radare2

radare2 (r2) is a Unix-style reverse engineering framework: a set of libraries, command-line tools and plugins for analyzing and modifying binaries. It began as a command-line hex editor for forensics and is a full rewrite of the original radare. It is distributed under LGPLv3, though individual plugins may carry different licenses (listed by r2 -Lj).

The main interface is an interactive shell. A typical session runs r2 /bin/ls, then aaa to analyze, afl to list functions, px for hexdumps, s to seek, pdf to disassemble a function, agf for an ASCII-art function graph, and iS/is to list sections and symbols (equivalent to rabin2 -Ss). Files can be reopened read-write (oo+) and patched with w. r2 can edit files on local disks, view kernel memory, and debug programs locally or through remote gdb/windbg servers. Scripting is available through an embedded JavaScript interpreter or through r2pipe, which drives r2 from other languages.

Coverage is broad. The README lists dozens of CPU architectures (x86, ARM, MIPS, RISC-V, AVR, WebAssembly, Dalvik, Java and others), file formats (ELF, Mach-O, PE, DEX, Dyldcache, UEFI and others), userland mounting of filesystems such as NTFS, APFS, EXT and FAT, and many operating systems including Windows, Linux, macOS, Android and the BSDs.

The r2pm package manager searches for, installs and removes plugins. Listed examples include r2ghidra (Ghidra decompiler via pdg), r2frida, r2yara, r2diaphora, the iaito Qt GUI, and the AI plugins r2ai and decai. The tool is used by reverse engineers, malware analysts, exploit developers and security researchers.

Installation

# via Source (Git)
git clone https://github.com/radareorg/radare2
radare2/sys/install.sh