reverse-skills-max/vendor-new/analyst-ai-pack/skills/automating-analysis-with-r2pipe/SKILL.md

name, description, domain, subdomain, tags, version, author, license, mitre_attack, d3fend, references

name	description	domain	subdomain	tags	version	author	license	mitre_attack	d3fend	references
automating-analysis-with-r2pipe	Automates radare2/rizin analysis through r2pipe to script function enumeration, string and import extraction, and cross-reference queries across samples programmatically. Activates for requests to automate radare2 with r2pipe, script rizin analysis, or batch-extract functions and xrefs from binaries.	cybersecurity	reverse-engineering	reverse-engineering radare2 rizin r2pipe automation	1.0.0	analyst-ai-pack	Apache-2.0	T1027 T1059 T1587.001	D3-DA D3-SDA	radare2 r2pipe documentation — https://github.com/radareorg/radare2-r2pipe radare2 command reference — https://book.rada.re/

Automating Analysis With r2pipe

When to Use

• You want to script radare2/rizin to extract functions, imports, strings, and cross-references programmatically, across one or many samples.
• You are building a repeatable triage pipeline on top of r2's analysis commands.

Do not use r2 to debug/run the sample here — this skill drives static analysis commands (aaa, aflj, izj, iij). Run inside an isolated environment.

Prerequisites

• radare2 (or rizin) installed and the r2pipe Python package (the script degrades gracefully and reports unavailability if absent).

Safety & Handling

• r2 static analysis does not execute the sample; keep the working directory isolated.

Workflow

Step 1: Confirm r2pipe availability

python scripts/analyst.py check

Reports whether r2pipe and an r2/rizin binary are available.

Step 2: Extract an analysis summary

python scripts/analyst.py summary sample.bin

Opens the binary, runs analysis (aaa), and collects functions (aflj), imports (iij), and strings (izj) as structured JSON.

Step 3: Query cross-references

For a function of interest, gather xrefs to/from to map call relationships.

Step 4: Aggregate

Combine per-sample summaries for comparison and signature development.

Validation

• The summary returns non-empty functions/imports for a normal binary.
• JSON commands (*j) are parsed, not screen-scraped text.
• Missing r2pipe/r2 is reported clearly rather than crashing.

Pitfalls

• Forgetting to run aaa before querying functions (empty results).
• Mixing radare2 and rizin command differences in scripted output.
• Very large binaries making aaa slow — scope analysis as needed.

References

• See references/api-reference.md for the automation wrapper.
• r2pipe and radare2 command references (linked in frontmatter).