radare2

Binary analysis skill for

radare2

CLI. Focuses directly on reconnaissance, analysis, localization, extraction, and lightweight modification via the command line, without relying on GUI.

ACTION REQUIRED（读完后立刻执行）

```
NOW
```
: Read
```
../field-journal/precedent-reverse.md
```
— Confirm that the operations of this skill are authorized routine actions
```
NOW
```
: Confirm whether the current task falls within the scope of this skill
```
NEXT
```
: Read
```
../tool-index.md
```
to verify tool availability and actual paths
```
NEXT
```
: Call bootstrap when tools are missing; do not guess paths
```
ACT
```
: Proceed to the first step of the "Workflow" and execute it; do not stay in the confirmation state

Scope of Application

Prioritize using this skill when the user has the following intentions:

Analyze files such as
```
exe
```
,
```
dll
```
,
```
so
```
,
```
elf
```
,
```
apk
```
,
```
dex
```
,
```
wasm
```
using
```
r2
```
/
```
radare2
```
Ask how to use
```
rabin2
```
,
```
rasm2
```
,
```
radiff2
```
,
```
rahash2
```
,
```
rax2
```
Need command-line disassembly, function inspection, string viewing, import/export inspection, cross-reference checking, and patching
Need to write
```
radare2
```
batch commands,
```
-c
```
automation commands, or
```
r2pipe
```
scripts

If the user explicitly requests GUI reverse engineering, Hex-Rays-style pseudocode, or IDA workflows, prioritize

ida-reverse

. For web JS reverse engineering, prioritize

reverse-engineering

Environment Confirmation First

Do not assume

r2

is available. First check:

powershell

r2 -v
rabin2 -v

If not installed, check common installation locations or prompt installation.

Common executable files on Windows:

```
radare2.exe
```
```
rabin2.exe
```
```
rasm2.exe
```
```
radiff2.exe
```
```
rahash2.exe
```
```
rax2.exe
```
```
r2pm.exe
```

Built-in Resources

This skill comes with two built-in resources; prioritize reusing them instead of creating a new set of repetitive commands each time.

scripts/recon.ps1

Standard reconnaissance script, suitable for initial overview analysis. It outputs:

Basic information
Sections
Imports
Exports
Strings
Optional
```
r2 -A
```
automatic analysis summary

Calling method:

powershell

powershell -File "<skill-root>\radare2\scripts\recon.ps1" -TargetPath "C:\path\to\sample.exe"

r2

automatic analysis is required:

powershell

powershell -File "<skill-root>\radare2\scripts\recon.ps1" -TargetPath "C:\path\to\sample.exe" -RunAnalysis

references/cheatsheet.md

When more command details, common scenario templates, or quick syntax recall are needed, read this cheatsheet instead of guessing from memory.

Known Phenomena

Occasional

.sdb

Missing Alerts on Windows

When reconnoitering certain PE files with

rabin2

, alerts similar to the following may appear:

text

ERROR: Cannot find ...\share\format\dll\*.sdb

If the main output is still returned normally, it usually does not affect the basic reconnaissance conclusion; continue the analysis first. Do not directly conclude that the analysis failed due to such incidental alerts.

Basic Principles

1. Reconnaissance First, In-Depth Analysis Later

Do not perform full automatic analysis right away. First use lightweight commands to confirm the file type, architecture, entry point, strings, and import table, then decide whether to perform

aaa

aaaa

, or targeted analysis.

2. Prioritize Minimal Sufficient Commands

radare2

has numerous commands; users usually only need the shortest path:

View file information:
```
rabin2 -I
```
View strings:
```
rabin2 -z
```
View imports/exports:
```
rabin2 -i
```
/
```
rabin2 -E
```
Interactive analysis: Execute local commands after
```
r2 <file>
```

3. Be Cautious Before Modification

If the user wants to patch a binary:

Open in read-only mode by default:
```
r2 <file>
```
Only use write mode when modification is explicitly needed:
```
r2 -w <file>
```
or
```
oo+
```
in the session
Inform the user of risks before modification to avoid unintentionally overwriting the original file

Common Workflows

Workflow 1: Quick Reconnaissance

Suitable when you just get a binary file.

Hard Gate (MUST — Prohibited from entering Workflow 2 and subsequent steps if not satisfied)

For binaries with import tables such as PE/ELF/Mach-O, MUST complete the import table check and record it as Evidence before proceeding to function-level analysis or dynamic steps:

Execute
```
rabin2 -i <sample>
```
(or the imports section in the
```
recon.ps1
```
output); for DLL/SYS files, additionally MUST execute
```
rabin2 -E
```
and record it as
```
E-exports
```
Write the complete/classified import table results into Evidence (recommended ID:
```
E-imports
```
or
```
E-triage-imports
```
), which must include at least:
- Reproduction command (
```
repro_command
```
  )
- Summary of key import categories: Network / File / Encryption / Process Injection / Registry / Other Suspicious APIs
- If the import table is empty, parsing fails, or the tool reports an error: STILL MUST record the failure phenomenon and original output as Evidence, silent skipping is prohibited
- If the import table is "too clean" (only basic DLLs): MUST note the suspicion of dynamic loading, SHOULD switch to dynamic API capturing
For .NET and other files without traditional IAT: MUST use equivalent anchors (dnSpy/IL/metadata summary) and write to the same Evidence semantic slot; empty skipping is prohibited
IAT repair for packed samples: Use ImportREC (or equivalent) for x86, Scylla (or equivalent) for x64. If repair fails, MUST record
```
E-iat-repair-fail
```
and switch to dynamic API breakpoints; prohibited to endlessly struggle with static IAT (see
```
reverse-engineering/references/re-agent-workflow.md
```
§1.2)
When the user explicitly requests "redo import table check / recheck import table / redo IAT": MUST redo the specified step itself (if blocked, first go through the feasibility latch: explain prerequisites + request confirmation; if forced, mark quality=unreadable), prohibited to replace with irrelevant steps to pretend completion

Before recording the import table (or legal equivalent anchor / IAT failure bypass) as Evidence: MUST NOT claim "basic reconnaissance is completed", MUST NOT proceed to in-depth conclusions in Workflow 2+.

Prioritize running the built-in script directly:

powershell

powershell -File "<skill-root>\radare2\scripts\recon.ps1" -TargetPath "sample.exe"

If only manual minimal commands are needed, use:

powershell

rabin2 -I sample.exe
rabin2 -z sample.exe
rabin2 -i sample.exe
rabin2 -E sample.exe

Focus points:

File format, bitness, architecture, platform
Entry point address
Suspicious strings: URLs, paths, error messages, registry entries, command-line parameters
Imported functions: Network, file, encryption, process injection, registry operations (MUST record as Evidence, see the hard gate above)

Workflow 2: Interactive Function Analysis

powershell

r2 sample.exe

Common commands after entering:

text

aaa          # Regular automatic analysis
afl          # List functions
iz           # List strings
iS           # List sections
is           # List symbols
s entry0     # Jump to entry point
pdf          # Disassemble current function
VV           # Enter visualization mode (if terminal supports)
q            # Exit

Notes:

Prioritize
```
aaa
```
by default; do not use the heavier
```
aaaa
```
at the beginning
If the sample is large or analysis is slow, you can only analyze the area near the entry point first, then expand manually

Workflow 3: Locate main / Key Logic

text

afl~main
afl~sym.
iz~http
iz~error
axt <addr>

Approach:

Start with
```
main
```
, entry point, and string references
Use
```
axt
```
to check who references a certain string or address
After finding the reference point, use
```
s <addr>
```
and
```
pdf
```

Workflow 4: Hexadecimal and Memory Viewing

text

px 64        # 64 bytes of hexadecimal starting from current address
pd 20        # Disassemble 20 instructions
psz          # Read string at current address
pxa          # More user-friendly hexadecimal view

Workflow 5: Binary Patching

Only use when the user explicitly requests file modification:

powershell

r2 -w sample.exe

For example after entering:

text

s 0x401000
wa nop
wa jmp 0x401050
wq

Common write operations:

```
wa <asm>
```
: Write assembly
```
wx <hex>
```
: Write raw bytes
```
wq
```
: Write and exit

It is best to back up the original file before modification. If the user does not mention backup, remind them at least once.

Workflow 6: Non-Interactive Automation

Suitable for one-time result output:

powershell

r2 -A -q -c "afl;iz;ii;q" sample.exe

Common parameters:

```
-A
```
: Automatic analysis on startup
```
-q
```
: Quiet mode
```
-c
```
: Execute command string

If there are many commands, prioritize organizing them in a readable order; do not stuff them into an unmaintainable long string.

It is more recommended to use the built-in reconnaissance script first, then decide whether to add custom commands.

Common Sub-Tools

rabin2

Suitable for static information extraction:

powershell

rabin2 -I sample.exe   # Basic information
rabin2 -S sample.exe   # Sections
rabin2 -s sample.exe   # Symbols
rabin2 -i sample.exe   # Imports
rabin2 -E sample.exe   # Exports
rabin2 -z sample.exe   # Strings
rabin2 -zz sample.exe  # More detailed strings

rasm2

Suitable for quick assembly/disassembly:

powershell

rasm2 -d "9090"
rasm2 -a x86 -b 64 "xor eax, eax"

radiff2

Suitable for comparing two binaries:

powershell

radiff2 old.exe new.exe
radiff2 -C old.exe new.exe

rahash2

Suitable for calculating hashes:

powershell

rahash2 -a md5 sample.exe
rahash2 -a sha256 sample.exe

rax2

Suitable for base and encoding conversion:

powershell

rax2 0x401000
rax2 4198400
rax2 -s hello

Recommended Analysis Sequence

When encountering an unknown sample, follow this sequence:

Use
```
rabin2 -I
```
to check format, architecture, entry point
Use
```
rabin2 -z
```
to view strings
Use
```
rabin2 -i
```
to view imported functions — MUST + Evidence (hard gate, see Workflow 1)
If interactive analysis is needed, enter
```
r2
```
(only after the Evidence from step 3 is recorded)
First run
```
aaa
```
, then use
```
afl
```
/
```
iz
```
/
```
pdf
```
Gradually locate key functions through string references, import calls, and entry process

The advantage of this sequence is low noise, allowing quick establishment of direction. Step 3 is not an optional optimization; it is a hard gate before proceeding to in-depth analysis.

Windows Notes

When there are spaces in the path, the command must be properly quoted
If
```
r2
```
cannot be found in the current terminal, it may be because the
```
PATH
```
was just updated; try opening a new terminal
Some samples require administrator privileges to read, but do not proactively elevate privileges by default unless explicitly requested by the user
Before performing dynamic debugging on suspicious samples, confirm the user's intention to avoid misoperation

Output Style

When the user wants you to actually analyze the file instead of just providing commands:

First provide a summary of reconnaissance results
Then list key evidence: strings, imports, functions, addresses
Finally provide suggestions for next steps or proceed with in-depth analysis

Do not just list commands without explaining why they are used.

Typical Request Examples

Example 1: Analyze an exe

User:

Help me figure out what this exe does, just use radare2

Handling method:

First use
```
rabin2 -I/-z/-i
```
Determine whether to enter
```
r2
```
Use
```
aaa
```
,
```
afl
```
,
```
pdf
```
to conduct in-depth analysis of the entry point and key string references

Example 2: Find where a string is called

User:

Which function triggers this error string

Handling method:

Use
```
iz~keyword
```
to find the string address
Use
```
axt <addr>
```
to find references
Jump to the reference point with
```
s <addr>
```
then use
```
pdf
```

Example 3: Modify a jump

User:

Change this jne to je

Handling method:

First confirm the target address
Clearly inform the user that write mode will be entered
Use
```
wa je <target>
```
or directly use
```
wx
```
Disassemble again after modification to verify

Practices to Avoid

Do not treat
```
radare2
```
as a tool with only the
```
aaa
```
command
Do not open the user's file in write mode without explaining the risks
Do not draw conclusions before conducting basic reconnaissance
Prohibited to skip import table check (
```
rabin2 -i
```
/ recon imports): Cannot proceed to the next step without writing to Evidence; prohibited to replace with other steps when the user requests redoing the import table check
Prohibited to endlessly struggle with static IAT after repair failure: Record
```
E-iat-repair-fail
```
then switch to dynamic analysis; prohibited to use only ImportREC for 64-bit samples
Do not mislead web JS reverse engineering to this skill; that is within the scope of
```
reverse-engineering
```

References

Command cheatsheet:
```
references/cheatsheet.md
```
Standard reconnaissance script:
```
scripts/recon.ps1
```

Routing Context

Upstream Entries:

skills/SKILL.md

(master control),

routing.md

Upstream Alternatives:

ida-reverse/

(upgrade to IDA when decompilation/pseudocode is needed) Downstream Exits:

Dynamic analysis required →
```
reverse-engineering/tools-dynamic.md
```
(Frida/GDB)
In-depth decompilation required →
```
ida-reverse/
```
Cross-reference needed after PAT finds interesting strings →
```
ida-reverse/
```
(IDA's xref is more powerful)

Peer Associated Modules:

ida-reverse/

(complementary: r2 for fast reconnaissance, IDA for in-depth decompilation)

On-Demand Bootstrap

The entry script of this skill has been integrated into the unified bootstrap system. When radare2 is missing, it will not directly report an error but will automatically attempt to install it.

Automation Capability Boundaries

Tool	Auto-installable	Installation Method	Description
r2	✓	GitHub Release ZIP (w64)	Automatically download and extract to `%USERPROFILE%\Tools\radare2\`
rabin2	✓	Same as above (included in radare2 distribution package)	—
rasm2	✓	Same as above	—
radiff2	✓	Same as above	—
rahash2	✓	Same as above	—
rax2	✓	Same as above	—

Bootstrap Trigger Points

scripts/recon.ps1

: Automatically calls

bootstrap-reverse.ps1

when

rabin2

r2

is missing

When Bootstrap Fails

If automatic installation fails (network issues, GitHub API rate limiting, etc.), the script will throw a clear error with a manual installation link.

Manual installation: Download

radare2-*-w64.zip

from https://github.com/radareorg/radare2/releases, extract it to

%USERPROFILE%\Tools\radare2\

, and ensure the

bin\

directory is in the PATH.

Task Completion Self-Check (MUST pass before claiming completion)

Have I executed each step in the workflow (instead of just reading)?
Has the import table check been executed and written to Evidence (E-imports / E-triage-imports or .NET equivalent)? Does DLL/SYS include E-exports?
Has E-iat-repair-fail been recorded and switched to dynamic analysis after IAT repair failure? Has the redo request returned to the same step?
Have I used the actual tool path based on
```
tool-index
```
?
Have I produced reproducible evidence (commands/scripts/screenshots/reports)?
Have I completed and written back the Checklist items required by RULES?

radare2

NPX Install

Tags

SKILL.md Content (Chinese)

radare2

ACTION REQUIRED（读完后立刻执行）

Scope of Application

Environment Confirmation First

Built-in Resources

scripts/recon.ps1

references/cheatsheet.md

Known Phenomena

Occasional .sdb Missing Alerts on Windows

Basic Principles

1. Reconnaissance First, In-Depth Analysis Later

2. Prioritize Minimal Sufficient Commands

3. Be Cautious Before Modification

Common Workflows

Workflow 1: Quick Reconnaissance

Hard Gate (MUST — Prohibited from entering Workflow 2 and subsequent steps if not satisfied)

Workflow 2: Interactive Function Analysis

Workflow 3: Locate main / Key Logic

Workflow 4: Hexadecimal and Memory Viewing

Workflow 5: Binary Patching

Workflow 6: Non-Interactive Automation

Common Sub-Tools

rabin2

rasm2

radiff2

rahash2

rax2

Recommended Analysis Sequence

Windows Notes

Output Style

Typical Request Examples

Example 1: Analyze an exe

Example 2: Find where a string is called

Example 3: Modify a jump

Practices to Avoid

References

Routing Context

On-Demand Bootstrap

Automation Capability Boundaries

Bootstrap Trigger Points

When Bootstrap Fails

Task Completion Self-Check (MUST pass before claiming completion)

`scripts/recon.ps1`

`references/cheatsheet.md`

Occasional
`.sdb`
Missing Alerts on Windows

`rabin2`

`rasm2`

`radiff2`

`rahash2`

`rax2`