# How to Perform Binary Analysis with IDA Pro or radare2 Using reverse-skill

> Master binary analysis with IDA Pro and radare2 using the reverse-skill framework. Streamline your workflow with automated tool selection and reproducible PowerShell scripts for efficient reverse engineering.

- Repository: [ZhaoXu/reverse-skill](https://github.com/zhaoxuya520/reverse-skill)
- Tags: how-to-guide
- Published: 2026-08-06

---

**The reverse-skill framework provides a unified skill-router that automatically selects IDA Pro for GUI-based decompilation or radare2 for command-line triage, bootstrapping both tools via PowerShell scripts to enable reproducible binary analysis workflows.**

The **reverse-skill** repository (zhaoxuya520/reverse-skill) implements an automated skill-router that eliminates manual tool configuration when you perform binary analysis with IDA Pro or radare2 using reverse-skill. This framework unifies commercial and open-source reverse engineering workflows through standardized PowerShell scripts and automated bootstrapping, ensuring consistent analysis environments across different binaries.

## Skill Selection and Routing Logic

The framework uses a central **skill-router** defined in [`skills/routing.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/routing.md) to dispatch requests to the appropriate tool. Two primary skills handle binary analysis:

- **`ida-reverse`** – Selected when requests require decompilation, high-level pseudocode, or GUI interaction. This skill interfaces with IDA Pro (commercial) via the `idalib-mcp` HTTP server.
- **`radare2`** – Selected for quick command-line triage, function inspection, string analysis, or when the user explicitly mentions `radare2`, `r2`, or related utilities.

Both skills follow a standardized seven-step workflow: bootstrap verification, backend initialization, binary opening, initial survey, deep analysis, optional patching, and report generation.

## Automated Tool Bootstrapping

Before analysis begins, each skill verifies tool availability against [`skills/tool-index.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/tool-index.md). If binaries are missing, automated bootstrap scripts execute:

- **radare2**: Downloaded automatically from official GitHub releases.
- **IDA Pro**: The `idalib-mcp` component is fetched from its dedicated repository.

This self-bootstrap capability removes manual installation steps and ensures reproducible environments across different analysis machines.

## Performing Binary Analysis with IDA Pro

The `ida-reverse` skill encapsulates IDA Pro operations within PowerShell wrappers that handle the `idalib-mcp` HTTP API.

### Starting the idalib-mcp Server

Run `skills/ida-reverse/scripts/start.ps1` to launch the MCP server in the background. This script automatically terminates any stale processes and initializes the HTTP backend required for subsequent API calls.

```powershell
powershell -File "skills\ida-reverse\scripts\start.ps1"

```

### Opening Binaries with open.ps1

The `skills/ida-reverse/scripts/open.ps1` script invokes `idalib_open` via HTTP to load the target binary. It automatically handles Windows System32 protection by creating temporary copies and implements timeout reporting for large files.

```powershell
powershell -File "skills\ida-reverse\scripts\open.ps1" -Path "C:\samples\malware.exe" -NoAutoAnalysis -TimeoutSeconds 600

```

### Survey and Decompilation Functions

After opening, use `idapro_survey_binary(detail_level="minimal")` to retrieve architecture, entry points, strings, and import classification. For deep analysis, the skill exposes several key functions:

- **`idapro_decompile(addr="main")`** – Generates high-level pseudocode for specified addresses.
- **`idapro_analyze_function(addr)`** – Performs detailed function analysis.
- **`idapro_xrefs_to(addrs="0x1400150a0")`** – Queries cross-references to track data flow.
- **`idapro_callgraph`** – Generates interprocedural call graphs.

These functions are defined in [`skills/ida-reverse/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/ida-reverse/SKILL.md) and map directly to the underlying IDA Python API exposed via the MCP server.

## Performing Binary Analysis with radare2

The `radare2` skill provides both automated reconnaissance scripts and interactive command workflows.

### Static Reconnaissance with rabin2

For rapid triage without launching an interactive session, use `rabin2` commands to extract metadata:

```bash
rabin2 -I sample.dll   # Format, architecture, and entry points

rabin2 -z sample.dll   # Extract strings

rabin2 -i sample.dll   # List imports

```

To run automated analysis, execute `skills/radare2/scripts/recon.ps1` with the `-RunAnalysis` flag, which invokes `r2 -A` for comprehensive auto-analysis:

```powershell
powershell -File "skills\radare2\scripts\recon.ps1" -TargetPath "sample.dll" -RunAnalysis

```

### Interactive Analysis Workflow

For manual exploration, launch `r2` directly and follow the recommended analysis sequence documented in [`skills/radare2/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/radare2/SKILL.md):

```bash
r2 sample.dll
> aaa          # Run light auto-analysis

> afl          # List all functions

> iz~http      # Grep for HTTP-related strings

> pdf @sym.main # Disassemble main function

> axt 0x401020 # Find cross-references to address

> VV           # Enter visual mode for graph view

```

### Binary Patching

Both skills expose patch primitives, though radare2 provides more direct command-line modification. Open the binary in write mode using `r2 -w`, then apply patches with `wa` (write assembly) or `wx` (write hex):

```bash
r2 -w sample.exe
> s 0x401030         # Seek to jump instruction

> wa je 0x401045     # Replace JNE with JE

> wq                 # Write changes and quit

```

**Warning:** The workflow explicitly requires user confirmation before entering write mode (`-w`) to prevent accidental corruption, as documented in the patching sections of both [`ida-reverse/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/ida-reverse/SKILL.md) and [`radare2/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/radare2/SKILL.md).

## Summary

- **reverse-skill** unifies IDA Pro and radare2 through a central routing table ([`skills/routing.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/routing.md)) that selects the optimal tool based on analysis requirements.
- **Automated bootstrapping** eliminates setup friction by downloading radare2 from GitHub releases and `idalib-mcp` from its repository when tools are missing from the `tool-index`.
- **Scripted reproducibility** is enforced through PowerShell wrappers (`start.ps1`, `open.ps1`, `recon.ps1`) that standardize server initialization, binary handling, and timeout management.
- **Deep analysis capabilities** include decompilation (`idapro_decompile`), cross-reference queries (`idapro_xrefs_to`, `axt`), and binary patching (`wa`, `wx`, `idapro_patch`).
- **Safety mechanisms** protect system binaries via temporary copies and require explicit confirmation for write operations.

## Frequently Asked Questions

### Does reverse-skill require manual installation of IDA Pro or radare2?

No. The framework includes auto-bootstrap logic that downloads radare2 directly from GitHub releases and fetches the `idalib-mcp` server from its repository if these tools are absent from the [`skills/tool-index.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/tool-index.md). PowerShell scripts in `skills/ida-reverse/scripts/` and `skills/radare2/scripts/` handle verification and installation automatically.

### How does reverse-skill decide whether to use IDA Pro or radare2?

The [`skills/routing.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/routing.md) file maps user intents to specific skills. The framework selects `ida-reverse` for requests involving decompilation, pseudocode generation, or GUI workflows, while `radare2` is chosen for command-line triage, quick string/inspection tasks, or when the user explicitly mentions radare2 terminology. This routing ensures the most appropriate tool handles each analysis phase.

### Can reverse-skill analyze Windows system binaries like those in System32?

Yes, but with safeguards. The `skills/ida-reverse/scripts/open.ps1` script automatically detects protected System32 binaries and creates temporary copies to prevent permission errors and accidental modification. For radare2, the `recon.ps1` script ensures the binary path is reachable before invoking analysis commands, handling permission constraints gracefully.

### What patch operations are supported when using reverse-skill with these tools?

Both skills support binary modification, though implementation differs. The `ida-reverse` skill exposes `idapro_patch` for byte-level modification through the IDA API, while the `radare2` skill supports interactive patching via `wa` (assemble) and `wx` (write hex) commands in write mode (`r2 -w`). Both workflows enforce explicit user confirmation before persisting changes to disk.