Radare2 Cheat Sheet

Posted on In Views: Disqus: Word count in article: 347 Reading time ≈ 1 mins.

A concise guide to common operations and tools within the Radare2 framework.

rax2 - Base Conversion

Used for converting between various numerical bases and formats.

Command Line

1
2
3
rax2 0x28       # Hex to decimal
rax2 40         # Decimal to hex
rax2 -h         # Show help

Internal (within r2)

Use the ? command to evaluate expressions or convert values. 

1
2
[0x00000000]> ? 0x28     # Convert 0x28 to all formats
[0x00000000]> ? 3+4      # Evaluate basic math

rabin2 - Binary Information

Extracts information from executable files (imports, exports, strings, etc.).

Common Commands

1
2
3
4
5
rabin2 -I file  # General binary info (arch, OS, bits, etc.)
rabin2 -z file  # List strings in data sections
rabin2 -zz file # List strings in the entire binary
rabin2 -i file  # List imports (linked libraries/functions)
rabin2 -e file  # List entry points

radare2 (r2) - Core Interactive Tool

The main interface for disassembly, analysis, and debugging.

Startup

1
2
3
r2 -A file      # Open file and run analysis (aaa)
r2 -w file      # Open file in write mode
r2 file         # Open without any analysis
1
2
3
s 0x400500      # Seek to specific address
s main          # Seek to 'main' symbol
s -             # Seek back to previous location

Analysis (a)

1
2
3
aa              # Basic analysis
aaa             # Full analysis (including functions and symbols)
afl             # List all analyzed functions

Disassembly & Printing (p)

1
2
3
4
5
pdf             # Print Disassembly of current Function
pdf @ main      # Print Disassembly of specific function
pd 10           # Print 10 lines of Disassembly
pD 32           # Print 32 bytes of Disassembly
px 64           # Print 64 bytes of Hexdump

Writing (w)

Note: Requires opening r2 with -w. 

1
2
wx 909090       # Write hex bytes (NOPs)
wa nop          # Assemble and write a single instruction

Visual Modes (v, V)

1
2
3
4
5
v               # Open visual panels
V               # Enter visual mode
VV              # Enter visual graph mode
v test          # Load saved layout 'test'
v= test         # Save current layout as 'test'

rasm2 - Assembler & Disassembler

Quickly assemble or disassemble instructions.

Usage

1
2
3
4
5
# Assemble an instruction (x86, 64-bit)
rasm2 -a x86 -b 64 "nop"

# Disassemble hex code (machine code)
rasm2 -a x86 -b 64 -d "90"

Useful Shortcuts (Internal)

  • ? - Show general help
  • V - Enter visual mode
  • VV - Enter visual graph mode
  • q - Exit current mode or r2