radare2: A framework for reverse engineering and analyzing binaries

Reverse engineering has a steep learning curve, and I remember staring at radare2’s prompt for the first time completely lost. Once the command structure clicked, though, it became one of the most versatile tools in my binary analysis workflow — free, scriptable, and capable of handling nearly any file format I throw at it. Here’s my full breakdown.

What Is radare2?

radare2 (often shortened to r2) is a free and open-source framework for reverse engineering and binary analysis. It supports disassembly, debugging, binary patching, forensic analysis of file formats, and scripting across a huge range of architectures (x86, ARM, MIPS, PowerPC, and more) and file formats (ELF, PE, Mach-O, and others).

Unlike GUI-heavy tools like IDA Pro or Ghidra, radare2 is command-line first, which makes it lightweight, scriptable, and ideal for automation in CTFs, malware analysis labs, and forensic investigations.

Architecture and Internal Working

radare2 is built around a modular library architecture:

• libr_core – the central engine tying everything together.
• libr_asm / libr_anal – handle disassembly and code analysis (function detection, cross-references, control flow graphs).
• libr_bin – parses binary file formats (ELF, PE, Mach-O, etc.) to extract sections, symbols, and imports/exports.
• libr_debug – provides a built-in debugger for dynamic analysis, supporting breakpoints, register inspection, and memory manipulation.
• libr_io – abstracts I/O so r2 can operate on local files, remote debuggers, or even raw memory dumps identically.

Its interface is command-driven: everything from seeking addresses to renaming functions happens through short, composable commands (e.g., pd, afl, s), which is what makes it so scriptable.

Installation

sudo apt install radare2

Or build the latest version from source:

git clone https://github.com/radareorg/radare2
cd radare2
sys/install.sh

Verify installation:

r2 -v

Basic Syntax

r2 [options] <file>

Practical Command Examples (Authorized Lab / CTF Binaries Only)

1. Opening a binary for analysis:

r2 ./sample_binary

2. Running full auto-analysis:

[0x00001060]> aaa

3. Listing all detected functions:

[0x00001060]> afl

Sample output:

0x00001060    1 42   entry0
0x00001149   10 210  main
0x00001040    1 6    sym.imp.puts

4. Disassembling a specific function:

[0x00001060]> pdf @ main

5. Viewing a graph of the control flow:

[0x00001060]> agf @ main

6. Searching for a string in the binary:

[0x00001060]> / password

7. Entering debug mode and setting a breakpoint:

r2 -d ./sample_binary

[0x7f...]> db main
[0x7f...]> dc

8. Patching a byte at a given address:

[0x00001060]> s 0x0000117a
[0x0000117a]> wx 90

9. Batch/scripted analysis (non-interactive):

r2 -q -c "aaa; afl" ./sample_binary

10. Extracting strings:

rabin2 -z ./sample_binary

Key Sub-Tools in the radare2 Suite

Real-World Use Cases

• Malware analysis: Statically analyzing a suspicious binary’s imports and strings before safely detonating it in a sandbox.
• CTF reverse engineering challenges: Quickly identifying key functions and control flow in crackme-style binaries.
• Digital forensics: Diffing two versions of a binary (radiff2) to identify what an attacker modified.
• Firmware analysis: Disassembling embedded device firmware to find hardcoded credentials or backdoors.
• Exploit development: Analyzing binary protections (NX, ASLR, canaries) with rabin2 -I before crafting a proof-of-concept exploit in a lab.

Integration with Other Tools

• Ghidra: Many analysts export Ghidra’s decompiled output and cross-check function boundaries against r2’s afl output.
• GDB: r2’s debugger can work alongside or instead of GDB; r2 -d gives a similar experience with r2’s analysis engine layered on top.
• Cutter: The official GUI front-end for radare2, useful when you want visual graphs without leaving r2’s analysis engine.
• YARA: Combine string/pattern findings from r2 with YARA rule creation for malware detection signatures.

Performance Optimization

• Use aa instead of aaa for faster (if less thorough) initial analysis on large binaries.
• Save analysis state with Ps <name> (project save) so you don’t have to re-run analysis every session.
• Use e asm.lines=false and similar display options to declutter output and speed up scrollback on large disassemblies.

Troubleshooting

• Analysis taking too long on large binaries: Drop from aaa to aa, or use e anal.timeout to cap analysis time.
• Symbols not resolving: Ensure debug symbols aren’t stripped; if they are, rely on afl and manual function renaming (afn).
• r2 command not found after building from source: Re-run sys/install.sh and ensure /usr/local/bin is in your $PATH.

Best Practices

• Always analyze unknown/suspicious binaries in an isolated VM or sandbox with no network access.
• Use r2 -w only when you intend to patch — otherwise open binaries read-only to avoid accidental modification.
• Save your working state frequently with Ps during long reverse engineering sessions.
• Document function renames (afn) and comments (CC) as you go — r2 projects can get complex fast.

Common Mistakes

1. Running aaa on very large binaries without patience or without setting an analysis timeout.
2. Forgetting -d when you intend to debug rather than statically analyze — leads to confusion about why breakpoints don’t work.
3. Not using visual mode (V) or graph mode (VV), missing out on radare2’s genuinely useful interactive views.
4. Analyzing malware without proper sandboxing/isolation.

FAQ

Is radare2 as good as IDA Pro or Ghidra? It’s different rather than strictly better or worse — r2 is free, scriptable, and CLI-first, while IDA/Ghidra offer more polished decompilation. Many analysts use r2 alongside them.

Does radare2 have a decompiler? Yes, via the r2dec or r2ghidra plugins, which can be installed separately.

Can radare2 analyze non-x86 architectures? Yes — ARM, MIPS, PowerPC, SPARC, RISC-V, and many others are supported.

Is there a GUI for radare2? Yes, Cutter is the official Qt-based GUI front-end.

Lab Example

1. Download a simple “crackme” binary from a legal CTF archive (e.g., crackmes.one).
2. Run r2 -A ./crackme to auto-analyze on load.
3. Use afl to list functions, then pdf @ main to read the main logic.
4. Identify the comparison logic gating the “success” branch.
5. Use wx to patch a conditional jump and observe the changed program behavior (in your own sandboxed copy only).

Summary

radare2 is a powerful, free, and highly scriptable reverse engineering framework that rewards the investment in learning its command syntax. From malware triage to CTF challenges to firmware analysis, it’s flexible enough to fit almost any binary analysis workflow, especially when combined with tools like Cutter, Ghidra, or YARA.

References

• Official documentation: https://book.rada.re/
• GitHub repository: https://github.com/radareorg/radare2
• Cutter GUI: https://cutter.re/