vlad/reverse-skills-max
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
main
reverse-skills-max/vendor-new/analyst-ai-pack/skills/reverse-engineering-binaries-with-radare2-rizin/SKILL.md

2.6 KiB
Raw Permalink Blame History

name, description, domain, subdomain, tags, version, author, license, mitre_attack, d3fend, references
name description domain subdomain tags version author license mitre_attack d3fend references
reverse-engineering-binaries-with-radare2-rizin Reverse engineers binaries using radare2/rizin interactively, covering analysis initialization, navigation, disassembly and graph views, patching, and the visual mode workflow. Activates for requests to reverse a binary with radare2 or rizin, learn r2 commands, or navigate and disassemble a sample in r2. cybersecurity reverse-engineering
reverse-engineering
radare2
rizin
disassembly
static-analysis
1.0.0 analyst-ai-pack Apache-2.0
T1027
T1059
T1587.001
D3-DA
D3-SDA
The radare2 book — https://book.rada.re/
Rizin documentation — https://rizin.re/

Reverse Engineering Binaries With radare2/rizin

When to Use

  • You want to statically reverse a binary with the radare2/rizin command set: analyze, navigate functions, read disassembly/graphs, and patch.
  • You prefer a scriptable, terminal-based RE workflow.

Do not use r2's debug mode (-d) to run untrusted samples on your host — for static RE, open without debugging. Work in an isolated environment.

Prerequisites

  • radare2 or rizin installed and the sample (read inertly).

Safety & Handling

  • Static analysis does not execute the sample; keep the working directory isolated.

Workflow

Step 1: Open and analyze

python scripts/analyst.py cheatsheet analyze

Prints the core sequence: open read-only (r2 -e bin.cache=true sample), aaa to analyze, afl to list functions, iI/ie for info/entrypoint.

Step 2: Navigate and disassemble

Use s <addr>/s main to seek, pdf to print a function, VV for the graph view, and axt for cross-references.

Step 3: Annotate

Rename with afn, add comments with CC, define data with Cd, and flag locations with f.

Step 4: Patch (optional)

In write mode (-w), use wa/wx to assemble/patch and re-verify with pdf.

Validation

  • aaa completes and afl lists functions before deeper navigation.
  • Commands used are real r2/rizin commands (verifiable in the book).
  • Patches are re-disassembled to confirm the intended change.

Pitfalls

  • Forgetting aaa, leaving functions undefined.
  • Confusing radare2 and rizin command differences in scripts.
  • Opening with -d (debug/run) when only static analysis is intended.

References