How to Analyze and Patch Binaries Using radare2 with CLI Workflow: A Complete Guide

You can analyze and patch binaries using radare2's CLI by opening the target with r2 -AA, analyzing functions with aaa, seeking to target addresses with s, and writing patches with wx followed by :wq to save changes.

The reverse-skill repository provides a modular framework for orchestrating reverse-engineering tasks through dedicated "skill" blocks. This guide demonstrates how to leverage the radare2 skill within that ecosystem to perform complete binary analysis and patching using pure command-line workflows, based on the actual implementation found in skills/radare2/SKILL.md and supporting scripts.

Architectural Overview of the reverse-skill Framework

The reverse-skill project is a task-skill router that orchestrates reverse-engineering, security analysis, and pentest workflows via a modular architecture. Understanding this structure helps contextualize where radare2 fits into the broader automation pipeline.

Core Router Layer

The routing logic that maps user intent to specific skills lives in skills/scripts/master-route.ps1. This script decides which skill to invoke based on input hints like "radare2 analyze" and validates coherence via skills/scripts/verify-routing-coherence.ps1.

Skill Definitions

Each capability is described by a markdown "SKILL" file. The radare2 implementation is located at skills/rare2/SKILL.md, which documents the complete CLI command reference for binary analysis and patching according to the reverse-skill source code.

Tool Discovery and Installation

Cross-platform installation logic resides in skills/scripts/refresh-tool-index.sh. This script discovers, downloads, and installs required binaries across Linux, macOS, and Windows. For Kali Linux specifically, kali/scripts/bootstrap-reverse.sh handles automated radare2 setup and environment configuration.

Auxiliary Scripts

The repository includes quick reconnaissance helpers like skills/radare2/scripts/recon.sh, which extracts basic binary metadata (sections, imports, strings) using rabin2-equivalent functionality before deep analysis begins.

Installing radare2 via the Tool Index

Before analysis, ensure radare2 is installed using the repository's platform-aware helpers.

# Query the tool index for radare2 installation commands

bash skills/scripts/refresh-tool-index.sh | grep radare2

# Example output on Ubuntu/Debian systems:

#   apt install radare2

# Execute the installation

sudo apt update && sudo apt install -y radare2

For Kali Linux deployments, the bootstrap script at kali/scripts/bootstrap-reverse.sh automates this process entirely.

Step-by-Step radare2 CLI Workflow

The following workflow mirrors the guidance embedded in skills/radare2/SKILL.md and demonstrates the complete lifecycle from reconnaissance to patched binary.

Initial Reconnaissance

Start with fast metadata extraction to understand the binary structure without full disassembly.

# Run the provided recon script (equivalent to rabin2 -z)

bash skills/radare2/scripts/recon.sh mybinary

This outputs sections, imports, strings, and entropy metrics—providing the "first look" recommended by the radare2 skill before launching the interactive shell.

Deep Static Analysis

Launch radare2 with automatic analysis flags to populate function lists and cross-references.

# Open with automatic analysis (-AA)

r2 -AA mybinary

# Inside the r2 prompt:

[0x00000000]> aaa          # Perform deeper analysis (functions, symbols, xrefs)

[0x00000000]> afl          # List all discovered functions

[0x00000000]> pdf @ sym.main   # Disassemble the main function

The aaa command is the canonical entry point documented in skills/radare2/SKILL.md for comprehensive function discovery.

Locating the Patch Target

Navigate to the specific instruction requiring modification. For example, to bypass a license check at 0x401250:

[0x00000000]> s 0x401250      # Seek to the target address

[0x401250]> pd 5              # Print five instructions of disassembly

Identify the conditional jump (je, jne, or similar) that controls program flow.

Applying Binary Patches

Overwrite the target instructions with NOPs (0x90) or alternative opcodes, then commit changes to disk.

[0x401250]> wx 90             # Write hex 0x90 (NOP) at current address

[0x401250]> :wq               # Write changes to disk and quit radare2

The wx (write hex) and :wq commands are the exact primitives recommended in the repository's patching documentation for in-place binary modification.

Verification

Confirm the patch persisted correctly by examining the modified binary:

r2 -qc "pd 5 @ 0x401250" mybinary

# Output should now show NOP instructions instead of the original conditional branch

Automating Patches with r2pipe

For CI/CD integration or batch processing, automate the workflow using r2pipe rather than interactive commands.

import r2pipe

# Open binary in write mode

r = r2pipe.open("mybinary", flags=["-w"])

# Execute analysis and patching

r.cmd("aaa")                           # Analyze all

r.cmd("wx 90 @ 0x401250")              # Write patch

r.cmd("q")                             # Quit

Alternatively, use a one-liner shell approach for scripts:

r2 -i <(printf "s 0x401250\nwx 90\n:") -q mybinary

The radare2 skill in reverse-skill explicitly lists r2pipe as a supported API for Python-based automation pipelines.

Summary

• reverse-skill organizes reverse-engineering capabilities into modular skill blocks routed by skills/scripts/master-route.ps1.
• Install radare2 using skills/scripts/refresh-tool-index.sh or kali/scripts/bootstrap-reverse.sh for platform-specific setup.
• Begin analysis with skills/radare2/scripts/recon.sh for quick metadata, then use r2 -AA followed by aaa for deep static analysis.
• Patch binaries by seeking to target addresses with s, writing hex with wx, and committing changes with :wq.
• Automate workflows using r2pipe Python bindings for integration into larger security pipelines.

Frequently Asked Questions

How do I install radare2 using the reverse-skill framework?

Run bash skills/scripts/refresh-tool-index.sh to detect your platform and output the appropriate install command (e.g., apt install radare2 for Debian/Ubuntu or brew install radare2 for macOS). On Kali Linux, execute kali/scripts/bootstrap-reverse.sh for fully automated setup.

What is the difference between aa and aaa in radare2?

aa performs basic analysis of functions and symbols, while aaa executes a more comprehensive analysis pass that includes recursive function discovery, cross-reference analysis, and type propagation. The skills/radare2/SKILL.md file recommends aaa for thorough binary inspection before patching.

How do I permanently save binary patches in radare2?

After modifying bytes with wx (write hex), use :wq to write the changes to the underlying file and quit. The colon prefix invokes radare2's shell escape, allowing standard vim-style write-quit semantics to persist your patches to disk.

Can I automate radare2 commands for CI/CD pipelines?

Yes. Use r2pipe (Python, Node.js, or Go bindings) to script radare2 sessions programmatically. The repository includes examples showing how to open binaries in write mode, execute analysis commands (aaa), apply patches (wx), and quit non-interactively—enabling automated binary hardening or malware patching in build pipelines.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}