Radare2 (also known as r2) is a complete framework for reverse-engineering and analyzing binaries; composed of a set of small utilities that can be used together or independently from the command line. Built around a disassembler for computer software which generates assembly language source code from machine-executable code, it supports a variety of executable formats for different processors and operating systems.
Shown is the graphical user interface of radare2 Cutter (2018)
|Original author(s)||Sergi Alvarez (pancake)|
|Developer(s)||pancake and the core-contributors|
|Operating system||Linux, BSD, Mac OS X, Microsoft Windows, Haiku, Android, IPhone OS, Solaris, MeeGo|
It was created in February 2006, aiming to provide a free and simple command line interface for a hexadecimal editor supporting 64 bit offsets to make searches and recovering data from hard-disks, for forensic purposes. Since then, the project has grown with the aim changed to provide a complete framework for analyzing binaries while adhering to several principles of the Unix philosophy.
In 2016, the first r2con took place in Barcelona, gathering more than 100 participants, featuring various talks about various features and improvements of the framework.
Features and usage
Since originally it didn't have a GUI, it has a steep learning curve. Originally built around a hexadecimal editor, it has now a multitude of tools and features, and also bindings for several languages. Meanwhile it has a WebUI and there is an external Qt GUI called Cutter (formerly named Iaito).
Radare2 is able to assemble and disassemble a lot of things, but it can also perform binary diffing with graphs, extract information like relocations symbols, and various other types of data. Internally, it uses a NoSQL database named sdb to keep track of analysis information that can be inferred by radare2 or manually added by the user. Since it is able to deal with malformed binaries, it has also been used by software security researchers for analysis purposes.
Radare2 has a built-in debugger, that is lower-level than the classic GDB. However, it can also interface itself with the GNU debugger, or even WineDBG to debug Windows binaries on other systems. It is even possible to use it as a kernel-debugger with VMWare. Also there is a support for the WinDBG protocol.
Since it features a disassembler and a low-level debugger, radare2 can be useful to developers of exploits. The software has features which assist in exploit development, such as a ROP gadget search engine and mitigation detection. Because of the software's flexibility and support for many file formats, it is often used by capture the flag teams and other security-oriented personnel. Radare2 can also assist in creating shellcodes with its 'ragg2' tool, similar to metasploit.
Cutter is the first official graphical user interface (GUI) for radare2. It is still a young project that is mostly aimed "on those who[se] are not yet radare2 users because of the learning curve, because they don't like CLI applications or because of the difficulty/instability of radare2". It's the successor of the formerly known project Iaito that suffered from too little maintenance after it became open source on GitHub. Later on Iaito was forked and heavily rewritten, again with C++ and Qt as its base. These design choices enable it to be a cross platform application targeting Linux, MacOS as well as Windows. At the same time it was renamed to Cutter. Cutter's goal is to export the extensive functionality of radare2 to a modern user friendly GUI that can compete with other major static and dynamic analysis frameworks like Hex-Rays Interactive Disassembler, or BinaryNinja.
- Recognized file formats
- COFF and derivatives, including Win32/64/generic PE
- ELF and derivatives
- Mach-O (Mach) and derivatives
- Game Boy and Game Boy Advance cartridges
- MZ (MS-DOS)
- Java class
- Lua 5.1 and Python bytecode
- dyld cache dump
- Dex (Dalvik EXecutable)
- Xbox xbe format
- Plan9 binaries
- WinRAR virtual machine
- File system like the ext family, ReiserFS, HFS+, NTFS, FAT, ...
- DWARF and PDB file formats for storing additional debug information
- Raw binary
- Instruction sets
- Intel x86 family
- ARM architecture
- Atmel AVR series
- Motorola 68k and H8
- Ricoh 5A22
- MOS 6502
- Smartcard PSOS Virtual Machine
- Java virtual machine
- MIPS: mipsb/mipsl/mipsr/mipsrl/r5900b/r5900l
- SPARC Family
- TMS320Cxxx series
- Argonaut RISC Core
- Intel 51 series: 8051/80251b/80251s/80930b/80930s
- Zilog Z80
- Cambridge Silicon Radio (CSR)
- AndroidVM Dalvik
- EFI bytecode
- Gameboy (z80-like)
- Java Bytecode
- Nios II
- "Releases - radare/radare2". Retrieved 28 October 2019 – via GitHub.
- Git repository
- "Radare demystified". Chaos Computer Club media site. CCC. 2016-12-29. Retrieved 2016-12-29.
- ""I have written more than 300.000 code lines for Radare"". www.cigtr.info. Retrieved 2017-01-21.
- CCC, radare demystified, retrieved 2017-01-21
- "r2con 2016". NCC Group. Retrieved 2017-01-21.
- Bakken, Sam (2016-08-09). "The hacker behind open-source, reverse-engineering tool Radare..." NowSecure. Retrieved 2017-01-21.
- "Recon 2015 Schedule". recon.cx. Retrieved 2017-01-21.
- "Talks at Hack.lu 2015". Hack.lu 2015. Retrieved 2017-01-21.
- Git repository for radare2's bindings
- The new web interface
- "Binary Diffing" visual en Linux con Radare2
- AlienVault - OSX/Leverage.a Analysis
- Craig Heffner - Finding and Reversing Backdoors in Consumer Firmware
- PHDays IV, May 21, 2014, 'Anton Kochkov', Application of radare2 illustrated by Shylock/Caphaw.D and Snakso.A analysis
- Gmane archive about WinDBG support in radare2
- Dragon Sector
- Phrack - manual binary mangling with radare
- Dydl cache - iphonedevwiki.net
- .XBE File Format 1.1
- Tavis Ormandy - Fun with Constrained Programming