SECURITY REVIEW
Not yet assessed
Review the original instructions and requested permissions before installing.
No security review is available for this catalog entry yet.
Community / AGENT SKILL
reverse-engineering-binaries-with-radare2-rizin
0
Reverse engineers binaries using radare2/rizin interactively, covering analysis initialization, navigation, disassembly and graph views, patching, and the visual mode workflow. Activates for requests to reverse a binary with radare2 or rizin, learn r2 commands, or navigate and disassemble a sample in r2.
Understand the trade-offs.
SKILL QUALITY
Not yet assessed
How clearly the skill guides your agent, how complete its workflow is, and how you can check the outcome.
No quality assessment is available for this catalog entry yet.
The full skill.
Original instructions from the publisher’s SKILL.md
# Reverse Engineering Binaries With radare2/rizin ## When to Use - You want to statically reverse a binary with the radare2/rizin command set: analyze, navigate functions, read disassembly/graphs, and patch. - You prefer a scriptable, terminal-based RE workflow. **Do not use** r2's debug mode (`-d`) to run untrusted samples on your host — for static RE, open without debugging. Work in an isolated environment. ## Prerequisites - radare2 or rizin installed and the sample (read inertly). ## Safety & Handling - Static analysis does not execute the sample; keep the working directory isolated. ## Workflow ### Step 1: Open and analyze ```bash python scripts/analyst.py cheatsheet analyze ``` Prints the core sequence: open read-only (`r2 -e bin.cache=true sample`), `aaa` to analyze, `afl` to list functions, `iI`/`ie` for info/entrypoint. ### Step 2: Navigate and disassemble Use `s <addr>`/`s main` to seek, `pdf` to print a function, `VV` for the graph view, and `axt` for cross-references. ### Step 3: Annotate Rename with `afn`, add comments with `CC`, define data with `Cd`, and flag locations with `f`. ### Step 4: Patch (optional) In write mode (`-w`), use `wa`/`wx` to assemble/patch and re-verify with `pdf`. ## Validation - `aaa` completes and `afl` lists functions before deeper navigation. - Commands used are real r2/rizin commands (verifiable in the book). - Patches are re-disassembled to confirm the intended change. ## Pitfalls - Forgetting `aaa`, leaving functions undefined. - Confusing radare2 and rizin command differences in scripts. - Opening with `-d` (debug/run) when only static analysis is intended. ## References - See [`references/api-reference.md`](references/api-reference.md) for the command cheatsheet tool. - The radare2 book and Rizin docs (linked in frontmatter).