# Difference Between IDA-Reverse and Radare2 Skill Modules: Binary Analysis Automation

> Compare ida-reverse and radare2 skill modules for binary analysis automation. Discover IDA Pro's advanced decompilation versus Radare2's lightweight CLI analysis.

- Repository: [ZhaoXu/reverse-skill](https://github.com/zhaoxuya520/reverse-skill)
- Tags: deep-dive
- Published: 2026-08-08

---

**The ida-reverse module leverages MCP-RPC calls to IDA Pro for decompilation and advanced type analysis, while the radare2 module executes direct CLI commands for lightweight, license-free static analysis and reconnaissance.**

The reverse-skill repository provides automated binary analysis workflows through modular skill definitions. Understanding the difference between ida-reverse and radare2 skill modules helps security researchers choose between high-fidelity decompilation and lightweight open-source analysis based on licensing constraints and automation requirements.

## Core Architecture and Integration Patterns

Both modules integrate with the routing layer defined in [`skills/MASTER-ROUTING.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/MASTER-ROUTING.md), but they differ fundamentally in how they interface with their underlying analysis engines.

### IDA-Reverse: MCP-RPC Server Architecture

The ida-reverse skill operates through an HTTP-based **Model Context Protocol (MCP)** server. According to [`skills/ida-reverse/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/ida-reverse/SKILL.md), this module requires the `idalib-mcp` Python package to expose IDA Pro functionality as structured JSON-RPC endpoints.

Key architectural components include:
- **`scripts/start.ps1`**: Initializes the background HTTP server and manages process lifecycle
- **`scripts/open.ps1`**: Handles binary loading via API, including locked file detection, timeout handling (default 600 seconds), and temporary System32 copies
- **MCP Functions**: All operations return structured JSON via `idapro_*` prefixed calls such as `idapro_survey_binary` and `idapro_decompile`

This architecture abstracts IDA Pro's GUI components, enabling deterministic PowerShell orchestration while maintaining access to Hex-Rays decompiler output and the type system.

### Radare2: Native CLI Automation

Conversely, the radare2 skill in [`skills/radare2/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/radare2/SKILL.md) implements direct shell command execution without intermediate RPC layers. The module interacts with `r2`, `rabin2`, and `radiff2` binaries through standard input/output streams.

Key architectural components include:
- **`scripts/recon.ps1`**: Aggregates `rabin2` commands (`-I`, `-z`, `-i`, `-E`) for rapid static reconnaissance
- **Interactive Sessions**: Direct `r2` process spawning for command sequences like `aaa` (auto-analysis), `afl` (list functions), `iz` (list strings), and `pdf` (print disassembly function)
- **Language Agnostic**: Supports automation via `r2pipe` bindings or direct `-c` flag scripting

## Capability and Feature Comparison

**Decompilation and Code Analysis**
- **IDA-Reverse**: Provides access to Hex-Rays decompiler through `idapro_decompile(addr)` and rich type system operations via `idapro_declare_type` and `idapro_set_type`
- **Radare2**: Limited to disassembly (`pdf`, `pdc`) without built-in decompiler; relies on external tools for pseudo-code generation

**Cross-References and Analysis**
- **IDA-Reverse**: Advanced xref analysis through `idapro_xrefs_to(addr)` with structured data-flow tracking
- **Radare2**: Cross-reference commands like `axt <addr>` (find references to address) executed within interactive sessions

**Binary Patching and Diffing**
- **IDA-Reverse**: Integrated debugging capabilities through `idapro_debugger_*` functions and `?ext=dbg` parameters
- **Radare2**: Native patching via `wa` (write assembly) and `wx` (write hex) commands, plus binary diffing through `radiff2 old.exe new.exe`

**Platform and Licensing**
- **IDA-Reverse**: Requires licensed IDA Pro installation; Windows-centric workflow with GUI dependencies managed by `scripts/bootstrap-reverse.ps1`
- **Radare2**: Open-source with automatic bootstrap downloading from GitHub releases; cross-platform support for Linux, macOS, and Windows headless environments

## Workflow Execution Patterns

### IDA-Reverse Deterministic Workflow

The ida-reverse module enforces a strict three-phase execution model:

1. **Server Initialization**: `scripts/start.ps1` ensures singleton HTTP server operation, cleaning old processes before starting
2. **Binary Preparation**: `scripts/open.ps1` manages file handles, timeouts, and schema validation
3. **RPC Execution**: Calls such as `idapro_type_query` and `idapro_idalib_*` session management functions return parsed JSON for downstream processing

### Radare2 Flexible Pipeline

The radare2 skill emphasizes rapid command chaining:

1. **Verification**: `r2 -v` checks tool availability (auto-installed by root-level `scripts/bootstrap-reverse.ps1` if missing, updating [`tool-index.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/tool-index.md))
2. **Batch Reconnaissance**: `scripts/recon.ps1` executes `rabin2 -I` (file info), `-z` (strings), `-i` (imports), and `-E` (exports) for immediate intelligence
3. **Interactive or Scripted**: Direct `r2` invocation with `-c "aaa;afl;iz"` for one-shot analysis or persistent sessions for manual exploration

## Practical Usage Examples

### Automating IDA-Reverse Analysis

```powershell

# Start the MCP HTTP server (background process management)

powershell -File "skills/ida-reverse/scripts/start.ps1"

# Open target with automatic file locking handling

powershell -File "skills/ida-reverse/scripts/open.ps1" `
    -Path "C:\samples\suspect.dll" -TimeoutSeconds 600

# Execute MCP functions for deep analysis

idapro_survey_binary(detail_level="full")
idapro_decompile(addr="sub_140001000")
idapro_xrefs_to(addr="0x140002000")

```

*All `idapro_*` calls return structured JSON suitable for automated parsing and correlation. Reference [`skills/ida-reverse/references/ida-mcp-cheatsheet.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/ida-reverse/references/ida-mcp-cheatsheet.md) for the complete function list.*

### Running Radare2 Reconnaissance

```powershell

# Verify installation (bootstrap auto-downloads if absent)

r2 -v

# Execute comprehensive reconnaissance script

powershell -File "skills/radare2/scripts/recon.ps1" `
    -TargetPath "/mnt/samples/malware.elf" -RunAnalysis

# Manual command pipeline for targeted inspection

rabin2 -I /mnt/samples/malware.elf    # File metadata and headers

rabin2 -z /mnt/samples/malware.elf    # Extract strings

# Interactive session for deep analysis

r2 /mnt/samples/malware.elf

# Inside r2:

aaa                # Auto-analysis (analyze all)

afl                # List all functions

iz                 # List strings

pdf @ sym.main     # Disassemble main function

axt 0x00401000     # Find xrefs to address

wa nop @ 0x00401000  # Patch instruction with NOP

```

*The `recon.ps1` script aggregates intelligence into formatted reports. Reference [`skills/radare2/references/cheatsheet.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/radare2/references/cheatsheet.md) for command syntax.*

## Installation and Bootstrapping

**IDA-Reverse Requirements**
According to [`skills/ida-reverse/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/ida-reverse/SKILL.md), this module requires:
- Licensed IDA Pro installation with Hex-Rays decompiler
- `idalib-mcp` Python package installation from GitHub
- PowerShell execution for lifecycle management in `scripts/start.ps1` and `scripts/open.ps1`

**Radare2 Auto-Installation**
The [`skills/radare2/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/radare2/SKILL.md) bootstrap table indicates automatic installation capability:
- Downloads radare2 release archives from GitHub releases
- Updates [`tool-index.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/tool-index.md) with executable paths for the routing layer
- Zero licensing costs for CI/CD integration

## Summary

- **Architecture**: IDA-Reverse uses MCP-RPC via HTTP server (`scripts/start.ps1`); Radare2 uses direct CLI execution (`scripts/recon.ps1`)
- **Decompilation**: Only IDA-Reverse provides Hex-Rays decompilation via `idapro_decompile`; Radare2 provides disassembly only through `pdf` and `pdc`
- **Licensing**: IDA-Reverse requires commercial IDA Pro; Radare2 is open-source with automatic bootstrap via `scripts/bootstrap-reverse.ps1`
- **Automation Style**: IDA-Reverse returns structured JSON for complex workflows; Radare2 returns text streams suitable for rapid shell scripting with `r2pipe`
- **Platform Support**: IDA-Reverse targets Windows GUI environments; Radare2 supports headless Linux/macOS/Windows operations without display requirements

## Frequently Asked Questions

### Which skill module should I choose for automated malware analysis without commercial licenses?

**Choose the radare2 skill module.** As implemented in [`skills/radare2/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/radare2/SKILL.md), this module automatically bootstraps the open-source radare2 suite from GitHub releases without licensing fees. The `scripts/recon.ps1` wrapper provides immediate static analysis capabilities through `rabin2` commands, making it ideal for budget-constrained environments or CI/CD pipelines where IDA Pro licenses are unavailable.

### Can the radare2 skill module decompile binary functions like IDA-Reverse?

**No.** The radare2 module lacks built-in decompilation capabilities. While IDA-Reverse exposes Hex-Rays decompiler output through `idapro_decompile(addr)`, radare2 is limited to disassembly commands such as `pdf` (print disassembly function) or `pdc` (pseudo-code decompiler). For true decompilation automation requiring high-level C-like output, IDA-Reverse is the only option between these two modules.

### How do the automation architectures differ between these skill modules?

**IDA-Reverse employs an RPC server model, while Radare2 uses direct process execution.** The ida-reverse skill maintains a persistent HTTP server (`scripts/start.ps1`) that handles JSON-RPC requests via the `idalib-mcp` protocol, maintaining session state through `idapro_idalib_*` functions. Conversely, the radare2 skill spawns ephemeral `r2` or `rabin2` processes through PowerShell, parsing standard output directly without intermediate APIs or persistent connections.

### Are both skill modules compatible with Linux analysis environments?

**Only radare2 is fully compatible out-of-the-box.** While the radare2 skill supports Linux, macOS, and Windows through `scripts/bootstrap-reverse.ps1`, IDA-Reverse requires Windows-specific PowerShell scripts (`scripts/open.ps1`) and a licensed IDA Pro installation typically used on Windows workstations. The radare2 module's CLI-first design ensures seamless headless Linux operation without X11 dependencies.