Radare2 : à quoi ça sert ? Reverse CLI expliqué 2025

Timeline Radare/Radare2
────────────────────────
 
2006   Radare v1 — hex editor CLI pour forensic
2009   Radare2 — réécriture complète, architecture modulaire
2013   Premier release stable avec auto-analysis
2016   Integration décompilateur expérimental
2017   Cutter GUI initiale (sur Radare2)
2018   Ecosystème r2pipe mature (Python, Go, JS, Ruby)
2019   Ghidra release → déplacement communauté partiel
2020 Déc  Rizin fork annoncé (HACKATHON community)
2021   Cutter migre Rizin
2022+  Coexistence Radare2 + Rizin, convergence ou divergence ?
2025   Radare2 5.9.x, Rizin 0.8.x, Cutter 2.4.x (sur Rizin)

# Ces commandes fonctionnent dans les deux
r2 /bin/ls          # ou rizin /bin/ls
aa                  # analyze all
pdf @main           # print disassembly function main
afl                 # list functions
pd 10               # print 10 instructions
s 0x401000          # seek address
V                   # visual mode

Préfixes de commandes Radare2 par famille
──────────────────────────────────────────
 
a    analyse (analysis)
p    print (disassembly, data, hex)
s    seek (navigation)
i    info (binary info)
f    flag (labels, markers)
c    compare (binaries, strings)
d    debug
w    write (patching)
r    resize / remove
V    visual mode interactive
!    shell command
?    help (? [command] for details)
~    grep filter (pipe-like)
$    macros
@    temporary seek
>    write output to file
j    json output suffix

Commandes Radare2 essentielles — mémorisation prioritaire
──────────────────────────────────────────────────────────
 
Navigation
  s 0x401000         Seek address
  s main             Seek flag/symbol
  ss 100             Seek +100 bytes
  ?                  Help contextuel
  q                  Quit
 
Analysis
  aa                 Analyze all (basic)
  aaa                Analyze all (auto-name functions, strings)
  aaaa               Very deep analysis (slow on large binaries)
  af                 Analyze function at current seek
  afl                List all functions
 
Info
  ii                 List imports
  ie                 List entry points
  iS                 List sections
  iz                 List strings in data section
  izz                List strings in all sections
  is                 List symbols
 
Print / Disassembly
  pd 10              Print 10 disassembly lines
  pdf                Print function disassembly
  pdg                Print decompilation Ghidra (r2ghidra plugin)
  pdd                Print decompilation r2dec
  px 64              Print hex 64 bytes
  pv                 Print value at current seek
 
Visual Mode
  V                  Enter visual mode
  p                  Cycle view (hex/disasm/decomp)
  V:                 Visual panels mode (multi-view)
  h / j / k / l      Vim-like navigation
  q                  Exit visual
 
Flags / Markers
  f myflag=0x401000  Create flag
  fs *               List all flag spaces
  afn newname        Rename function
 
Debug
  doo                Debug reopen in debug mode
  db 0x401000        Breakpoint
  dc                 Continue
  ds                 Step into
  dso                Step over
  drr                Register references
 
Patching
  wx 90              Write bytes hex (NOP = 0x90)
  wa call main       Write assembly
  w "string"         Write ASCII
 
Scripting
  r2 -c "command" file          Run command then quit
  r2 -qc "aaa;izzj" file         JSON output for strings

Mode Visual — organisation
───────────────────────────
 
┌──────────────────────────────────────────┐
│ [hex][disasm][decomp][strings][functions]│  ← tabs via 'p' cycle
├──────────────────────────────────────────┤
│                                            │
│  Disassembly listing                       │
│  0x401000  push rbp                        │
│  0x401001  mov rbp, rsp                    │
│  0x401004  sub rsp, 0x20                   │
│  ...                                        │
│                                            │
├──────────────────────────────────────────┤
│ Status : offset flags perm                │
└──────────────────────────────────────────┘
 
Navigation :
  j/k  = up/down ligne
  h/l  = left/right byte
  p/P  = cycle views
  V:   = multi-panels mode
  ?    = help contextuel
  q    = exit

# Script Python avec r2pipe — extraction structurée d'un binaire
# pip install r2pipe
 
import r2pipe
import json
from pathlib import Path
 
def analyze_binary(binary_path: str) -> dict:
    """Retourne dict structuré avec info binaire + fonctions + strings + imports."""
    r2 = r2pipe.open(binary_path, flags=["-2"])  # -2 = silence stderr
 
    # Auto-analyze (aaa = basic analysis, plus rapide que aaaa)
    r2.cmd("aaa")
 
    result = {
        "file": str(Path(binary_path).resolve()),
        "info": {},
        "functions": [],
        "strings": [],
        "imports": [],
        "sections": [],
        "entry_points": [],
    }
 
    # Info binaire
    result["info"] = json.loads(r2.cmd("ij"))["bin"]
 
    # Entry points
    result["entry_points"] = json.loads(r2.cmd("iej"))
 
    # Fonctions
    functions = json.loads(r2.cmd("aflj"))
    result["functions"] = [
        {
            "name": f["name"],
            "offset": f["offset"],
            "size": f["size"],
            "calls": f.get("callrefs", []),
        }
        for f in functions
    ]
 
    # Strings
    result["strings"] = json.loads(r2.cmd("izzj"))
 
    # Imports
    result["imports"] = json.loads(r2.cmd("iij"))
 
    # Sections
    result["sections"] = json.loads(r2.cmd("iSj"))
 
    r2.quit()
    return result
 
 
if __name__ == "__main__":
    import sys
    result = analyze_binary(sys.argv[1])
    print(json.dumps(result, indent=2, default=str))

# Batch processing — analyse de tous samples dans un répertoire
import r2pipe
import json
import csv
from pathlib import Path
from concurrent.futures import ProcessPoolExecutor
 
def extract_iocs(binary_path: str) -> dict:
    r2 = r2pipe.open(str(binary_path), flags=["-2"])
    r2.cmd("aa")
 
    iocs = {
        "file": binary_path.name,
        "sha256": r2.cmd("itj").strip(),
        "urls": [],
        "ips": [],
        "registry_keys": [],
    }
 
    # Extract strings with regex matching
    strings = json.loads(r2.cmd("izzj"))
    import re
    URL_RE = re.compile(r"https?://[^\s<>\"']+")
    IP_RE = re.compile(r"\b\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\b")
    REG_RE = re.compile(r"HKEY_\w+\\[^\"]+", re.IGNORECASE)
 
    for s in strings:
        text = s.get("string", "")
        iocs["urls"] += URL_RE.findall(text)
        iocs["ips"] += IP_RE.findall(text)
        iocs["registry_keys"] += REG_RE.findall(text)
 
    r2.quit()
    return iocs
 
 
def process_directory(sample_dir: Path, output_csv: Path):
    samples = list(sample_dir.glob("*.exe")) + list(sample_dir.glob("*.dll"))
 
    with ProcessPoolExecutor(max_workers=8) as executor:
        results = list(executor.map(extract_iocs, samples))
 
    # Export CSV
    with open(output_csv, "w", newline="") as f:
        writer = csv.DictWriter(f, fieldnames=["file", "sha256", "urls", "ips", "registry_keys"])
        writer.writeheader()
        for r in results:
            r["urls"] = ";".join(r["urls"])
            r["ips"] = ";".join(r["ips"])
            r["registry_keys"] = ";".join(r["registry_keys"])
            writer.writerow(r)
 
    print(f"Processed {len(results)} samples → {output_csv}")
 
 
if __name__ == "__main__":
    process_directory(Path("/malware/samples"), Path("/malware/iocs.csv"))

# Installation r2ghidra (Radare2 Package Manager)
r2pm -U
r2pm -i r2ghidra
 
# Utilisation
r2 /bin/ls
[0x00004b50]> aaa
[0x00004b50]> s main
[0x00004c40]> pdg
// Ghidra decompiler output :
// void main(int argc, char **argv) { ... }

# Utilisation r2dec
[0x00004c40]> pdd
 
// Output pseudo-C r2dec style :
// int64_t main(int32_t argc, char **argv) {
//     // ...
// }

Cutter vs Radare2 CLI — quand choisir
──────────────────────────────────────
 
CUTTER GUI recommandé pour :
  ├─ Débutants reverse engineering
  ├─ Analyse manuelle exploratoire
  ├─ Workflow hybride CLI + GUI
  ├─ Formations et enseignement
  └─ Users venant de IDA Pro / Ghidra
 
RADARE2 CLI PUR recommandé pour :
  ├─ Power users maîtrisant les commandes
  ├─ Automation scripting intensif
  ├─ Workflows SSH remote / VMs headless
  ├─ Pipeline CI/CD malware analysis
  └─ Architectures exotiques sans support Cutter

#!/bin/bash
# pipeline_malware.sh
 
for sample in /malware/inbox/*.exe; do
    # Analyse rapide Radare2 → JSON structuré
    r2 -qc "aaa;ij;aflj;izzj;iij" "$sample" > /malware/output/$(basename "$sample").json
 
    # YARA scan en parallèle
    yara /yara/rules.yar "$sample" > /malware/output/$(basename "$sample").yara
 
    # Hash + VirusTotal API si configuré
    sha256=$(sha256sum "$sample" | cut -d' ' -f1)
    curl -s -H "x-apikey: $VT_KEY" "https://www.virustotal.com/api/v3/files/$sha256" \
        > /malware/output/$(basename "$sample").vt.json
 
    mv "$sample" /malware/processed/
done
 
# Indexation résultats dans OpenCTI ou MISP
python3 /scripts/push_to_misp.py /malware/output/

# CTF binary — solution en 2 minutes
r2 -A ./crackme
[0x00400540]> izz~flag       # grep strings pour "flag"
0x00601080 16 flag{try_harder_lol}
 
[0x00400540]> afl             # list functions
0x00400530 4 49 entry0
0x00400560 3 18 sym.imp.printf
0x00400580 1 40 sym.check_password
 
[0x00400540]> pdf @ sym.check_password
# Lecture assembly + détection pattern XOR simple
 
[0x00400540]> s 0x4005c0      # seek au XOR
[0x004005c0]> px 32 @ 0x601100    # hex dump target bytes

Apprendre Radare2 en 4 semaines — parcours structuré
─────────────────────────────────────────────────────
 
Semaine 1 — Installation et commandes de base
  ├─ Installation (apt install radare2 ou build from source)
  ├─ r2 -A /bin/ls
  ├─ Mémoriser 15 commandes essentielles (a, aa, s, p, pd, V, q, ?)
  └─ Tutoriel radareorg/radare2book chapitre 1-2
 
Semaine 2 — Workflows reverse classiques
  ├─ Analyse d'une dizaine de CrackMes.one 1-2 étoiles
  ├─ Visual mode (V) et multi-panels (V:)
  ├─ Flags et annotations (f, afn)
  └─ Export résultats (> file, j suffix)
 
Semaine 3 — Scripting et décompilation
  ├─ Installation r2ghidra via r2pm
  ├─ r2pipe Python — premier script analyse
  ├─ Décompilation pdg et pdd
  └─ Batch processing sur corpus
 
Semaine 4 — Niveau intermédiaire
  ├─ Cutter GUI installation et workflow hybride
  ├─ Debugger r2 pour dynamic analysis
  ├─ Plugin development (Python r2pipe class)
  └─ CTF reverse participation avec stack Radare2