How radare2 Powers Binary Analysis in the reverse-skill Framework

The reverse-skill framework embeds radare2 as a self-contained CLI skill for automated binary reconnaissance, providing tool discovery, auto-installation, and ready-to-run workflows across Linux, macOS, and Windows.

The reverse-skill framework treats radare2 as a first-class skill for command-line binary analysis. According to the zhaoxuya520/reverse-skill source code, radare2 integration spans four architectural layers: skill definition, tool discovery and bootstrap, workflow automation, and routing integration. This design allows operators to perform rapid binary reconnaissance without memorizing complex radare2 syntax or managing manual installations.

Skill Definition and Scope

The radare2 skill is formally declared in skills/radare2/SKILL.md. This file specifies:

• Supported intents: disassembly, string inspection, import/export analysis, lightweight patching
• File formats: exe, dll, so, elf, apk, dex, wasm
• Auxiliary utilities: rabin2, rasm2, radiff2, rahash2, rax2

The skill definition establishes radare2 as the default handler for any user intent mentioning binary analysis, strings, imports, or exports.

Tool Discovery and Auto-Installation

The framework automates radare2 lifecycle management through two key components.

ToolDiscovery.ps1

skills/scripts/ToolDiscovery.ps1 contains PowerShell logic that searches common installation paths:

• %USERPROFILE%\Tools\radare2\bin\r2.exe
• System PATH directories

When radare2 is detected, the skill registers automatically. If binaries are missing, the framework triggers installation.

Bootstrap Scripts

Cross-platform bootstrap routines handle first-time setup:

• skills/scripts/bootstrap-reverse.sh — Linux/macOS
• skills/scripts/bootstrap-reverse.ps1 — Windows

These scripts fetch the latest radare2 release from the official GitHub repository and unpack it to %USERPROFILE%\Tools\radare2, ensuring zero-manual-setup deployment.

Automated Reconnaissance Workflows

The core radare2 integration lives in skills/radare2/scripts/recon.sh and its PowerShell counterpart recon.ps1. These scripts provide a "quick-recon" entry point that wraps radare2 commands into an auditable, repeatable workflow.

Standard Reconnaissance Commands

The recon scripts execute this sequence:

1. rabin2 -I — basic file information
2. rabin2 -S — section listing
3. rabin2 -i / -E — imports and exports
4. rabin2 -zz — top strings discovery

Optional Deep Analysis

When analysis mode is enabled (-RunAnalysis in PowerShell, --analyze in Bash), the scripts invoke:

r2 -A -q -c 's entry0;afl;iz;ii;q' -- sample.bin

This performs automatic function-level analysis, listing all functions, strings, and imports in a single pass.

Running the Reconnaissance Scripts

PowerShell (Windows)

Basic reconnaissance without automatic analysis:

powershell -File "<skill-root>\radare2\scripts\recon.ps1" `
    -TargetPath "C:\samples\myapp.exe"

Full analysis with function discovery:

powershell -File "<skill-root>\radare2\scripts\recon.ps1" `
    -TargetPath "C:\samples\myapp.exe" -RunAnalysis

Bash (Linux/macOS)

Light reconnaissance:

bash skills/radare2/scripts/recon.sh /opt/binaries/sample.bin

With full analysis:

bash skills/radare2/scripts/recon.sh /opt/binaries/sample.bin --analyze

Manual radare2 Commands Referenced

The recon scripts automate these underlying radare2 operations:

# File metadata extraction

rabin2 -I sample.bin

# Binary section enumeration

rabin2 -S sample.bin

# String extraction (top 40)

rabin2 -zz sample.bin | head -n 40

# Deep automated analysis

r2 -A -q -c 's entry0;afl;iz;ii;q' -- sample.bin

Auxiliary Tool Integration

The skill definition exposes radare2's ecosystem beyond the core r2 binary:

# Disassemble at specific offset

rax2 -a -s 0x401000 -e sample.bin

# Binary differential analysis

radiff2 -A old.bin new.bin

# Cryptographic hash generation

rahash2 -a sha256 sample.bin

Routing and Test Validation

User hints route to the radare2 skill through skills/routing.md. The mapping includes patterns like:

• "radare2 analyze binary"
• "r2 analyze"

The routing is validated by skills/tests/routing-benchmark.json, which contains test cases ensuring these hints resolve to radare2/SKILL.md.

Operator Documentation

Command templates and common patterns are centralized in skills/radare2/references/cheatsheet.md. This reference eliminates the need for operators to memorize radare2 syntax, providing copy-paste ready commands for typical analysis scenarios.

Summary

• radare2 is embedded as a self-contained CLI skill with automated discovery and installation
• recon.sh and recon.ps1 provide cross-platform, parameterized workflows for binary reconnaissance
• The routing engine automatically triggers radare2 for user intents mentioning binary analysis, strings, or imports
• Auxiliary tools (rabin2, radiff2, etc.) are exposed as first-class capabilities
• Operator documentation in cheatsheet.md reduces cognitive load and enforces consistent usage patterns

Frequently Asked Questions

What file formats does the radare2 skill support?

The skill supports exe, dll, so, elf, apk, dex, and wasm formats as declared in skills/radare2/SKILL.md. This coverage spans Windows PE binaries, Linux ELF shared objects, Android APK/DEX packages, and WebAssembly modules.

How does reverse-skill handle missing radare2 installations?

The ToolDiscovery.ps1 script detects missing binaries and triggers bootstrap-reverse.sh or bootstrap-reverse.ps1, which download and unpack the latest official radare2 release to %USERPROFILE%\Tools\radare2. This ensures the skill functions without manual intervention.

What is the difference between standard reconnaissance and full analysis?

Standard reconnaissance runs rabin2 for file info, sections, imports, exports, and strings. Full analysis additionally invokes r2 -A for automatic function discovery, producing a complete function list with the afl command and deeper string analysis.

Can I use radare2 auxiliary tools directly through reverse-skill?

Yes. The skill definition explicitly exposes rabin2, rasm2, radiff2, rahash2, and rax2. These are available for direct invocation and are referenced in the cheatsheet.md documentation for operator convenience.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}