This page looks best with JavaScript enabled

Radare2 Cheatsheet

 ·  โ˜• 3 min read  ·  โœ๏ธ Ben Mason

radare2 commands

command Args

-d โ€“ start in debug mode
-A โ€“ Auto aaa
-a arm -m 0x0800C000 -b 16
-m [addr] โ€“ map file at given address (loadaddr)
-i load script
Radare2 โ€“ aldeid

Project Managment

P โ€“ list projects
Ps <filename> โ€“ Save to filename

shell commands

aaa โ€“ analyse all
afl โ€“ command (Analyze Functions List).
s <function> โ€“ seek to function or any memory address
axt @@ str.* โ€“ find usage of strings
ood โ€“ Open binary in debugger
?[??][expr] โ€“ Help or evaluate math expression
s..[addr] โ€“ seek to lower part of address

Set parameters

e var=? will list possible options
e asm.arch โ€“ ASM achitecture arm
e asm.bits โ€“ Processor bits 8.16.32.64 etc

Change Data Type

Cs [len] โ€“ set current address and length to string
Cd [len] โ€“ set current address and length to data
C- [len] โ€“ set current address and length to code
Cf [len] โ€“ set current address and length to struct

Comments

CC โ€“ Add comment at current location
CC- โ€“ Remove Comment
CCu <comments> @ <Address> โ€“ Add comments a specified address

change data type (Hint)

ahi s โ€“ set specific offset as string
ahi s @0x080485a3 set single address to string
ahi s @@=0x080485a3 0x080485ad 0x080485b7 โ€“ sets multiple memory addresses strings @@ is an integrator place holder

rename function

s fcn.00401510
afn better_name

Or by using
afn better_name fcn.00401510
afn better_name 0x00401510
afn better_name @fcn.00401510
afn better_name @0x00401510

variables

afvn [identifier] [new_name]
afvt [name] [new_type] change type for given argument/local
afvd print local variables (debug mode)

Print

pdf โ€“ print disassemble function
ps โ€“ print string, EX: ps @ 0x02ee

  • @ is a temporary seek
    pdc โ€“ print C pseudo code

flags

fs โ€“ To list the flag spaces
fs <flagspace>; f โ€“ show specific flag space

searching

pd 0xdff ~0xc6

rabin2 โ€“ binary info

i? โ€“ Commands related to rabin2, information about the binary
iz โ€“ List strings in data sections
izz โ€“ Search for Strings in the whole binary

Visual mode

V โ€“ visual mode from r2 or switch to Graph in Visual Mode
j / k โ€“ move forward or back
p / P โ€“ switch between visual modes
<enter> โ€“ jump / call to go to location
:<r2 command> โ€“ run radare2 command in visual mode
;[-]comment โ€“ add or [-] remove comment

Visual Graph

VV โ€“ visual graph
:<r2 command> โ€“ run radare2 command in visual mode
v โ€“ visual code review
p / P โ€“ switch between visual graphs
R โ€“ change colors
;[-]comment โ€“ add or [-] remove comment
? โ€“ show commands
TAB โ€“ Jump to next function
t โ€“ Jump to true branch
f โ€“ Jump to false branch

Misc

/V4 0x40000000 0x4000f000 find perperal between those address ranges
~ โ€“ Grep
? โ€“ at end count of hits on search
$$ โ€“ current offeset
/v โ€“ find dwords
/r โ€“ find refs

radare2/intro.md at master ยท radare/radare2 ยท GitHub

A journey into Radare 2 โ€“ Part 1: Simple crackme โ€“ Megabeets
A journey into Radare 2 โ€“ Part 2: Exploitation โ€“ Megabeets

Reverse Engineering With Radare2 โ€“ Intro โ€“ Insinuator.net
Reverse Engineering With Radare2 โ€“ Part 2 โ€“ Insinuator.net
Reverse Engineering With Radare2 โ€“ Part 3 โ€“ Insinuator.net
Radare2 cheat Sheet โ€“ { Anas Aboureada }

Share on

Ben Mason
WRITTEN BY
Ben Mason
Computer Security โ€“ Reverse Engineering โ€“ Malware โ€“ Electronics Hobbyist โ€“ Sometimes Photographer โ€“ Spaceflight โ€“ Cat Enthusiast