# IDA-Reverse and Radare2 Skill Modules for Binary Analysis: Architecture and Workflow Differences

> Compare IDA-Reverse and Radare2 skill modules for binary analysis. Discover architecture and workflow differences between RPC-based IDA Pro and scriptable r2-pipe for efficient reverse engineering.

- Repository: [ZhaoXu/reverse-skill](https://github.com/zhaoxuya520/reverse-skill)
- Tags: deep-dive
- Published: 2026-08-07

---

**The ida-reverse skill module leverages IDA Pro's idalib-mcp HTTP server for RPC-based decompilation and type analysis, while the radare2 module uses direct CLI commands via r2-pipe for lightweight, scriptable static reconnaissance.**

The reverse-skill repository provides specialized automation for binary analysis through two distinct skill modules that integrate into the routing framework defined in [`skills/MASTER-ROUTING.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/MASTER-ROUTING.md). While both modules utilize the shared `scripts/bootstrap-reverse.ps1` for toolchain management, they target fundamentally different analysis ecosystems—one commercial and GUI-oriented, the other open-source and command-line-first. Understanding the architectural differences between these ida-reverse and radare2 skill modules for binary analysis enables security researchers to select the appropriate tooling for decompilation-heavy tasks versus rapid static reconnaissance.

## Architectural Foundations

### IDA-Reverse: MCP RPC Architecture

The ida-reverse skill operates through an HTTP-based **Model Context Protocol (MCP)** server. According to [`skills/ida-reverse/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/ida-reverse/SKILL.md), the module requires the `idalib-mcp` Python package to expose IDA Pro functionality as structured JSON-RPC endpoints.

Key characteristics include:

- **Commercial dependency**: Requires a licensed IDA Pro installation and the `idalib-mcp` package installed from GitHub
- **Server lifecycle**: Managed via `skills/ida-reverse/scripts/start.ps1`, which handles background process cleanup and port management
- **Binary handling**: `skills/ida-reverse/scripts/open.ps1` manages file locks through temporary copies and implements timeout logic
- **Function exposure**: All capabilities exposed through `idapro_*` MCP functions such as `idapro_survey_binary`, `idapro_decompile`, and `idapro_xrefs_to`

### Radare2: Native CLI Architecture

The radare2 skill module interfaces directly with the **r2-pipe** ecosystem and native radare2 binaries. As documented in [`skills/radare2/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/radare2/SKILL.md), this module emphasizes shell command automation over RPC abstraction.

Key characteristics include:

- **Open-source stack**: Auto-installs via `scripts/bootstrap-reverse.ps1` by downloading radare2 releases from GitHub
- **Direct execution**: Uses `rabin2` for metadata extraction and `r2` for interactive analysis
- **Scripting model**: The `skills/radare2/scripts/recon.ps1` wrapper chains commands like `rabin2 -I`, `rabin2 -z`, and `rabin2 -i`
- **Lightweight footprint**: No persistent server process; commands execute via `-c` flags or `r2pipe`

## Workflow Automation Comparison

### IDA-Reverse Deterministic Orchestration

The ida-reverse workflow follows a strict three-phase initialization pattern:

1. **Server initialization**: `start.ps1` launches the idalib-mcp HTTP server and validates process isolation
2. **Binary loading**: `open.ps1` transmits the target path to the server API, handling System32 copies and locked files
3. **RPC execution**: Functions like `idapro_decompile(addr="sym.main")` return structured JSON for downstream parsing

This architecture guarantees deterministic state management but requires maintaining the HTTP server lifecycle throughout the analysis session.

### Radare2 Command Chaining

The radare2 module implements immediate execution patterns:

1. **Availability check**: Verifies `r2 -v` via the bootstrap-generated [`tool-index.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/tool-index.md)
2. **Reconnaissance**: `recon.ps1` executes `rabin2 -I` (file info), `-z` (strings), `-i` (imports), and `-E` (exports) in sequence
3. **Interactive or scripted**: Analysts invoke `r2 <file>` directly or use `-c "aaa; afl; pdf~main"` for one-shot analysis

Unlike the ida-reverse module, radare2 requires no background service, making it suitable for CI/CD pipelines and headless environments.

## Capability Matrix

### Decompilation and Type Analysis

**IDA-Reverse** provides access to the **Hex-Rays decompiler** through `idapro_decompile()`, along with full type system manipulation via `idapro_declare_type` and `idapro_set_type`. It supports automatic struct/enum detection and rich session management through `idapro_idalib_*` functions.

**Radare2** offers no built-in decompiler in the base installation; analysis focuses on disassembly (`pdf` command) and static metadata extraction.

### Cross-Reference Analysis

**IDA-Reverse** exposes `idapro_xrefs_to()` and `idapro_xrefs_from()` for comprehensive cross-reference graphs with data-flow analysis capabilities.

**Radare2** utilizes `axt` (cross-references to) and `axf` (cross-references from) commands within the r2 shell for relationship mapping.

### Binary Patching and Diffing

**IDA-Reverse** provides limited patching support through debugger extensions (`idapro_open_file` with `?ext=dbg`).

**Radare2** enables native patching via `wa` (write assembly) and `wx` (write hex), plus binary diffing through the `radiff2` utility.

## Implementation Examples

### IDA-Reverse PowerShell Workflow

```powershell

# Initialize the MCP server (background process management)

powershell -File "skills/ida-reverse/scripts/start.ps1"

# Open target with file-lock handling and timeout

powershell -File "skills/ida-reverse/scripts/open.ps1" `
    -Path "C:\samples\malware.exe" -TimeoutSeconds 600

# Execute MCP functions returning structured JSON

idapro_survey_binary(detail_level="minimal")
idapro_decompile(addr="0x140001000")
idapro_type_query(symbol="struct_EPROCESS")

```

### Radare2 PowerShell Workflow

```powershell

# Verify installation via bootstrap index

r2 -v

# Automated reconnaissance with analysis flag

powershell -File "skills/radare2/scripts/recon.ps1" `
    -TargetPath "/mnt/samples/malware.elf" -RunAnalysis

# Manual command pipeline for metadata extraction

rabin2 -I /mnt/samples/malware.elf    # Binary metadata

rabin2 -z /mnt/samples/malware.elf    # Extract strings

rabin2 -i /mnt/samples/malware.elf    # List imports

# One-shot analysis without interactive shell

r2 -qc "aaa; afl; iz; pdf @ main" /mnt/samples/malware.elf

```

## Summary

- **ida-reverse** requires a licensed IDA Pro installation and operates through a persistent HTTP MCP server, offering superior decompilation via Hex-Rays and robust type system management through JSON-RPC calls defined in [`skills/ida-reverse/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/ida-reverse/SKILL.md).
- **radare2** functions as a lightweight, open-source CLI wrapper with no server dependencies, excelling at rapid static reconnaissance using `rabin2` utilities and binary patching across diverse file formats (ELF, Mach-O, PE, WASM, DEX).
- Both modules integrate into the `reverse-skill` routing framework via [`skills/MASTER-ROUTING.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/MASTER-ROUTING.md) and utilize `scripts/bootstrap-reverse.ps1` for automated toolchain installation and [`tool-index.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/tool-index.md) registration.
- Choose **ida-reverse** for Windows malware analysis requiring pseudocode output and struct recovery; choose **radare2** for Linux/macOS automation, embedded systems, and license-constrained environments.

## Frequently Asked Questions

### Does the ida-reverse module work without a commercial IDA Pro license?

No. The ida-reverse skill module requires a fully licensed **IDA Pro** installation plus the `idalib-mcp` Python package as specified in [`skills/ida-reverse/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/ida-reverse/SKILL.md). The module cannot function with the free IDA version because the MCP server relies on idalib APIs that are restricted in the commercial licensing model.

### Can the radare2 skill module perform decompilation like ida-reverse?

The radare2 module does not include built-in decompilation capabilities in its default configuration. While radare2 supports plugins like `r2ghidra-dec`, the skill module as implemented focuses on disassembly (`pdf` command) and static metadata extraction via `rabin2`. For pseudocode output equivalent to Hex-Rays, you must use the ida-reverse module.

### How does the bootstrap process differ between the two modules?

Both modules use the shared `scripts/bootstrap-reverse.ps1` logic, but with different installation targets. The ida-reverse bootstrap verifies the presence of `idalib-mcp` in the Python environment and updates [`tool-index.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/tool-index.md) with the IDA installation path. The radare2 bootstrap automatically downloads the latest radare2 release from GitHub, extracts the binaries, and registers the paths without requiring manual intervention or commercial licenses.

### Which module is better for automated CI/CD pipelines?

The **radare2** skill module is significantly better suited for CI/CD environments. It requires no persistent background server (unlike ida-reverse's HTTP MCP server managed by `start.ps1`), consumes fewer resources, and can execute one-shot analysis commands via `r2 -c` without interactive shells. The `recon.ps1` script provides deterministic output suitable for automated reporting, whereas ida-reverse's server lifecycle management adds complexity to containerized deployments.