# Setting Up radare2 CLI-Based Reverse Engineering Workflows on Linux and macOS

> Master radare2 CLI workflows on Linux/macOS. Install, run recon scripts, and use commands like aaa, afl, pdf for efficient binary analysis and patching. Boost your reverse engineering skills.

- Repository: [ZhaoXu/reverse-skill](https://github.com/zhaoxuya520/reverse-skill)
- Tags: how-to-guide
- Published: 2026-08-09

---

**To establish a complete radare2 CLI workflow on Linux or macOS, install the framework from source or package manager, execute the PowerShell recon script at `skills/radare2/scripts/recon.ps1` for automated first-pass analysis, then leverage interactive commands like `aaa`, `afl`, and `pdf` for deep binary inspection and patching.**

The `zhaoxuya520/reverse-skill` repository provides a structured, command-line-driven approach to binary analysis that operates entirely without GUI dependencies. By following the skill definition in [`skills/radare2/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/radare2/SKILL.md) and supporting resources in the `skills/radare2/references/` directory, you can perform reproducible reverse engineering on ELF, Mach-O, PE, and other formats directly from the terminal.

## Installing radare2 on Linux and macOS

### Linux Installation

For the most current features and bug fixes, build radare2 from source rather than relying on distribution packages that often lag behind upstream.

```bash
git clone https://github.com/radareorg/radare2 ~/tools/radare2-src
cd ~/tools/radare2-src
./sys/install.sh
r2 -v   # verify installation

```

*Source: [`docs/platforms/linux.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/docs/platforms/linux.md) (lines 86‑94)*

If you require a quicker installation and your distribution maintains a recent package, you may use `sudo apt install radare2`, though this may lack the latest analysis improvements.

### macOS Installation

Homebrew provides the most reliable path on macOS, automatically registering all companion utilities in your `PATH`.

```bash
brew install radare2
r2 -v   # confirm version

```

*Source: [`docs/platforms/macos.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/docs/platforms/macos.md)*

## Verifying the Toolchain

Before initiating any analysis workflow, confirm that the full tool suite is accessible. According to [`skills/radare2/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/radare2/SKILL.md), if any component is missing, the bootstrap logic in `skills/scripts/bootstrap-reverse.ps1` will trigger automatic installation.

```bash
r2 -v
rabin2 -v
rasm2 -v
radiff2 -v

```

## Automated Reconnaissance with the Recon Script

The repository includes `skills/radare2/scripts/recon.ps1`, a PowerShell script designed for automated first-pass intelligence gathering. This script extracts file format metadata, section tables, imports, exports, and strings without requiring interactive input.

Run the reconnaissance workflow with:

```powershell
powershell -File "skills/radare2/scripts/recon.ps1" -TargetPath "./sample.exe"

# Add -RunAnalysis to automatically execute r2 -A for full function discovery

```

The script outputs a structured report compatible with downstream skills such as `reverse-engineering` or `binary-diff`, making it ideal for CI/CD pipelines and CTF automation.

*Source: [`skills/radare2/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/radare2/SKILL.md) (lines 55‑76)*

## Interactive radare2 Analysis Workflow

For manual inspection, start an interactive session and follow the command sequence defined in [`skills/radare2/references/cheatsheet.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/radare2/references/cheatsheet.md):

```bash
r2 sample.exe

```

Once inside the radare2 shell, execute these steps:

1. **`aaa`** – Run light auto-analysis to build the function graph and identify symbols.
2. **`afl`** – List all discovered functions with their virtual addresses.
3. **`iz`** – Display all printable strings found in the binary.
4. **`iS`** – Show the section table (segments and sections).
5. **`s entry0`** – Seek (jump) to the program entry point.
6. **`pdf`** – Print disassembly of the current function.
7. **`VV`** – Enter visual graph mode for control-flow analysis (requires compatible terminal).
8. **`q`** – Quit the session.

*Source: [`skills/radare2/references/cheatsheet.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/radare2/references/cheatsheet.md) (lines 19‑27)*

## Locating High-Value Code Patterns

To pinpoint logic of interest, combine string filtering with cross-reference analysis as documented in the cheatsheet:

```bash

# Filter strings containing specific keywords

iz~http
iz~error

# Find cross-references to a specific address

axt 0x401234

```

After identifying a reference address, navigate and disassemble:

```bash
s 0x401234
pdf

```

*Source: [`skills/radare2/references/cheatsheet.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/radare2/references/cheatsheet.md) (lines 30‑38)*

## Binary Patching via CLI

**⚠️ Always back up the original binary before writing modifications.**

Enter write mode by launching with the `-w` flag:

```bash
r2 -w sample.exe

```

Common patching operations include:

- **`s 0x401000`** – Seek to the target offset.
- **`wa nop`** – Write an assembly instruction (NOP in this case).
- **`wx 9090`** – Write raw hexadecimal bytes directly.
- **`wq`** – Write changes to disk and quit.

*Source: [`skills/radare2/references/cheatsheet.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/radare2/references/cheatsheet.md) (lines 49‑60)*

## Non-Interactive Automation for CI/CD

For scripted workflows that require no human interaction, use radare2’s `-c` flag to execute command sequences and exit immediately:

```bash
r2 -A -q -c "afl;iz;ii;q" sample.exe

```

Here, `-A` performs auto-analysis, `-q` suppresses the startup banner, and `-c` accepts a semicolon-separated list of commands. This pattern is essential for automated triage in `reverse-skill` pipelines.

*Source: [`skills/radare2/references/cheatsheet.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/radare2/references/cheatsheet.md) (lines 62‑66)*

## Summary

- **Install** radare2 from source on Linux via [`./sys/install.sh`](https://github.com/zhaoxuya520/reverse-skill/blob/main/./sys/install.sh) or via `brew install radare2` on macOS as specified in `docs/platforms/`.
- **Verify** installation using `r2 -v` and companion tools; the bootstrap logic in [`skills/radare2/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/radare2/SKILL.md) handles missing dependencies.
- **Recon** quickly using `skills/radare2/scripts/recon.ps1` for automated metadata extraction.
- **Analyze** interactively using the command sequence `aaa` → `afl` → `iz` → `pdf` documented in the cheatsheet.
- **Patch** safely with `r2 -w`, using `wa` for assembly or `wx` for raw bytes, always backing up originals.
- **Automate** with `-c` flags for non-interactive execution in scripts and CI/CD environments.

## Frequently Asked Questions

### How do I install radare2 on Linux if the distribution package is outdated?

Clone the official repository from `https://github.com/radareorg/radare2` and run [`./sys/install.sh`](https://github.com/zhaoxuya520/reverse-skill/blob/main/./sys/install.sh) from the source root. This method, preferred in [`docs/platforms/linux.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/docs/platforms/linux.md), ensures you receive the latest analysis engines and bug fixes that distribution repositories often delay.

### Can I use the PowerShell recon script on macOS?

Yes, the `skills/radare2/scripts/recon.ps1` script is cross-platform and executes correctly on macOS provided PowerShell Core (pwsh) is installed. The script invokes `rabin2` and `r2` commands that function identically on both Linux and macOS, producing the same JSON-like output for downstream processing.

### What is the safest way to patch a binary using radare2?

Always create a backup copy before opening the target with `r2 -w`. Use `s` to seek to your target offset, then `wa` to write assembly instructions or `wx` to inject raw hex bytes. Finally, use `wq` to commit changes and quit. Never patch production binaries without verification in a controlled environment.

### How can I extract function lists and strings without entering interactive mode?

Use the non-interactive execution flag: `r2 -A -q -c "afl;iz;q" ./binary`. This command runs auto-analysis (`-A`), suppresses the banner (`-q`), executes the command string (`-c`), and exits immediately. This pattern is ideal for integration with automation scripts referenced in [`skills/radare2/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/radare2/SKILL.md).