radare2

by radareorg

22.9Kstars

3.2Kforks

486watchers

Updated 3 months ago

About

Radare2 is a comprehensive UNIX-like reverse engineering framework and command-line toolset for analyzing, debugging, and modifying binaries.

UNIX-like reverse engineering framework and command-line toolset

Primary Use Case

Radare2 is primarily used by security researchers, reverse engineers, and forensic analysts to analyze, debug, and manipulate binary executables across multiple architectures. It supports tasks such as disassembly, debugging, symbolic execution, and scripting, making it ideal for vulnerability research, malware analysis, and software forensics.

Key Features

Multi-architecture support for analyzing, emulating, debugging, and disassembling binaries
Command-line interface with scripting support via embedded JavaScript and r2pipe
Ability to edit files, view kernel memory, and debug locally or remotely via gdb/windbg servers
Extensible via numerous plugins including symbolic execution, decompilers, and GUI frontends
Open source under LGPLv3 with modular licensing for plugins
Support for binary diffing and AI-based decompilation plugins
Multiple build systems supported including meson/ninja and make
Integration with r2pm for browsing and installing plugins

Installation

Clone the repository: git clone https://github.com/radareorg/radare2
Run the install script: radare2/sys/install.sh
Alternatively, build using meson and ninja or make
On Windows, run preconfigure.bat, configure.bat, and make.bat with MSVC or MinGW
To uninstall current build: make uninstall
To uninstall all system installations: sudo make purge
Download prebuilt binaries from the releases page if preferred

Usage

>_ r2 -Lj

List all loaded plugins and their licenses

>_ r2pm

Browse and install radare2 plugins and tools

>_ sys/install.sh

Run the default installation script for radare2

>_ make uninstall

Uninstall the currently built radare2

>_ sudo make purge

Uninstall all system-wide radare2 installations

>_ pdd

Invoke the r2dec decompiler plugin to decompile code

Security Frameworks

Reconnaissance

Resource Development

Initial Access

Defense Evasion

Collection

Usage Insights

Integrate Radare2 scripting capabilities with automated malware analysis pipelines for scalable triage.
Leverage multi-architecture support to analyze cross-platform threats in diverse environments.
Use Radare2’s debugging and symbolic execution plugins to enhance exploit development and vulnerability research.
Combine Radare2 with threat intelligence feeds to accelerate reverse engineering of emerging malware.
Incorporate Radare2 into purple team exercises to simulate advanced adversary techniques and improve detection capabilities.