What is this?
r2 (radare2) is a libre reverse engineering framework for Unix-like systems: a set of libraries, tools and plugins for analyzing, disassembling, emulating, debugging and modifying binaries.
r2 (radare2) is a libre reverse engineering framework for Unix-like systems: a set of libraries, tools and plugins for analyzing, disassembling, emulating, debugging and modifying binaries.So is it a library I link against, or a tool I run?Both, but the center of it is a full-featured low-level command-line tool. The project began as a simple command-line hexadecimal editor focused on forensics.
Both, but the center of it is a full-featured low-level command-line tool. The project began as a simple command-line hexadecimal editor focused on forensics.What do I need to have installed first?Just a build toolchain on a Unix-like system: make, or meson/ninja (muon/samu works too). On Windows builds require meson and msvc or mingw as compilers.
Just a build toolchain on a Unix-like system: make, or meson/ninja (muon/samu works too). On Windows builds require meson and msvc or mingw as compilers.Is there a GUI, or is it all terminal?Out of the box r2 is terminal-only; the graphical way in is iaito, the official Qt interface, which you install as a plugin.
Out of the box r2 is terminal-only; the graphical way in is iaito, the official Qt interface, which you install as a plugin.What does it run on?Almost everything: Windows (XP or newer, x86/x64/arm64), Linux, macOS and iOS, Android, the BSDs, QNX, Solaris, Haiku and more — a classic cross-platform Unix tool.
Almost everything: Windows (XP or newer, x86/x64/arm64), Linux, macOS and iOS, Android, the BSDs, QNX, Solaris, Haiku and more — a classic cross-platform Unix tool.Is the license straightforward?Mostly: the core is LGPLv3, but each plugin can ship under a different license — check r2 -Lj for the details before bundling anything.
Mostly: the core is LGPLv3, but each plugin can ship under a different license — check r2 -Lj for the details before bundling anything.Is there a decompiler?Yes, several: r2ghidra exposes the native Ghidra decompiler via the pdg command, r2dec is a JS-based decompiler on pdd, and decai is an AI-based decompiler.
Yes, several: r2ghidra exposes the native Ghidra decompiler via the pdg command, r2dec is a JS-based decompiler on pdd, and decai is an AI-based decompiler.Can I script it from other languages?Yes — r2pipe lets you drive r2 from any programming language, r2papi adds a high-level API on top of it, and r2 itself embeds a JavaScript interpreter.
Yes — r2pipe lets you drive r2 from any programming language, r2papi adds a high-level API on top of it, and r2 itself embeds a JavaScript interpreter.Which CPU architectures can it disassemble?Dozens: x86, ARM, MIPS, RISC-V, PowerPC, SPARC and m68k alongside embedded and vintage chips like AVR, Z80, 6502 and 8051, plus Java/Dalvik bytecode, WebAssembly and MSIL.
Dozens: x86, ARM, MIPS, RISC-V, PowerPC, SPARC and m68k alongside embedded and vintage chips like AVR, Z80, 6502 and 8051, plus Java/Dalvik bytecode, WebAssembly and MSIL.What file formats can it open?ELF, PE/PE+, Mach-O and COFF binaries, DEX and Java class files, WASM, BIOS/UEFI images, kernel caches, Windows minidumps, plus console formats like GB/GBA, NDS and PSX.
ELF, PE/PE+, Mach-O and COFF binaries, DEX and Java class files, WASM, BIOS/UEFI images, kernel caches, Windows minidumps, plus console formats like GB/GBA, NDS and PSX.What are similar projects?pwndbg, Detect-It-Easy, x64dbg, ablation, ghidra, dnSpy, ida-pro-mcp, vol-rs
pwndbg, Detect-It-Easy, x64dbg, ablation, ghidra, dnSpy, ida-pro-mcp, vol-rsWhich topics is it in?commandline, disassembler, forensics, debugger, lgpl, decompiler, malware-analysis, binary-analysis, scripting, freebsd, kernel, hacking-tool
commandline, disassembler, forensics, debugger, lgpl, decompiler, malware-analysis, binary-analysis, scripting, freebsd, kernel, hacking-tool