radare2 for command-line binary analysis and reverse engineering

radare2 is a free, scriptable reverse engineering framework that disassembles, debugs, and patches binaries across hundreds of architectures, built for analysts working malware triage and authorized vulnerability research.

Tool	radareorg/radare2 — UNIX-like reverse engineering framework and command-line toolset written in C
Category	Binary analysis / disassembly / debugging framework
Primary Use	Static and dynamic analysis of binaries in authorized security research, CTF work, and malware triage using aaa, pdf, agf, and debugger sessions
Safe Use	Analyzing software you own or are authorized to test: lab malware triage, CTF challenges, defensive research, and code audit on owned systems
Telemetry Note	As a local analysis tool, radare2 touches no attacker infrastructure; defenders should note debugger attach events, read-write file reopens via oo+, and any r2pm package installations in shared analyst environments

radare2 occupies a unique position in the reverse engineering world: it is the rare full-featured analysis platform that grew out of a command-line hexadecimal editor rather than a GUI-first IDE. The README notes that the original radare project started as a simple forensic hex editor, and that lineage still shows in the tool's seek-based interaction model, where every operation is anchored to a current offset in a file, memory region, or debugger session. Today the project, distributed under LGPLv3 with per-plugin licensing visible via r2 -Lj, is a complete rewrite covering libraries, tools, and a plugin ecosystem that spans everything from disassembly to AI-assisted decompilation. At roughly 24.8k stars on GitHub and a current master version of 6.2.3, it is one of the most actively maintained open-source reversing projects in existence.

What makes r2 distinctive architecturally is its everything-is-a-file philosophy. The README explains that the tool can edit files on local hard drives, view kernel memory, and debug programs locally or through remote gdb/windbg servers, all through the same uniform I/O layer. This means an analyst can pivot from examining a static ELF on disk to attaching to a live process to mounting a filesystem image — the README lists userland mounts for NTFS, EXT, APFS, FAT, HFS+, and many others — without changing mental models. That uniformity is what turns a disassembler into a general-purpose low-level instrumentation platform, and it is the reason so many specialized plugins build on top of it.

The breadth of supported targets is honestly hard to overstate. The README enumerates CPU architectures from the mainstream (i386, x86-64, ARM, RISC-V, MIPS, PowerPC, SPARC) through embedded and retro territory (8051, 6502, GameBoy, SNES, CHIP-8, MSP430, Xtensa) to virtual machines and bytecode formats (Java, Dalvik, WebAssembly, MSIL, EVM, PythonBytecode). File format support follows the same pattern: ELF, Mach-O, PE/PE+, DEX, MDMP minidumps, UEFI images, Android boot images, WASM, and console ROM formats like N3DS and GBA. For an analyst who works across desktop malware, mobile applications, firmware, and CTF curiosities, this coverage means one toolchain instead of five.

The core workflow, as sketched in the README's usage section, is seek-and-command. Opening a target read-only with r2 /bin/ls, running aaa (equivalent to launching with r2 -A) triggers full analysis, and from there afl lists discovered functions while iS and is enumerate sections and symbols. Seeking is done with s sym.main, hexdumps with px 32, and the README highlights pdf for function disassembly alongside agf, which renders an ASCII-art control-flow graph directly in the terminal. Built-in filtering with the ~ modifier — for example f~foo — acts as an internal grep, which keeps the entire loop keyboard-driven and free of context switching. This is a tool designed for operators who live in terminals and want analysis to compose like shell pipelines.

Scripting is where radare2 becomes a framework rather than a program. The README describes an embedded JavaScript interpreter plus r2pipe, the protocol that lets you drive an r2 session from any programming language, and r2papi, a higher-level API layered on top of it. For detection engineering and automated triage, this is the crucial property: you can script symbol extraction, string sweeps, or structural comparisons against batches of samples and integrate the output into your own tooling. The r2sarif plugin extends this further by importing and exporting SARIF documents, meaning results can flow into standardized reporting pipelines that other security tooling already understands.

The plugin ecosystem, managed through the r2pm package manager (r2pm -s to search, r2pm -Uci to install, r2pm -u to uninstall), is arguably the project's biggest force multiplier. Two plugins stand out for daily malware work. r2ghidra brings the Ghidra decompiler into r2 natively, exposing it through the pdg command — pseudocode output without leaving your terminal session. r2frida bridges r2 to the Frida instrumentation framework, started simply with r2 frida://0, enabling live process introspection during authorized dynamic analysis. Conversely, r4ghidra runs radare inside Ghidra for analysts who prefer the GUI but want r2 commands.

Beyond decompilation and instrumentation, the ecosystem covers niche but valuable targets. r2flutter handles Dart/Flutter AOT snapshots from Android and iOS applications, r2unity inspects Unity IL2CPP metadata alongside native binaries, r2hermes disassembles React Native Hermes bytecode, and goresym imports Go symbol recovery results as r2 flags. For binary diffing — a core technique in patch analysis and variant tracking — r2diaphora ports the Diaphora engine onto radare2. Symbolic execution is available through radius2, which builds on the boolector solver and r2's own esil emulation layer, and r2yara lets you run Yara from inside r2 or use r2 primitives from Yara rules, a direct bridge between analysis and detection. Even AI-assisted reversing is represented, with r2ai running a local Llama model and decai providing an AI-based decompiler front end — both notable for keeping models on localhost rather than shipping sample data to external services.

Installation is straightforward and well documented. The recommended path is building from the Git repository with sys/install.sh after a clone, and both make and meson/ninja builds are supported, with .bat scripts covering Windows msvc or mingw toolchains. Packaging is mature: the README shows packages in Alpine, Arch, Fedora, Homebrew, MacPorts, Void, HaikuPorts, Snap, and Termux, so on most analyst workstations you can get a current build from your distribution of choice. Removal is equally explicit — make uninstall for the current build, sudo make purge to strip every system installation — a small detail that reflects the project's UNIX-grown hygiene.

From a defender's perspective, radare2 is a benign, locally scoped tool that contacts no external infrastructure during analysis, but it does leave observable traces in shared environments. Attaching the debugger to a process, reopening a file read-write with oo+ before patching, and r2pm package installs into R2PM_HOME are all events worth logging on forensic workstations. None of this is malicious — it is the normal residue of legitimate analysis — but knowing what normal looks like helps distinguish an analyst's box from something else.

Where r2 fits in an authorized workflow is best summarized by its own history: forensics first, then everything else. Whether the task is triaging a suspicious PE in a malware lab, auditing firmware you were contracted to assess, recovering symbols from a stripped Go binary, or grinding through CDF challenges, the same command grammar applies. The official book at book.rada.re, talks from the annual r2con conference, and active Discord, Telegram, Matrix, and IRC channels provide deep documentation. For professionals who value composability, terminal-native speed, and unmatched format coverage over point-and-click comfort, radare2 remains the reference implementation of what a libre reversing framework can be.

Official project repository for radareorg/radare2.

Download Tool

Educational analysis for authorized security professionals. Use only in controlled, authorized environments.