Setting Up radare2 CLI-Based Reverse Engineering Workflows on Linux and macOS

To establish a complete radare2 CLI workflow on Linux or macOS, install the framework from source or package manager, execute the PowerShell recon script at skills/radare2/scripts/recon.ps1 for automated first-pass analysis, then leverage interactive commands like aaa, afl, and pdf for deep binary inspection and patching.

The zhaoxuya520/reverse-skill repository provides a structured, command-line-driven approach to binary analysis that operates entirely without GUI dependencies. By following the skill definition in skills/radare2/SKILL.md and supporting resources in the skills/radare2/references/ directory, you can perform reproducible reverse engineering on ELF, Mach-O, PE, and other formats directly from the terminal.

Installing radare2 on Linux and macOS

Linux Installation

For the most current features and bug fixes, build radare2 from source rather than relying on distribution packages that often lag behind upstream.

git clone https://github.com/radareorg/radare2 ~/tools/radare2-src
cd ~/tools/radare2-src
./sys/install.sh
r2 -v   # verify installation

Source: docs/platforms/linux.md (lines 86‑94)

If you require a quicker installation and your distribution maintains a recent package, you may use sudo apt install radare2, though this may lack the latest analysis improvements.

macOS Installation

Homebrew provides the most reliable path on macOS, automatically registering all companion utilities in your PATH.

brew install radare2
r2 -v   # confirm version

Source: docs/platforms/macos.md

Verifying the Toolchain

Before initiating any analysis workflow, confirm that the full tool suite is accessible. According to skills/radare2/SKILL.md, if any component is missing, the bootstrap logic in skills/scripts/bootstrap-reverse.ps1 will trigger automatic installation.

r2 -v
rabin2 -v
rasm2 -v
radiff2 -v

Automated Reconnaissance with the Recon Script

The repository includes skills/radare2/scripts/recon.ps1, a PowerShell script designed for automated first-pass intelligence gathering. This script extracts file format metadata, section tables, imports, exports, and strings without requiring interactive input.

Run the reconnaissance workflow with:

powershell -File "skills/radare2/scripts/recon.ps1" -TargetPath "./sample.exe"

# Add -RunAnalysis to automatically execute r2 -A for full function discovery

The script outputs a structured report compatible with downstream skills such as reverse-engineering or binary-diff, making it ideal for CI/CD pipelines and CTF automation.

Source: skills/radare2/SKILL.md (lines 55‑76)

Interactive radare2 Analysis Workflow

For manual inspection, start an interactive session and follow the command sequence defined in skills/radare2/references/cheatsheet.md:

r2 sample.exe

Once inside the radare2 shell, execute these steps:

1. aaa – Run light auto-analysis to build the function graph and identify symbols.
2. afl – List all discovered functions with their virtual addresses.
3. iz – Display all printable strings found in the binary.
4. iS – Show the section table (segments and sections).
5. s entry0 – Seek (jump) to the program entry point.
6. pdf – Print disassembly of the current function.
7. VV – Enter visual graph mode for control-flow analysis (requires compatible terminal).
8. q – Quit the session.

Source: skills/radare2/references/cheatsheet.md (lines 19‑27)

Locating High-Value Code Patterns

To pinpoint logic of interest, combine string filtering with cross-reference analysis as documented in the cheatsheet:

# Filter strings containing specific keywords

iz~http
iz~error

# Find cross-references to a specific address

axt 0x401234

After identifying a reference address, navigate and disassemble:

s 0x401234
pdf

Source: skills/radare2/references/cheatsheet.md (lines 30‑38)

Binary Patching via CLI

⚠️ Always back up the original binary before writing modifications.

Enter write mode by launching with the -w flag:

r2 -w sample.exe

Common patching operations include:

• s 0x401000 – Seek to the target offset.
• wa nop – Write an assembly instruction (NOP in this case).
• wx 9090 – Write raw hexadecimal bytes directly.
• wq – Write changes to disk and quit.

Source: skills/radare2/references/cheatsheet.md (lines 49‑60)

Non-Interactive Automation for CI/CD

For scripted workflows that require no human interaction, use radare2’s -c flag to execute command sequences and exit immediately:

r2 -A -q -c "afl;iz;ii;q" sample.exe

Here, -A performs auto-analysis, -q suppresses the startup banner, and -c accepts a semicolon-separated list of commands. This pattern is essential for automated triage in reverse-skill pipelines.

Source: skills/radare2/references/cheatsheet.md (lines 62‑66)

Summary

• Install radare2 from source on Linux via ./sys/install.sh or via brew install radare2 on macOS as specified in docs/platforms/.
• Verify installation using r2 -v and companion tools; the bootstrap logic in skills/radare2/SKILL.md handles missing dependencies.
• Recon quickly using skills/radare2/scripts/recon.ps1 for automated metadata extraction.
• Analyze interactively using the command sequence aaa → afl → iz → pdf documented in the cheatsheet.
• Patch safely with r2 -w, using wa for assembly or wx for raw bytes, always backing up originals.
• Automate with -c flags for non-interactive execution in scripts and CI/CD environments.

Frequently Asked Questions

How do I install radare2 on Linux if the distribution package is outdated?

Clone the official repository from https://github.com/radareorg/radare2 and run ./sys/install.sh from the source root. This method, preferred in docs/platforms/linux.md, ensures you receive the latest analysis engines and bug fixes that distribution repositories often delay.

Can I use the PowerShell recon script on macOS?

Yes, the skills/radare2/scripts/recon.ps1 script is cross-platform and executes correctly on macOS provided PowerShell Core (pwsh) is installed. The script invokes rabin2 and r2 commands that function identically on both Linux and macOS, producing the same JSON-like output for downstream processing.

What is the safest way to patch a binary using radare2?

Always create a backup copy before opening the target with r2 -w. Use s to seek to your target offset, then wa to write assembly instructions or wx to inject raw hex bytes. Finally, use wq to commit changes and quit. Never patch production binaries without verification in a controlled environment.

How can I extract function lists and strings without entering interactive mode?

Use the non-interactive execution flag: r2 -A -q -c "afl;iz;q" ./binary. This command runs auto-analysis (-A), suppresses the banner (-q), executes the command string (-c), and exits immediately. This pattern is ideal for integration with automation scripts referenced in skills/radare2/SKILL.md.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}