Repolode
radareorg

radareorg/radare2

Libre reverse engineering framework and command-line toolset for analyzing, disassembling, debugging and emulating binaries on Unix-like systems.

Open-source alternative to:IDA ProHopper Disassembler

Stars
25,332
Forks
3,420
Open issues
791
Last commit
21 hours ago

What is it?

radare2 (r2) is a reverse engineering framework made of libraries, command-line tools and plugins. It started as a hexadecimal editor for forensics and has grown into a low-level tool for inspecting, disassembling, debugging and modifying compiled programs, as well as editing files on disk and inspecting kernel memory.

It supports a wide range of CPU architectures and file formats, including ELF, Mach-O, PE and DEX, and can debug programs locally or through remote gdb and windbg servers. Analysis and scripting are available through an embedded JavaScript interpreter and r2pipe, which lets other programming languages drive r2.

A package manager, r2pm, installs many community plugins such as a Qt graphical interface (iaito), a Ghidra-based decompiler and a Frida I/O plugin. The project is distributed under LGPLv3, with individual plugins carrying their own licenses.

Key features

  • 01Disassembles, analyzes and emulates binaries across many CPU architectures.
  • 02Parses common executable and file formats such as ELF, Mach-O, PE and DEX.
  • 03Debugs local programs or connects to remote gdb and windbg servers.
  • 04Scripts analysis through an embedded JavaScript interpreter and r2pipe from any language.
  • 05Extends functionality with plugins installable through the r2pm package manager.

Use cases

  • Reverse engineering unknown binaries or firmware during security research.
  • Analyzing suspicious executables in malware investigations.
  • Inspecting file contents and structure in digital forensics work.
  • Automating binary analysis tasks with scripts in various programming languages.

Quick start

  1. 1

    Clone the repository from GitHub

    git clone https://github.com/radareorg/radare2
  2. 2

    Run the default installation script from the cloned repository

    radare2/sys/install.sh
  3. 3

    Open a file in r2 and run the first analysis command

    r2 /bin/ls

Things to know

  • Installation is from source and requires a build toolchain.
  • Windows builds need meson and MSVC or MinGW, and the README gives less detail for them.
  • Plugins can carry different licenses than the core LGPLv3 framework.

In collections

Topics

FAQ

What is radare2?
Libre reverse engineering framework and command-line toolset for analyzing, disassembling, debugging and emulating binaries on Unix-like systems. radare2 (r2) is a reverse engineering framework made of libraries, command-line tools and plugins. It started as a hexadecimal editor for forensics and has grown into a low-level tool for inspecting, disassembling, debugging and modifying compiled programs, as well as editing files on disk and inspecting kernel memory.
Is radare2 free to use? What license does it have?
radare2 is open source under the Other license. Check the license terms before using it in commercial products.
Is radare2 still maintained?
Actively maintained. The last commit to radare2 was on Nov 6, 2026.
What can I use radare2 for?
Reverse engineering unknown binaries or firmware during security research. Analyzing suspicious executables in malware investigations. Inspecting file contents and structure in digital forensics work. Automating binary analysis tasks with scripts in various programming languages.
How do I install radare2?
Clone the repository from GitHub: git clone https://github.com/radareorg/radare2 Run the default installation script from the cloned repository: radare2/sys/install.sh Open a file in r2 and run the first analysis command: r2 /bin/ls
Where can I get radare2?
The source code and installation instructions are on GitHub: https://github.com/radareorg/radare2

Summary generated by AI from the project's README. GitHub stats refresh daily.

Related projects