Difference Between IDA-Reverse and Radare2 Skill Modules: Binary Analysis Automation

The ida-reverse module leverages MCP-RPC calls to IDA Pro for decompilation and advanced type analysis, while the radare2 module executes direct CLI commands for lightweight, license-free static analysis and reconnaissance.

The reverse-skill repository provides automated binary analysis workflows through modular skill definitions. Understanding the difference between ida-reverse and radare2 skill modules helps security researchers choose between high-fidelity decompilation and lightweight open-source analysis based on licensing constraints and automation requirements.

Core Architecture and Integration Patterns

Both modules integrate with the routing layer defined in skills/MASTER-ROUTING.md, but they differ fundamentally in how they interface with their underlying analysis engines.

IDA-Reverse: MCP-RPC Server Architecture

The ida-reverse skill operates through an HTTP-based Model Context Protocol (MCP) server. According to skills/ida-reverse/SKILL.md, this module requires the idalib-mcp Python package to expose IDA Pro functionality as structured JSON-RPC endpoints.

Key architectural components include:

• scripts/start.ps1: Initializes the background HTTP server and manages process lifecycle
• scripts/open.ps1: Handles binary loading via API, including locked file detection, timeout handling (default 600 seconds), and temporary System32 copies
• MCP Functions: All operations return structured JSON via idapro_* prefixed calls such as idapro_survey_binary and idapro_decompile

This architecture abstracts IDA Pro's GUI components, enabling deterministic PowerShell orchestration while maintaining access to Hex-Rays decompiler output and the type system.

Radare2: Native CLI Automation

Conversely, the radare2 skill in skills/radare2/SKILL.md implements direct shell command execution without intermediate RPC layers. The module interacts with r2, rabin2, and radiff2 binaries through standard input/output streams.

Key architectural components include:

• scripts/recon.ps1: Aggregates rabin2 commands (-I, -z, -i, -E) for rapid static reconnaissance
• Interactive Sessions: Direct r2 process spawning for command sequences like aaa (auto-analysis), afl (list functions), iz (list strings), and pdf (print disassembly function)
• Language Agnostic: Supports automation via r2pipe bindings or direct -c flag scripting

Capability and Feature Comparison

Decompilation and Code Analysis

• IDA-Reverse: Provides access to Hex-Rays decompiler through idapro_decompile(addr) and rich type system operations via idapro_declare_type and idapro_set_type
• Radare2: Limited to disassembly (pdf, pdc) without built-in decompiler; relies on external tools for pseudo-code generation

Cross-References and Analysis

• IDA-Reverse: Advanced xref analysis through idapro_xrefs_to(addr) with structured data-flow tracking
• Radare2: Cross-reference commands like axt <addr> (find references to address) executed within interactive sessions

Binary Patching and Diffing

• IDA-Reverse: Integrated debugging capabilities through idapro_debugger_* functions and ?ext=dbg parameters
• Radare2: Native patching via wa (write assembly) and wx (write hex) commands, plus binary diffing through radiff2 old.exe new.exe

Platform and Licensing

• IDA-Reverse: Requires licensed IDA Pro installation; Windows-centric workflow with GUI dependencies managed by scripts/bootstrap-reverse.ps1
• Radare2: Open-source with automatic bootstrap downloading from GitHub releases; cross-platform support for Linux, macOS, and Windows headless environments

Workflow Execution Patterns

IDA-Reverse Deterministic Workflow

The ida-reverse module enforces a strict three-phase execution model:

1. Server Initialization: scripts/start.ps1 ensures singleton HTTP server operation, cleaning old processes before starting
2. Binary Preparation: scripts/open.ps1 manages file handles, timeouts, and schema validation
3. RPC Execution: Calls such as idapro_type_query and idapro_idalib_* session management functions return parsed JSON for downstream processing

Radare2 Flexible Pipeline

The radare2 skill emphasizes rapid command chaining:

1. Verification: r2 -v checks tool availability (auto-installed by root-level scripts/bootstrap-reverse.ps1 if missing, updating tool-index.md)
2. Batch Reconnaissance: scripts/recon.ps1 executes rabin2 -I (file info), -z (strings), -i (imports), and -E (exports) for immediate intelligence
3. Interactive or Scripted: Direct r2 invocation with -c "aaa;afl;iz" for one-shot analysis or persistent sessions for manual exploration

Practical Usage Examples

Automating IDA-Reverse Analysis

# Start the MCP HTTP server (background process management)

powershell -File "skills/ida-reverse/scripts/start.ps1"

# Open target with automatic file locking handling

powershell -File "skills/ida-reverse/scripts/open.ps1" `
    -Path "C:\samples\suspect.dll" -TimeoutSeconds 600

# Execute MCP functions for deep analysis

idapro_survey_binary(detail_level="full")
idapro_decompile(addr="sub_140001000")
idapro_xrefs_to(addr="0x140002000")

All idapro_* calls return structured JSON suitable for automated parsing and correlation. Reference skills/ida-reverse/references/ida-mcp-cheatsheet.md for the complete function list.

Running Radare2 Reconnaissance

# Verify installation (bootstrap auto-downloads if absent)

r2 -v

# Execute comprehensive reconnaissance script

powershell -File "skills/radare2/scripts/recon.ps1" `
    -TargetPath "/mnt/samples/malware.elf" -RunAnalysis

# Manual command pipeline for targeted inspection

rabin2 -I /mnt/samples/malware.elf    # File metadata and headers

rabin2 -z /mnt/samples/malware.elf    # Extract strings

# Interactive session for deep analysis

r2 /mnt/samples/malware.elf

# Inside r2:

aaa                # Auto-analysis (analyze all)

afl                # List all functions

iz                 # List strings

pdf @ sym.main     # Disassemble main function

axt 0x00401000     # Find xrefs to address

wa nop @ 0x00401000  # Patch instruction with NOP

The recon.ps1 script aggregates intelligence into formatted reports. Reference skills/radare2/references/cheatsheet.md for command syntax.

Installation and Bootstrapping

IDA-Reverse Requirements According to skills/ida-reverse/SKILL.md, this module requires:

• Licensed IDA Pro installation with Hex-Rays decompiler
• idalib-mcp Python package installation from GitHub
• PowerShell execution for lifecycle management in scripts/start.ps1 and scripts/open.ps1

Radare2 Auto-Installation The skills/radare2/SKILL.md bootstrap table indicates automatic installation capability:

• Downloads radare2 release archives from GitHub releases
• Updates tool-index.md with executable paths for the routing layer
• Zero licensing costs for CI/CD integration

Summary

• Architecture: IDA-Reverse uses MCP-RPC via HTTP server (scripts/start.ps1); Radare2 uses direct CLI execution (scripts/recon.ps1)
• Decompilation: Only IDA-Reverse provides Hex-Rays decompilation via idapro_decompile; Radare2 provides disassembly only through pdf and pdc
• Licensing: IDA-Reverse requires commercial IDA Pro; Radare2 is open-source with automatic bootstrap via scripts/bootstrap-reverse.ps1
• Automation Style: IDA-Reverse returns structured JSON for complex workflows; Radare2 returns text streams suitable for rapid shell scripting with r2pipe
• Platform Support: IDA-Reverse targets Windows GUI environments; Radare2 supports headless Linux/macOS/Windows operations without display requirements

Frequently Asked Questions

Which skill module should I choose for automated malware analysis without commercial licenses?

Choose the radare2 skill module. As implemented in skills/radare2/SKILL.md, this module automatically bootstraps the open-source radare2 suite from GitHub releases without licensing fees. The scripts/recon.ps1 wrapper provides immediate static analysis capabilities through rabin2 commands, making it ideal for budget-constrained environments or CI/CD pipelines where IDA Pro licenses are unavailable.

Can the radare2 skill module decompile binary functions like IDA-Reverse?

No. The radare2 module lacks built-in decompilation capabilities. While IDA-Reverse exposes Hex-Rays decompiler output through idapro_decompile(addr), radare2 is limited to disassembly commands such as pdf (print disassembly function) or pdc (pseudo-code decompiler). For true decompilation automation requiring high-level C-like output, IDA-Reverse is the only option between these two modules.

How do the automation architectures differ between these skill modules?

IDA-Reverse employs an RPC server model, while Radare2 uses direct process execution. The ida-reverse skill maintains a persistent HTTP server (scripts/start.ps1) that handles JSON-RPC requests via the idalib-mcp protocol, maintaining session state through idapro_idalib_* functions. Conversely, the radare2 skill spawns ephemeral r2 or rabin2 processes through PowerShell, parsing standard output directly without intermediate APIs or persistent connections.

Are both skill modules compatible with Linux analysis environments?

Only radare2 is fully compatible out-of-the-box. While the radare2 skill supports Linux, macOS, and Windows through scripts/bootstrap-reverse.ps1, IDA-Reverse requires Windows-specific PowerShell scripts (scripts/open.ps1) and a licensed IDA Pro installation typically used on Windows workstations. The radare2 module's CLI-first design ensures seamless headless Linux operation without X11 dependencies.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}