How to Perform Binary Analysis with IDA Pro or radare2 Using reverse-skill

The reverse-skill framework provides a unified skill-router that automatically selects IDA Pro for GUI-based decompilation or radare2 for command-line triage, bootstrapping both tools via PowerShell scripts to enable reproducible binary analysis workflows.

The reverse-skill repository (zhaoxuya520/reverse-skill) implements an automated skill-router that eliminates manual tool configuration when you perform binary analysis with IDA Pro or radare2 using reverse-skill. This framework unifies commercial and open-source reverse engineering workflows through standardized PowerShell scripts and automated bootstrapping, ensuring consistent analysis environments across different binaries.

Skill Selection and Routing Logic

The framework uses a central skill-router defined in skills/routing.md to dispatch requests to the appropriate tool. Two primary skills handle binary analysis:

• ida-reverse – Selected when requests require decompilation, high-level pseudocode, or GUI interaction. This skill interfaces with IDA Pro (commercial) via the idalib-mcp HTTP server.
• radare2 – Selected for quick command-line triage, function inspection, string analysis, or when the user explicitly mentions radare2, r2, or related utilities.

Both skills follow a standardized seven-step workflow: bootstrap verification, backend initialization, binary opening, initial survey, deep analysis, optional patching, and report generation.

Automated Tool Bootstrapping

Before analysis begins, each skill verifies tool availability against skills/tool-index.md. If binaries are missing, automated bootstrap scripts execute:

• radare2: Downloaded automatically from official GitHub releases.
• IDA Pro: The idalib-mcp component is fetched from its dedicated repository.

This self-bootstrap capability removes manual installation steps and ensures reproducible environments across different analysis machines.

Performing Binary Analysis with IDA Pro

The ida-reverse skill encapsulates IDA Pro operations within PowerShell wrappers that handle the idalib-mcp HTTP API.

Starting the idalib-mcp Server

Run skills/ida-reverse/scripts/start.ps1 to launch the MCP server in the background. This script automatically terminates any stale processes and initializes the HTTP backend required for subsequent API calls.

powershell -File "skills\ida-reverse\scripts\start.ps1"

Opening Binaries with open.ps1

The skills/ida-reverse/scripts/open.ps1 script invokes idalib_open via HTTP to load the target binary. It automatically handles Windows System32 protection by creating temporary copies and implements timeout reporting for large files.

powershell -File "skills\ida-reverse\scripts\open.ps1" -Path "C:\samples\malware.exe" -NoAutoAnalysis -TimeoutSeconds 600

Survey and Decompilation Functions

After opening, use idapro_survey_binary(detail_level="minimal") to retrieve architecture, entry points, strings, and import classification. For deep analysis, the skill exposes several key functions:

• idapro_decompile(addr="main") – Generates high-level pseudocode for specified addresses.
• idapro_analyze_function(addr) – Performs detailed function analysis.
• idapro_xrefs_to(addrs="0x1400150a0") – Queries cross-references to track data flow.
• idapro_callgraph – Generates interprocedural call graphs.

These functions are defined in skills/ida-reverse/SKILL.md and map directly to the underlying IDA Python API exposed via the MCP server.

Performing Binary Analysis with radare2

The radare2 skill provides both automated reconnaissance scripts and interactive command workflows.

Static Reconnaissance with rabin2

For rapid triage without launching an interactive session, use rabin2 commands to extract metadata:

rabin2 -I sample.dll   # Format, architecture, and entry points

rabin2 -z sample.dll   # Extract strings

rabin2 -i sample.dll   # List imports

To run automated analysis, execute skills/radare2/scripts/recon.ps1 with the -RunAnalysis flag, which invokes r2 -A for comprehensive auto-analysis:

powershell -File "skills\radare2\scripts\recon.ps1" -TargetPath "sample.dll" -RunAnalysis

Interactive Analysis Workflow

For manual exploration, launch r2 directly and follow the recommended analysis sequence documented in skills/radare2/SKILL.md:

r2 sample.dll
> aaa          # Run light auto-analysis

> afl          # List all functions

> iz~http      # Grep for HTTP-related strings

> pdf @sym.main # Disassemble main function

> axt 0x401020 # Find cross-references to address

> VV           # Enter visual mode for graph view

Binary Patching

Both skills expose patch primitives, though radare2 provides more direct command-line modification. Open the binary in write mode using r2 -w, then apply patches with wa (write assembly) or wx (write hex):

r2 -w sample.exe
> s 0x401030         # Seek to jump instruction

> wa je 0x401045     # Replace JNE with JE

> wq                 # Write changes and quit

Warning: The workflow explicitly requires user confirmation before entering write mode (-w) to prevent accidental corruption, as documented in the patching sections of both ida-reverse/SKILL.md and radare2/SKILL.md.

Summary

• reverse-skill unifies IDA Pro and radare2 through a central routing table (skills/routing.md) that selects the optimal tool based on analysis requirements.
• Automated bootstrapping eliminates setup friction by downloading radare2 from GitHub releases and idalib-mcp from its repository when tools are missing from the tool-index.
• Scripted reproducibility is enforced through PowerShell wrappers (start.ps1, open.ps1, recon.ps1) that standardize server initialization, binary handling, and timeout management.
• Deep analysis capabilities include decompilation (idapro_decompile), cross-reference queries (idapro_xrefs_to, axt), and binary patching (wa, wx, idapro_patch).
• Safety mechanisms protect system binaries via temporary copies and require explicit confirmation for write operations.

Frequently Asked Questions

Does reverse-skill require manual installation of IDA Pro or radare2?

No. The framework includes auto-bootstrap logic that downloads radare2 directly from GitHub releases and fetches the idalib-mcp server from its repository if these tools are absent from the skills/tool-index.md. PowerShell scripts in skills/ida-reverse/scripts/ and skills/radare2/scripts/ handle verification and installation automatically.

How does reverse-skill decide whether to use IDA Pro or radare2?

The skills/routing.md file maps user intents to specific skills. The framework selects ida-reverse for requests involving decompilation, pseudocode generation, or GUI workflows, while radare2 is chosen for command-line triage, quick string/inspection tasks, or when the user explicitly mentions radare2 terminology. This routing ensures the most appropriate tool handles each analysis phase.

Can reverse-skill analyze Windows system binaries like those in System32?

Yes, but with safeguards. The skills/ida-reverse/scripts/open.ps1 script automatically detects protected System32 binaries and creates temporary copies to prevent permission errors and accidental modification. For radare2, the recon.ps1 script ensures the binary path is reachable before invoking analysis commands, handling permission constraints gracefully.

What patch operations are supported when using reverse-skill with these tools?

Both skills support binary modification, though implementation differs. The ida-reverse skill exposes idapro_patch for byte-level modification through the IDA API, while the radare2 skill supports interactive patching via wa (assemble) and wx (write hex) commands in write mode (r2 -w). Both workflows enforce explicit user confirmation before persisting changes to disk.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}