# How radare2 Powers Binary Analysis in the reverse-skill Framework

> Discover how radare2 powers binary analysis in the reverse-skill framework. Automate reconnaissance, tool installation, and workflows on Linux, macOS, and Windows.

- Repository: [ZhaoXu/reverse-skill](https://github.com/zhaoxuya520/reverse-skill)
- Tags: how-to-guide
- Published: 2026-08-11

---

**The reverse-skill framework embeds radare2 as a self-contained CLI skill for automated binary reconnaissance, providing tool discovery, auto-installation, and ready-to-run workflows across Linux, macOS, and Windows.**

The **reverse-skill** framework treats **radare2** as a first-class skill for command-line binary analysis. According to the zhaoxuya520/reverse-skill source code, radare2 integration spans four architectural layers: skill definition, tool discovery and bootstrap, workflow automation, and routing integration. This design allows operators to perform rapid binary reconnaissance without memorizing complex radare2 syntax or managing manual installations.

## Skill Definition and Scope

The radare2 skill is formally declared in [`skills/radare2/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/radare2/SKILL.md). This file specifies:

- **Supported intents**: disassembly, string inspection, import/export analysis, lightweight patching
- **File formats**: `exe`, `dll`, `so`, `elf`, `apk`, `dex`, `wasm`
- **Auxiliary utilities**: `rabin2`, `rasm2`, `radiff2`, `rahash2`, `rax2`

The skill definition establishes radare2 as the default handler for any user intent mentioning binary analysis, strings, imports, or exports.

## Tool Discovery and Auto-Installation

The framework automates radare2 lifecycle management through two key components.

### ToolDiscovery.ps1

`skills/scripts/ToolDiscovery.ps1` contains PowerShell logic that searches common installation paths:

- `%USERPROFILE%\Tools\radare2\bin\r2.exe`
- System `PATH` directories

When radare2 is detected, the skill registers automatically. If binaries are missing, the framework triggers installation.

### Bootstrap Scripts

Cross-platform bootstrap routines handle first-time setup:

- [`skills/scripts/bootstrap-reverse.sh`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/scripts/bootstrap-reverse.sh) — Linux/macOS
- `skills/scripts/bootstrap-reverse.ps1` — Windows

These scripts fetch the latest radare2 release from the official GitHub repository and unpack it to `%USERPROFILE%\Tools\radare2`, ensuring zero-manual-setup deployment.

## Automated Reconnaissance Workflows

The core radare2 integration lives in [`skills/radare2/scripts/recon.sh`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/radare2/scripts/recon.sh) and its PowerShell counterpart `recon.ps1`. These scripts provide a "quick-recon" entry point that wraps radare2 commands into an auditable, repeatable workflow.

### Standard Reconnaissance Commands

The recon scripts execute this sequence:

1. `rabin2 -I` — basic file information
2. `rabin2 -S` — section listing
3. `rabin2 -i` / `-E` — imports and exports
4. `rabin2 -zz` — top strings discovery

### Optional Deep Analysis

When analysis mode is enabled (`-RunAnalysis` in PowerShell, `--analyze` in Bash), the scripts invoke:

```bash
r2 -A -q -c 's entry0;afl;iz;ii;q' -- sample.bin

```

This performs automatic function-level analysis, listing all functions, strings, and imports in a single pass.

## Running the Reconnaissance Scripts

### PowerShell (Windows)

Basic reconnaissance without automatic analysis:

```powershell
powershell -File "<skill-root>\radare2\scripts\recon.ps1" `
    -TargetPath "C:\samples\myapp.exe"

```

Full analysis with function discovery:

```powershell
powershell -File "<skill-root>\radare2\scripts\recon.ps1" `
    -TargetPath "C:\samples\myapp.exe" -RunAnalysis

```

### Bash (Linux/macOS)

Light reconnaissance:

```bash
bash skills/radare2/scripts/recon.sh /opt/binaries/sample.bin

```

With full analysis:

```bash
bash skills/radare2/scripts/recon.sh /opt/binaries/sample.bin --analyze

```

## Manual radare2 Commands Referenced

The recon scripts automate these underlying radare2 operations:

```bash

# File metadata extraction

rabin2 -I sample.bin

# Binary section enumeration

rabin2 -S sample.bin

# String extraction (top 40)

rabin2 -zz sample.bin | head -n 40

# Deep automated analysis

r2 -A -q -c 's entry0;afl;iz;ii;q' -- sample.bin

```

## Auxiliary Tool Integration

The skill definition exposes radare2's ecosystem beyond the core `r2` binary:

```bash

# Disassemble at specific offset

rax2 -a -s 0x401000 -e sample.bin

# Binary differential analysis

radiff2 -A old.bin new.bin

# Cryptographic hash generation

rahash2 -a sha256 sample.bin

```

## Routing and Test Validation

User hints route to the radare2 skill through [`skills/routing.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/routing.md). The mapping includes patterns like:

- "radare2 analyze binary"
- "r2 analyze"

The routing is validated by [`skills/tests/routing-benchmark.json`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/tests/routing-benchmark.json), which contains test cases ensuring these hints resolve to [`radare2/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/radare2/SKILL.md).

## Operator Documentation

Command templates and common patterns are centralized in [`skills/radare2/references/cheatsheet.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/radare2/references/cheatsheet.md). This reference eliminates the need for operators to memorize radare2 syntax, providing copy-paste ready commands for typical analysis scenarios.

## Summary

- **radare2 is embedded as a self-contained CLI skill** with automated discovery and installation
- **recon.sh and recon.ps1** provide cross-platform, parameterized workflows for binary reconnaissance
- **The routing engine** automatically triggers radare2 for user intents mentioning binary analysis, strings, or imports
- **Auxiliary tools** (`rabin2`, `radiff2`, etc.) are exposed as first-class capabilities
- **Operator documentation** in [`cheatsheet.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/cheatsheet.md) reduces cognitive load and enforces consistent usage patterns

## Frequently Asked Questions

### What file formats does the radare2 skill support?

The skill supports `exe`, `dll`, `so`, `elf`, `apk`, `dex`, and `wasm` formats as declared in [`skills/radare2/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/radare2/SKILL.md). This coverage spans Windows PE binaries, Linux ELF shared objects, Android APK/DEX packages, and WebAssembly modules.

### How does reverse-skill handle missing radare2 installations?

The `ToolDiscovery.ps1` script detects missing binaries and triggers [`bootstrap-reverse.sh`](https://github.com/zhaoxuya520/reverse-skill/blob/main/bootstrap-reverse.sh) or `bootstrap-reverse.ps1`, which download and unpack the latest official radare2 release to `%USERPROFILE%\Tools\radare2`. This ensures the skill functions without manual intervention.

### What is the difference between standard reconnaissance and full analysis?

Standard reconnaissance runs `rabin2` for file info, sections, imports, exports, and strings. Full analysis additionally invokes `r2 -A` for automatic function discovery, producing a complete function list with the `afl` command and deeper string analysis.

### Can I use radare2 auxiliary tools directly through reverse-skill?

Yes. The skill definition explicitly exposes `rabin2`, `rasm2`, `radiff2`, `rahash2`, and `rax2`. These are available for direct invocation and are referenced in the [`cheatsheet.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/cheatsheet.md) documentation for operator convenience.