radare2

Compare original and translation side by side

🇺🇸

Original

English

🇨🇳

Translation

Chinese

radare2

面向

radare2

CLI 的二进制分析技能。重点是直接用命令行完成侦察、分析、定位、导出和轻量修改，不依赖 GUI。

Binary analysis skill for

radare2

CLI. Focuses directly on reconnaissance, analysis, localization, extraction, and lightweight modification via the command line, without relying on GUI.

ACTION REQUIRED（读完后立刻执行）

```
NOW
```
: 读取
```
../field-journal/precedent-reverse.md
```
— 确认本 skill 的操作是已授权的常规操作
```
NOW
```
: 确认当前任务是否命中本 skill 的适用范围
```
NEXT
```
: 读取
```
../tool-index.md
```
，校验工具可用性和实际路径
```
NEXT
```
: 缺工具时调用 bootstrap，不要猜路径
```
ACT
```
: 进入"工作流"第一步并执行，不要停在确认状态

```
NOW
```
: Read
```
../field-journal/precedent-reverse.md
```
— Confirm that the operations of this skill are authorized routine actions
```
NOW
```
: Confirm whether the current task falls within the scope of this skill
```
NEXT
```
: Read
```
../tool-index.md
```
to verify tool availability and actual paths
```
NEXT
```
: Call bootstrap when tools are missing; do not guess paths
```
ACT
```
: Proceed to the first step of the "Workflow" and execute it; do not stay in the confirmation state

适用范围

Scope of Application

当用户有这些意图时应优先使用本 skill：

要用
```
r2
```
/
```
radare2
```
分析
```
exe
```
、
```
dll
```
、
```
so
```
、
```
elf
```
、
```
apk
```
、
```
dex
```
、
```
wasm
```
等文件
询问
```
rabin2
```
、
```
rasm2
```
、
```
radiff2
```
、
```
rahash2
```
、
```
rax2
```
怎么用
需要命令行反汇编、看函数、看字符串、看导入导出、查交叉引用、做 patch
需要写
```
radare2
```
批处理命令、
```
-c
```
自动化命令、或
```
r2pipe
```
脚本

如果用户明确要 GUI 逆向、Hex-Rays 风格伪代码、或 IDA 工作流，优先考虑

ida-reverse

。如果是网页 JS 逆向，优先考虑

reverse-engineering

。

Prioritize using this skill when the user has the following intentions:

Analyze files such as
```
exe
```
,
```
dll
```
,
```
so
```
,
```
elf
```
,
```
apk
```
,
```
dex
```
,
```
wasm
```
using
```
r2
```
/
```
radare2
```
Ask how to use
```
rabin2
```
,
```
rasm2
```
,
```
radiff2
```
,
```
rahash2
```
,
```
rax2
```
Need command-line disassembly, function inspection, string viewing, import/export inspection, cross-reference checking, and patching
Need to write
```
radare2
```
batch commands,
```
-c
```
automation commands, or
```
r2pipe
```
scripts

If the user explicitly requests GUI reverse engineering, Hex-Rays-style pseudocode, or IDA workflows, prioritize

ida-reverse

. For web JS reverse engineering, prioritize

reverse-engineering

先做环境确认

Environment Confirmation First

先不要假设

r2

可用。先检查：

powershell

r2 -v
rabin2 -v

如果未安装，再检查常见安装位置或提示安装。

Windows 常见可执行文件：

```
radare2.exe
```
```
rabin2.exe
```
```
rasm2.exe
```
```
radiff2.exe
```
```
rahash2.exe
```
```
rax2.exe
```
```
r2pm.exe
```

Do not assume

r2

is available. First check:

powershell

r2 -v
rabin2 -v

If not installed, check common installation locations or prompt installation.

Common executable files on Windows:

```
radare2.exe
```
```
rabin2.exe
```
```
rasm2.exe
```
```
radiff2.exe
```
```
rahash2.exe
```
```
rax2.exe
```
```
r2pm.exe
```

内置资源

Built-in Resources

这个 skill 自带两个资源，优先复用，不要每次临时组织一套重复命令。

This skill comes with two built-in resources; prioritize reusing them instead of creating a new set of repetitive commands each time.

scripts/recon.ps1

scripts/recon.ps1

标准侦察脚本，适合先做第一轮概况分析。会输出：

基本信息
节区
导入
导出
字符串
可选的
```
r2 -A
```
自动分析摘要

调用方式：

powershell

powershell -File "<skill-root>\radare2\scripts\recon.ps1" -TargetPath "C:\path\to\sample.exe"

如果需要附带

r2

自动分析：

powershell

powershell -File "<skill-root>\radare2\scripts\recon.ps1" -TargetPath "C:\path\to\sample.exe" -RunAnalysis

Standard reconnaissance script, suitable for initial overview analysis. It outputs:

Basic information
Sections
Imports
Exports
Strings
Optional
```
r2 -A
```
automatic analysis summary

Calling method:

powershell

powershell -File "<skill-root>\radare2\scripts\recon.ps1" -TargetPath "C:\path\to\sample.exe"

r2

automatic analysis is required:

powershell

powershell -File "<skill-root>\radare2\scripts\recon.ps1" -TargetPath "C:\path\to\sample.exe" -RunAnalysis

references/cheatsheet.md

references/cheatsheet.md

当需要更多命令细节、常见场景模板、或要快速回忆语法时，读取这个速查表，而不是凭记忆硬猜。

When more command details, common scenario templates, or quick syntax recall are needed, read this cheatsheet instead of guessing from memory.

已知现象

Known Phenomena

Windows 下偶发

.sdb

缺失告警

Occasional

.sdb

Missing Alerts on Windows

某些 PE 文件在

rabin2

侦察时，可能出现类似下面的告警：

text

ERROR: Cannot find ...\share\format\dll\*.sdb

如果主体输出仍然正常返回，通常不影响基础侦察结论，先继续分析即可。不要因为这类附带告警就直接判定分析失败。

When reconnoitering certain PE files with

rabin2

, alerts similar to the following may appear:

text

ERROR: Cannot find ...\share\format\dll\*.sdb

If the main output is still returned normally, it usually does not affect the basic reconnaissance conclusion; continue the analysis first. Do not directly conclude that the analysis failed due to such incidental alerts.

基本原则

Basic Principles

1. 先侦察，后深挖

1. Reconnaissance First, In-Depth Analysis Later

不要一上来就全量自动分析。先用轻量命令确认文件类型、架构、入口点、字符串、导入表，再决定是否做

aaa

、

aaaa

或定向分析。

Do not perform full automatic analysis right away. First use lightweight commands to confirm the file type, architecture, entry point, strings, and import table, then decide whether to perform

aaa

aaaa

, or targeted analysis.

2. 优先最小足够命令

2. Prioritize Minimal Sufficient Commands

radare2

命令非常多，用户通常只需要最短路径：

看文件信息：
```
rabin2 -I
```
看字符串：
```
rabin2 -z
```
看导入导出：
```
rabin2 -i
```
/
```
rabin2 -E
```
交互分析：
```
r2 <file>
```
后再执行局部命令

radare2

has numerous commands; users usually only need the shortest path:

View file information:
```
rabin2 -I
```
View strings:
```
rabin2 -z
```
View imports/exports:
```
rabin2 -i
```
/
```
rabin2 -E
```
Interactive analysis: Execute local commands after
```
r2 <file>
```

3. 修改前保持谨慎

3. Be Cautious Before Modification

如果用户要 patch 二进制：

默认先只读打开：
```
r2 <file>
```
只有在明确需要修改时再用写模式：
```
r2 -w <file>
```
或会话中
```
oo+
```
修改前先告知风险，避免无意覆盖原文件

If the user wants to patch a binary:

Open in read-only mode by default:
```
r2 <file>
```
Only use write mode when modification is explicitly needed:
```
r2 -w <file>
```
or
```
oo+
```
in the session
Inform the user of risks before modification to avoid unintentionally overwriting the original file

常用工作流

Common Workflows

工作流 1：快速侦察

Workflow 1: Quick Reconnaissance

适合刚拿到一个二进制文件时。

Suitable when you just get a binary file.

硬门禁（MUST — 未满足禁止进入工作流 2 及后续）

Hard Gate (MUST — Prohibited from entering Workflow 2 and subsequent steps if not satisfied)

对 PE/ELF/Mach-O 等含导入表的二进制，MUST 先完成导入表检查并落成 Evidence，再进入函数级分析或动态步骤：

执行
```
rabin2 -i <sample>
```
（或
```
recon.ps1
```
输出中的 imports 段）；DLL/SYS 另 MUST
```
rabin2 -E
```
并记
```
E-exports
```
将完整/分类后的导入表结果写入 Evidence（建议 id：
```
E-imports
```
或
```
E-triage-imports
```
），至少包含：
- 复现命令（
```
repro_command
```
  ）
- 关键导入分类摘要：网络 / 文件 / 加密 / 进程注入 / 注册表 / 其他可疑 API
- 若导入表为空、解析失败或工具报错：仍 MUST 记录失败现象与原始输出为 Evidence，不得静默跳过
- 导入表「过干净」（仅基础 DLL）：MUST 注明动态加载嫌疑，SHOULD 转入动态抓 API
.NET 等无传统 IAT：MUST 走等价锚点（dnSpy/IL/元数据摘要）写入同一 Evidence 语义槽，禁止空过
加壳样本 IAT 修复：x86 用 ImportREC（或等价）、x64 用 Scylla（或等价）。修复失败 MUST 记
```
E-iat-repair-fail
```
后转动态 API 断点；禁止在静态 IAT 上无限死磕（见
```
reverse-engineering/references/re-agent-workflow.md
```
§1.2）
用户明确要求「重做导入表检查 / 重新检查导入表 / 重做 IAT」时：MUST 重做被点名步骤本身（阻塞时先走可行性门闩：说明前提+请确认；强制则标 quality=unreadable），禁止改换为无关步骤冒充完成

未记录导入表（或合法等价锚点 / IAT 失败旁路）Evidence 前：MUST NOT 声称「基础侦察完成」，MUST NOT 进入工作流 2+ 的深挖结论。

优先直接运行内置脚本：

powershell

powershell -File "<skill-root>\radare2\scripts\recon.ps1" -TargetPath "sample.exe"

如果只需要手动最小命令，则使用：

powershell

rabin2 -I sample.exe
rabin2 -z sample.exe
rabin2 -i sample.exe
rabin2 -E sample.exe

关注点：

文件格式、位数、架构、平台
入口点地址
可疑字符串：URL、路径、报错、注册表、命令行参数
导入函数：网络、文件、加密、进程注入、注册表操作（MUST 落 Evidence，见上方硬门禁）

For binaries with import tables such as PE/ELF/Mach-O, MUST complete the import table check and record it as Evidence before proceeding to function-level analysis or dynamic steps:

Execute
```
rabin2 -i <sample>
```
(or the imports section in the
```
recon.ps1
```
output); for DLL/SYS files, additionally MUST execute
```
rabin2 -E
```
and record it as
```
E-exports
```
Write the complete/classified import table results into Evidence (recommended ID:
```
E-imports
```
or
```
E-triage-imports
```
), which must include at least:
- Reproduction command (
```
repro_command
```
  )
- Summary of key import categories: Network / File / Encryption / Process Injection / Registry / Other Suspicious APIs
- If the import table is empty, parsing fails, or the tool reports an error: STILL MUST record the failure phenomenon and original output as Evidence, silent skipping is prohibited
- If the import table is "too clean" (only basic DLLs): MUST note the suspicion of dynamic loading, SHOULD switch to dynamic API capturing
For .NET and other files without traditional IAT: MUST use equivalent anchors (dnSpy/IL/metadata summary) and write to the same Evidence semantic slot; empty skipping is prohibited
IAT repair for packed samples: Use ImportREC (or equivalent) for x86, Scylla (or equivalent) for x64. If repair fails, MUST record
```
E-iat-repair-fail
```
and switch to dynamic API breakpoints; prohibited to endlessly struggle with static IAT (see
```
reverse-engineering/references/re-agent-workflow.md
```
§1.2)
When the user explicitly requests "redo import table check / recheck import table / redo IAT": MUST redo the specified step itself (if blocked, first go through the feasibility latch: explain prerequisites + request confirmation; if forced, mark quality=unreadable), prohibited to replace with irrelevant steps to pretend completion

Before recording the import table (or legal equivalent anchor / IAT failure bypass) as Evidence: MUST NOT claim "basic reconnaissance is completed", MUST NOT proceed to in-depth conclusions in Workflow 2+.

Prioritize running the built-in script directly:

powershell

powershell -File "<skill-root>\radare2\scripts\recon.ps1" -TargetPath "sample.exe"

If only manual minimal commands are needed, use:

powershell

rabin2 -I sample.exe
rabin2 -z sample.exe
rabin2 -i sample.exe
rabin2 -E sample.exe

Focus points:

File format, bitness, architecture, platform
Entry point address
Suspicious strings: URLs, paths, error messages, registry entries, command-line parameters
Imported functions: Network, file, encryption, process injection, registry operations (MUST record as Evidence, see the hard gate above)

工作流 2：交互式分析函数

Workflow 2: Interactive Function Analysis

powershell

r2 sample.exe

进入后常用：

text

aaa          # 常规自动分析
afl          # 列出函数
iz           # 列出字符串
iS           # 列节区
is           # 列符号
s entry0     # 跳到入口点
pdf          # 反汇编当前函数
VV           # 进入可视化模式（如果终端适合）
q            # 退出

说明：

默认优先
```
aaa
```
，不要一开始就用更重的
```
aaaa
```
如果样本很大或分析很慢，可以只分析入口附近，再手动扩展

powershell

r2 sample.exe

Common commands after entering:

text

aaa          # Regular automatic analysis
afl          # List functions
iz           # List strings
iS           # List sections
is           # List symbols
s entry0     # Jump to entry point
pdf          # Disassemble current function
VV           # Enter visualization mode (if terminal supports)
q            # Exit

Notes:

Prioritize
```
aaa
```
by default; do not use the heavier
```
aaaa
```
at the beginning
If the sample is large or analysis is slow, you can only analyze the area near the entry point first, then expand manually

工作流 3：定位 main / 关键逻辑

Workflow 3: Locate main / Key Logic

text

afl~main
afl~sym.
iz~http
iz~error
axt <addr>

思路：

先从
```
main
```
、入口点、字符串引用入手
用
```
axt
```
查谁引用了某个字符串或地址
找到引用点后再
```
s <addr>
```
、
```
pdf
```

text

afl~main
afl~sym.
iz~http
iz~error
axt <addr>

Approach:

Start with
```
main
```
, entry point, and string references
Use
```
axt
```
to check who references a certain string or address
After finding the reference point, use
```
s <addr>
```
and
```
pdf
```

工作流 4：十六进制与内存查看

Workflow 4: Hexadecimal and Memory Viewing

text

px 64        # 当前地址起 64 字节十六进制
pd 20        # 反汇编 20 条指令
psz          # 读取当前地址字符串
pxa          # 更友好的十六进制视图

text

px 64        # 64 bytes of hexadecimal starting from current address
pd 20        # Disassemble 20 instructions
psz          # Read string at current address
pxa          # More user-friendly hexadecimal view

工作流 5：二进制 patch

Workflow 5: Binary Patching

仅当用户明确要求修改文件时使用：

powershell

r2 -w sample.exe

进入后例如：

text

s 0x401000
wa nop
wa jmp 0x401050
wq

常见写操作：

```
wa <asm>
```
：写汇编
```
wx <hex>
```
：写原始字节
```
wq
```
：写入并退出

修改前最好先备份原文件。如果用户没提备份，至少提醒一次。

Only use when the user explicitly requests file modification:

powershell

r2 -w sample.exe

For example after entering:

text

s 0x401000
wa nop
wa jmp 0x401050
wq

Common write operations:

```
wa <asm>
```
: Write assembly
```
wx <hex>
```
: Write raw bytes
```
wq
```
: Write and exit

It is best to back up the original file before modification. If the user does not mention backup, remind them at least once.

工作流 6：非交互自动化

Workflow 6: Non-Interactive Automation

适合一次性输出结果：

powershell

r2 -A -q -c "afl;iz;ii;q" sample.exe

常用参数：

```
-A
```
：启动时自动分析
```
-q
```
：安静模式
```
-c
```
：执行命令串

如果命令很多，优先整理成易读顺序，不要塞入难以维护的超长串。

更推荐先用内置侦察脚本打底，再决定要不要补定制命令。

Suitable for one-time result output:

powershell

r2 -A -q -c "afl;iz;ii;q" sample.exe

Common parameters:

```
-A
```
: Automatic analysis on startup
```
-q
```
: Quiet mode
```
-c
```
: Execute command string

If there are many commands, prioritize organizing them in a readable order; do not stuff them into an unmaintainable long string.

It is more recommended to use the built-in reconnaissance script first, then decide whether to add custom commands.

常用子工具

Common Sub-Tools

rabin2

rabin2

适合静态信息提取：

powershell

rabin2 -I sample.exe   # 基本信息
rabin2 -S sample.exe   # 节区
rabin2 -s sample.exe   # 符号
rabin2 -i sample.exe   # 导入
rabin2 -E sample.exe   # 导出
rabin2 -z sample.exe   # 字符串
rabin2 -zz sample.exe  # 更详细字符串

Suitable for static information extraction:

powershell

rabin2 -I sample.exe   # Basic information
rabin2 -S sample.exe   # Sections
rabin2 -s sample.exe   # Symbols
rabin2 -i sample.exe   # Imports
rabin2 -E sample.exe   # Exports
rabin2 -z sample.exe   # Strings
rabin2 -zz sample.exe  # More detailed strings

rasm2

rasm2

适合快速汇编/反汇编：

powershell

rasm2 -d "9090"
rasm2 -a x86 -b 64 "xor eax, eax"

Suitable for quick assembly/disassembly:

powershell

rasm2 -d "9090"
rasm2 -a x86 -b 64 "xor eax, eax"

radiff2

radiff2

适合对比两个二进制：

powershell

radiff2 old.exe new.exe
radiff2 -C old.exe new.exe

Suitable for comparing two binaries:

powershell

radiff2 old.exe new.exe
radiff2 -C old.exe new.exe

rahash2

rahash2

适合算哈希：

powershell

rahash2 -a md5 sample.exe
rahash2 -a sha256 sample.exe

Suitable for calculating hashes:

powershell

rahash2 -a md5 sample.exe
rahash2 -a sha256 sample.exe

rax2

rax2

适合进制和编码转换：

powershell

rax2 0x401000
rax2 4198400
rax2 -s hello

Suitable for base and encoding conversion:

powershell

rax2 0x401000
rax2 4198400
rax2 -s hello

Recommended Analysis Sequence

遇到未知样本时，按这个顺序做：

```
rabin2 -I
```
看格式、架构、入口点
```
rabin2 -z
```
看字符串
```
rabin2 -i
```
看导入函数 — MUST + Evidence（硬门，见工作流 1）
如需交互分析，再进
```
r2
```
（仅当步骤 3 的 Evidence 已落盘）
先
```
aaa
```
，再
```
afl
```
/
```
iz
```
/
```
pdf
```
通过字符串引用、导入调用、入口流程逐步定位关键函数

这个顺序的好处是噪音低，能尽快建立方向感。步骤 3 不是可选优化，是进入深挖前的硬门。

When encountering an unknown sample, follow this sequence:

Use
```
rabin2 -I
```
to check format, architecture, entry point
Use
```
rabin2 -z
```
to view strings
Use
```
rabin2 -i
```
to view imported functions — MUST + Evidence (hard gate, see Workflow 1)
If interactive analysis is needed, enter
```
r2
```
(only after the Evidence from step 3 is recorded)
First run
```
aaa
```
, then use
```
afl
```
/
```
iz
```
/
```
pdf
```
Gradually locate key functions through string references, import calls, and entry process

The advantage of this sequence is low noise, allowing quick establishment of direction. Step 3 is not an optional optimization; it is a hard gate before proceeding to in-depth analysis.

Windows 注意事项

Windows Notes

路径里有空格时，命令必须正确加引号
如果当前终端找不到
```
r2
```
，可能是
```
PATH
```
刚更新，开一个新终端再试
有些样本需要管理员权限读取，但默认不要主动提升权限，除非用户明确需要
对可疑样本做动态调试前，要先确认用户意图，避免误操作

When there are spaces in the path, the command must be properly quoted
If
```
r2
```
cannot be found in the current terminal, it may be because the
```
PATH
```
was just updated; try opening a new terminal
Some samples require administrator privileges to read, but do not proactively elevate privileges by default unless explicitly requested by the user
Before performing dynamic debugging on suspicious samples, confirm the user's intention to avoid misoperation

输出风格

Output Style

当用户不是只要命令，而是要你实际分析文件时：

先给出侦察结果摘要
再列出关键证据：字符串、导入、函数、地址
最后给出下一步建议或继续深入分析

不要只罗列命令而不解释为什么这么做。

When the user wants you to actually analyze the file instead of just providing commands:

First provide a summary of reconnaissance results
Then list key evidence: strings, imports, functions, addresses
Finally provide suggestions for next steps or proceed with in-depth analysis

Do not just list commands without explaining why they are used.

典型请求示例

Typical Request Examples

示例 1：分析一个 exe

Example 1: Analyze an exe

用户：

帮我看看这个 exe 干了什么，用 radare2 就行

处理方式：

先用
```
rabin2 -I/-z/-i
```
判断是否需要进入
```
r2
```
用
```
aaa
```
、
```
afl
```
、
```
pdf
```
深挖入口和关键字符串引用

User:

Help me figure out what this exe does, just use radare2

Handling method:

First use
```
rabin2 -I/-z/-i
```
Determine whether to enter
```
r2
```
Use
```
aaa
```
,
```
afl
```
,
```
pdf
```
to conduct in-depth analysis of the entry point and key string references

示例 2：找字符串在哪被调用

Example 2: Find where a string is called

用户：

这个报错字符串在哪个函数里触发的

处理方式：

用
```
iz~关键字
```
找字符串地址
用
```
axt <addr>
```
找引用
跳到引用点
```
s <addr>
```
后
```
pdf
```

User:

Which function triggers this error string

Handling method:

Use
```
iz~keyword
```
to find the string address
Use
```
axt <addr>
```
to find references
Jump to the reference point with
```
s <addr>
```
then use
```
pdf
```

示例 3：改掉跳转

Example 3: Modify a jump

用户：

把这个 jne 改成 je

处理方式：

先确认目标地址
明确告知要进入写模式
用
```
wa je <target>
```
或直接
```
wx
```
修改后再次反汇编验证

User:

Change this jne to je

Handling method:

First confirm the target address
Clearly inform the user that write mode will be entered
Use
```
wa je <target>
```
or directly use
```
wx
```
Disassemble again after modification to verify

避免的做法

Practices to Avoid

不要把
```
radare2
```
当成只有
```
aaa
```
一个命令的工具
不要在未说明风险时直接写模式打开用户文件
不要在还没做基础侦察前就下结论
禁止跳过导入表检查（
```
rabin2 -i
```
/ recon imports）：未写入 Evidence 不得进入下一步；用户要求重做导入表时禁止改做其他步骤
禁止 IAT 修复失败后静态死磕：记
```
E-iat-repair-fail
```
后转动态；禁止 64 位样本只用 ImportREC
不要把网页 JS 逆向误导到这个 skill；那是
```
reverse-engineering
```
的范围

Do not treat
```
radare2
```
as a tool with only the
```
aaa
```
command
Do not open the user's file in write mode without explaining the risks
Do not draw conclusions before conducting basic reconnaissance
Prohibited to skip import table check (
```
rabin2 -i
```
/ recon imports): Cannot proceed to the next step without writing to Evidence; prohibited to replace with other steps when the user requests redoing the import table check
Prohibited to endlessly struggle with static IAT after repair failure: Record
```
E-iat-repair-fail
```
then switch to dynamic analysis; prohibited to use only ImportREC for 64-bit samples
Do not mislead web JS reverse engineering to this skill; that is within the scope of
```
reverse-engineering
```

参考资料

References

命令速查：
```
references/cheatsheet.md
```
标准侦察脚本：
```
scripts/recon.ps1
```

Command cheatsheet:
```
references/cheatsheet.md
```
Standard reconnaissance script:
```
scripts/recon.ps1
```

路由上下文

Routing Context

上游入口:

skills/SKILL.md

（总控）、

routing.md

上游备选:

ida-reverse/

（需要反编译/伪代码时升级到 IDA） 下游出口:

需动态分析 →
```
reverse-engineering/tools-dynamic.md
```
（Frida/GDB）
需深度反编译 →
```
ida-reverse/
```
PAT 发现有趣字符串后需交叉引用 →
```
ida-reverse/
```
（IDA 的 xref 更强大）

同级关联模块:

ida-reverse/

（互补：r2 侦察快，IDA 反编译深）

Upstream Entries:

skills/SKILL.md

(master control),

routing.md

Upstream Alternatives:

ida-reverse/

(upgrade to IDA when decompilation/pseudocode is needed) Downstream Exits:

Dynamic analysis required →
```
reverse-engineering/tools-dynamic.md
```
(Frida/GDB)
In-depth decompilation required →
```
ida-reverse/
```
Cross-reference needed after PAT finds interesting strings →
```
ida-reverse/
```
(IDA's xref is more powerful)

Peer Associated Modules:

ida-reverse/

(complementary: r2 for fast reconnaissance, IDA for in-depth decompilation)

按需自举（On-Demand Bootstrap）

On-Demand Bootstrap

本 skill 的入口脚本已接入统一自举系统。缺少 radare2 时不会直接报错，而是自动尝试安装。

The entry script of this skill has been integrated into the unified bootstrap system. When radare2 is missing, it will not directly report an error but will automatically attempt to install it.

自动化能力边界

Automation Capability Boundaries

工具	可自动安装	安装方式	说明
r2	✓	GitHub Release ZIP (w64)	自动下载解压到 `%USERPROFILE%\Tools\radare2\`
rabin2	✓	同上（包含在 radare2 发行包中）	—
rasm2	✓	同上	—
radiff2	✓	同上	—
rahash2	✓	同上	—
rax2	✓	同上	—

Tool	Auto-installable	Installation Method	Description
r2	✓	GitHub Release ZIP (w64)	Automatically download and extract to `%USERPROFILE%\Tools\radare2\`
rabin2	✓	Same as above (included in radare2 distribution package)	—
rasm2	✓	Same as above	—
radiff2	✓	Same as above	—
rahash2	✓	Same as above	—
rax2	✓	Same as above	—

自举触发点

Bootstrap Trigger Points

scripts/recon.ps1

：缺

rabin2

或

r2

时自动调用

bootstrap-reverse.ps1

scripts/recon.ps1

: Automatically calls

bootstrap-reverse.ps1

when

rabin2

r2

is missing

自举失败时

When Bootstrap Fails

如果自动安装失败（网络不通、GitHub API 限流等），脚本会抛出明确错误并附带手动安装链接。

手动安装：从 https://github.com/radareorg/radare2/releases 下载

radare2-*-w64.zip

，解压到

%USERPROFILE%\Tools\radare2\

并确保

bin\

目录在 PATH 中。

If automatic installation fails (network issues, GitHub API rate limiting, etc.), the script will throw a clear error with a manual installation link.

Manual installation: Download

radare2-*-w64.zip

from https://github.com/radareorg/radare2/releases, extract it to

%USERPROFILE%\Tools\radare2\

, and ensure the

bin\

directory is in the PATH.

任务完成自检（声称完成前 MUST 通过）

Task Completion Self-Check (MUST pass before claiming completion)

我是否执行了工作流中的每一步（而不是只阅读）？
导入表检查是否已执行且写入 Evidence（E-imports / E-triage-imports 或 .NET 等价）？DLL/SYS 是否含 E-exports？
IAT 修复失败是否记录 E-iat-repair-fail 并转动态？重做请求是否回到同一步？
我是否基于
```
tool-index
```
使用了真实工具路径？
我是否产出了可复现证据（命令/脚本/截图/报告）？
我是否完成并回写了 RULES 要求的 Checklist 项？

Have I executed each step in the workflow (instead of just reading)?
Has the import table check been executed and written to Evidence (E-imports / E-triage-imports or .NET equivalent)? Does DLL/SYS include E-exports?
Has E-iat-repair-fail been recorded and switched to dynamic analysis after IAT repair failure? Has the redo request returned to the same step?
Have I used the actual tool path based on
```
tool-index
```
?
Have I produced reproducible evidence (commands/scripts/screenshots/reports)?
Have I completed and written back the Checklist items required by RULES?

radare2

Original

Translation

radare2

radare2

ACTION REQUIRED（读完后立刻执行）

ACTION REQUIRED（读完后立刻执行）

适用范围

Scope of Application

先做环境确认

Environment Confirmation First

内置资源

Built-in Resources

scripts/recon.ps1

scripts/recon.ps1

references/cheatsheet.md

references/cheatsheet.md

已知现象

Known Phenomena

Windows 下偶发 .sdb 缺失告警

Occasional .sdb Missing Alerts on Windows

基本原则

Basic Principles

1. 先侦察，后深挖

1. Reconnaissance First, In-Depth Analysis Later

2. 优先最小足够命令

2. Prioritize Minimal Sufficient Commands

3. 修改前保持谨慎

3. Be Cautious Before Modification

常用工作流

Common Workflows

工作流 1：快速侦察

Workflow 1: Quick Reconnaissance

硬门禁（MUST — 未满足禁止进入工作流 2 及后续）

Hard Gate (MUST — Prohibited from entering Workflow 2 and subsequent steps if not satisfied)

工作流 2：交互式分析函数

Workflow 2: Interactive Function Analysis

工作流 3：定位 main / 关键逻辑

Workflow 3: Locate main / Key Logic

工作流 4：十六进制与内存查看

Workflow 4: Hexadecimal and Memory Viewing

工作流 5：二进制 patch

Workflow 5: Binary Patching

工作流 6：非交互自动化

Workflow 6: Non-Interactive Automation

常用子工具

Common Sub-Tools

rabin2

rabin2

rasm2

rasm2

radiff2

radiff2

rahash2

rahash2

rax2

rax2

推荐分析顺序

Recommended Analysis Sequence

Windows 注意事项

Windows Notes

输出风格

Output Style

典型请求示例

Typical Request Examples

示例 1：分析一个 exe

Example 1: Analyze an exe

示例 2：找字符串在哪被调用

Example 2: Find where a string is called

示例 3：改掉跳转

Example 3: Modify a jump

避免的做法

Practices to Avoid

参考资料

References

路由上下文

Routing Context

按需自举（On-Demand Bootstrap）

On-Demand Bootstrap

自动化能力边界

`scripts/recon.ps1`

`scripts/recon.ps1`

`references/cheatsheet.md`

`references/cheatsheet.md`

Windows 下偶发
`.sdb`
缺失告警

Occasional
`.sdb`
Missing Alerts on Windows

`rabin2`

`rabin2`

`rasm2`

`rasm2`

`radiff2`

`radiff2`

`rahash2`

`rahash2`

`rax2`

`rax2`