# How to Analyze and Patch Binaries Using radare2 with CLI Workflow: A Complete Guide

> Learn to analyze and patch binaries using radare2's CLI. Discover commands for analysis, seeking, and patching to streamline your reverse engineering workflow.

- Repository: [ZhaoXu/reverse-skill](https://github.com/zhaoxuya520/reverse-skill)
- Tags: how-to-guide
- Published: 2026-08-07

---

**You can analyze and patch binaries using radare2's CLI by opening the target with `r2 -AA`, analyzing functions with `aaa`, seeking to target addresses with `s`, and writing patches with `wx` followed by `:wq` to save changes.**

The reverse-skill repository provides a modular framework for orchestrating reverse-engineering tasks through dedicated "skill" blocks. This guide demonstrates how to leverage the radare2 skill within that ecosystem to perform complete binary analysis and patching using pure command-line workflows, based on the actual implementation found in [`skills/radare2/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/radare2/SKILL.md) and supporting scripts.

## Architectural Overview of the reverse-skill Framework

The reverse-skill project is a **task-skill router** that orchestrates reverse-engineering, security analysis, and pentest workflows via a modular architecture. Understanding this structure helps contextualize where radare2 fits into the broader automation pipeline.

### Core Router Layer

The routing logic that maps user intent to specific skills lives in `skills/scripts/master-route.ps1`. This script decides which skill to invoke based on input hints like "radare2 analyze" and validates coherence via `skills/scripts/verify-routing-coherence.ps1`.

### Skill Definitions

Each capability is described by a markdown "SKILL" file. The radare2 implementation is located at [`skills/rare2/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/rare2/SKILL.md), which documents the complete CLI command reference for binary analysis and patching according to the reverse-skill source code.

### Tool Discovery and Installation

Cross-platform installation logic resides in [`skills/scripts/refresh-tool-index.sh`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/scripts/refresh-tool-index.sh). This script discovers, downloads, and installs required binaries across Linux, macOS, and Windows. For Kali Linux specifically, [`kali/scripts/bootstrap-reverse.sh`](https://github.com/zhaoxuya520/reverse-skill/blob/main/kali/scripts/bootstrap-reverse.sh) handles automated radare2 setup and environment configuration.

### Auxiliary Scripts

The repository includes quick reconnaissance helpers like [`skills/radare2/scripts/recon.sh`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/radare2/scripts/recon.sh), which extracts basic binary metadata (sections, imports, strings) using `rabin2`-equivalent functionality before deep analysis begins.

## Installing radare2 via the Tool Index

Before analysis, ensure radare2 is installed using the repository's platform-aware helpers.

```bash

# Query the tool index for radare2 installation commands

bash skills/scripts/refresh-tool-index.sh | grep radare2

# Example output on Ubuntu/Debian systems:

#   apt install radare2

# Execute the installation

sudo apt update && sudo apt install -y radare2

```

For Kali Linux deployments, the bootstrap script at [`kali/scripts/bootstrap-reverse.sh`](https://github.com/zhaoxuya520/reverse-skill/blob/main/kali/scripts/bootstrap-reverse.sh) automates this process entirely.

## Step-by-Step radare2 CLI Workflow

The following workflow mirrors the guidance embedded in [`skills/radare2/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/radare2/SKILL.md) and demonstrates the complete lifecycle from reconnaissance to patched binary.

### Initial Reconnaissance

Start with fast metadata extraction to understand the binary structure without full disassembly.

```bash

# Run the provided recon script (equivalent to rabin2 -z)

bash skills/radare2/scripts/recon.sh mybinary

```

This outputs sections, imports, strings, and entropy metrics—providing the "first look" recommended by the radare2 skill before launching the interactive shell.

### Deep Static Analysis

Launch radare2 with automatic analysis flags to populate function lists and cross-references.

```bash

# Open with automatic analysis (-AA)

r2 -AA mybinary

# Inside the r2 prompt:

[0x00000000]> aaa          # Perform deeper analysis (functions, symbols, xrefs)

[0x00000000]> afl          # List all discovered functions

[0x00000000]> pdf @ sym.main   # Disassemble the main function

```

The `aaa` command is the canonical entry point documented in [`skills/radare2/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/radare2/SKILL.md) for comprehensive function discovery.

### Locating the Patch Target

Navigate to the specific instruction requiring modification. For example, to bypass a license check at `0x401250`:

```bash
[0x00000000]> s 0x401250      # Seek to the target address

[0x401250]> pd 5              # Print five instructions of disassembly

```

Identify the conditional jump (`je`, `jne`, or similar) that controls program flow.

### Applying Binary Patches

Overwrite the target instructions with NOPs (0x90) or alternative opcodes, then commit changes to disk.

```bash
[0x401250]> wx 90             # Write hex 0x90 (NOP) at current address

[0x401250]> :wq               # Write changes to disk and quit radare2

```

The `wx` (write hex) and `:wq` commands are the exact primitives recommended in the repository's patching documentation for in-place binary modification.

### Verification

Confirm the patch persisted correctly by examining the modified binary:

```bash
r2 -qc "pd 5 @ 0x401250" mybinary

# Output should now show NOP instructions instead of the original conditional branch

```

## Automating Patches with r2pipe

For CI/CD integration or batch processing, automate the workflow using **r2pipe** rather than interactive commands.

```python
import r2pipe

# Open binary in write mode

r = r2pipe.open("mybinary", flags=["-w"])

# Execute analysis and patching

r.cmd("aaa")                           # Analyze all

r.cmd("wx 90 @ 0x401250")              # Write patch

r.cmd("q")                             # Quit

```

Alternatively, use a one-liner shell approach for scripts:

```bash
r2 -i <(printf "s 0x401250\nwx 90\n:") -q mybinary

```

The radare2 skill in reverse-skill explicitly lists `r2pipe` as a supported API for Python-based automation pipelines.

## Summary

- **reverse-skill** organizes reverse-engineering capabilities into modular skill blocks routed by `skills/scripts/master-route.ps1`.
- Install radare2 using [`skills/scripts/refresh-tool-index.sh`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/scripts/refresh-tool-index.sh) or [`kali/scripts/bootstrap-reverse.sh`](https://github.com/zhaoxuya520/reverse-skill/blob/main/kali/scripts/bootstrap-reverse.sh) for platform-specific setup.
- Begin analysis with [`skills/radare2/scripts/recon.sh`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/radare2/scripts/recon.sh) for quick metadata, then use `r2 -AA` followed by `aaa` for deep static analysis.
- Patch binaries by seeking to target addresses with `s`, writing hex with `wx`, and committing changes with `:wq`.
- Automate workflows using **r2pipe** Python bindings for integration into larger security pipelines.

## Frequently Asked Questions

### How do I install radare2 using the reverse-skill framework?

Run `bash skills/scripts/refresh-tool-index.sh` to detect your platform and output the appropriate install command (e.g., `apt install radare2` for Debian/Ubuntu or `brew install radare2` for macOS). On Kali Linux, execute [`kali/scripts/bootstrap-reverse.sh`](https://github.com/zhaoxuya520/reverse-skill/blob/main/kali/scripts/bootstrap-reverse.sh) for fully automated setup.

### What is the difference between `aa` and `aaa` in radare2?

`aa` performs basic analysis of functions and symbols, while `aaa` executes a more comprehensive analysis pass that includes recursive function discovery, cross-reference analysis, and type propagation. The [`skills/radare2/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/radare2/SKILL.md) file recommends `aaa` for thorough binary inspection before patching.

### How do I permanently save binary patches in radare2?

After modifying bytes with `wx` (write hex), use `:wq` to write the changes to the underlying file and quit. The colon prefix invokes radare2's shell escape, allowing standard vim-style write-quit semantics to persist your patches to disk.

### Can I automate radare2 commands for CI/CD pipelines?

Yes. Use **r2pipe** (Python, Node.js, or Go bindings) to script radare2 sessions programmatically. The repository includes examples showing how to open binaries in write mode, execute analysis commands (`aaa`), apply patches (`wx`), and quit non-interactively—enabling automated binary hardening or malware patching in build pipelines.