r2pipe scripting. Route to a separate ida-reverse skill instead when the user explicitly wants a GUI, Hex-Rays-style decompiled pseudocode, or an IDA-centric workflow, and to a separate reverse-engineering skill for web/JS reverse engineering. Do not skip the import-table evidence gate to get to function analysis faster, and do not open a user's binary in write mode without first stating the risk.

• Input: a binary sample path, plus the analysis goal (quick recon, function-level dig, string cross-reference, diff between two binaries, or an explicit patch request).
• Output: a categorized recon summary (format/arch/entry point, strings, imports/exports as logged evidence), located functions and disassembly, cross-reference chains from a string or address back to the calling function, and - for patch requests - a written binary with the change verified by re-disassembling it.

powershell -File "<skill-root>\radare2\scripts\recon.ps1" -TargetPath "C:\path\to\sample.exe"

Core radare2 CLI tools (r2, rabin2, rasm2, radiff2, rahash2, rax2), auto-installed from GitHub Releases when missing. It also routes to the wider radare2-skills ecosystem when a user names it directly: r2xsql (SQL queries over a binary's imports/strings/functions), r2mcp/r2http (MCP and HTTP command channels), radius2 (symbolic execution), and r2pm (plugin management) - all still subject to the same import-table evidence gate and write-mode confirmation.

Reverse engineers, malware analysts, and CTF players who want fast, scriptable command-line binary triage and light patching without booting a full GUI disassembler.