R2(1)

💖 radare2(1) — advanced command-line hexadecimal editor, disassembler and debugger 💖

okay so this is the radare2(1) manual page, bestie — manual name folded in near the top like a little name tag 🫶.

🌸 NAME 🌸

radare2 — advanced command-line hexadecimal editor, disassembler and debugger. That's the whole mood, no cap. 💅

✨ SYNOPSIS ✨

radare2 [-a arch] [-b bits] [-B baddr] [-c cmd] [-e k=v] [-i file]
        [-I prefile] [-k kernel] [-m addr] [-p project] [-P patch]
        [-r rarun2] [-R rr2rule] [-s addr] [-012AdDEjwntLquvVxX]
        -|--|=|file

🌈 DESCRIPTION 🌈

okay so radare2 is an advanced command-line hex editor, disassembler, and debugger — the whole package. It's giving interactive reverse engineering, scripting, and automation capabilities for binary analysis and vulnerability research. iconic fr fr.

The alias r2 may be used as a shorthand for radare2. Slay. ✨

The options are:

• -- — Open radare2 on an empty file
• - — Equivalent of r2 malloc://512
• -0 — Print \x00 after initialization and after every command executed
• -1 — Redirect stderr to stdout
• -2 — Close stderr before starting RCore
• -a arch — force asm.arch (x86, ppc, arm, mips, bf, java, ...)
• -A — run aaa command before prompt or patch to analyze all referenced code. Use -AA to run aaaa
• -b bits — force asm.bits (16, 32, 64)
• -B baddr — Specify the base address to be used when loading a new binary. See e?bin.baddr
• -c cmd — Execute the given command before giving prompt
• -d — Start in debugger mode
• -D dbg.backend — Enable debug mode. Set cfg.debug=true
• -e k=v — Set configuration eval variable key=value. For example -e scr.color=false. When -e is passed after -j, it will set the script source to run instead of setting eval vars.
• -E — Edit the user startup script using the cfg.editor (EDITOR env) of choice
• -f — Blocksize = file size
• -j — Run QJS script if an argument is passed or enter the qjs shell if no file is specified. You can evaluate expressions when passing the -e flag after the -j.
• -i file — Run script, lang program or radare2 plugin file. After the file is loaded
• -I file — Run script, lang program or radare2 plugin file. Before the file is loaded
• -k kernel — Select kernel (asm.os) for syscall resolution
• -L — List loaded IO plugins.
• -LL — List loaded core plugins.
• -m addr — map file at given address
• -M — Disable demangling
• -n — Do not perform any analysis (r_bin). Just load the raw file
• -nn — Only load the rbin structures (elf, mach0, ...)
• -N — Do not load user settings/projects from ~/.radare2rc, ~/.config/radare2/rc and the scripts inside ~/.config/radare2/rc.d/ directory.
• -NN — Same as -N but also disables the automatic loading of plugins on startup time
• -q — Quiet mode (no prompt) and quit after running the commands specified with -i or -c
• -qq — Quit before showing the prompt. Right after all the -e -c and -i arguments are evaluated.
• -Q — Same as q, but exiting without freeing RCore, this produces leaks at exit time, but saves some precious ms to run the testsuite in fast mode.
• -p prj — Set project file
• -P file — Apply rapatch file and quit (see doc/rapatch.md for more details)
• -r rarun2 — Specify dbg.profile rarun2 profile to use when spawning a program for debugging
• -R rarun2-directive — Specify custom rarun2 directives without having to create a rarun2 profile
• -s addr — Start seeking at this address
• -S — Enable sandboxed mode (same as -e cfg.sandbox=true)
• -t — Get binary information and analyze binary in a background thread
• -T — Avoid computing the file hashes
• -u — Set bin.filter=false to load rbin info without filtering names
• -v — Show version information and exit (Use -qv to get just the version number)
• -V — Show radare2 library versions (prints JSON format if -j is used)
• -w — Open in write mode
• -h — Show help message
• -H [variable] — Show files and environment help, or print the selected variable
• -x — Open the file map without executable permissions
• -X — Same as -e bin.usextr=false, do not use extract plugins, useful for dyldcache

🐚 SHELL 🐚

Type ? for help. That's it, that's the vibe. 💖

👀 VISUAL 👀

To enter visual mode use the V command. Then press ? for help. main character energy, honestly. ✨

🫶 DEBUGGER 🫶

In r2 the debugger commands are implemented under the d command. Type d? for help.

Useful debugger additions include:

• dts+ — Start recording reversible debugger session state.
• dtsc [label] — Create a checkpoint from the current live state. Checkpoints carry a stable id and may branch from the current checkpoint.
• dtsr id — Restore a checkpoint by id and continue from that branch.
• dtsd id — Delete a non-current leaf checkpoint.
• dtst dir / dtsf dir — Save and load the current debug session, including checkpoint ids and parent links.
• dtsw id fd hex / dtswc id [fd / dtswj] — Queue replay bytes on a checkpoint file descriptor, clear queued bytes, and inspect replay state in JSON form.

🌈 ENVIRONMENT 🌈

• R2_ARGS — run radare2 with defined arguments in environment and ignore cli ones
• R2_IGNVER — load plugins ignoring the specified version. (be careful)
• R2_DEBUG — if defined, show error messages and crash signal
• R2_DEBUG_ASSERT=1 — set a breakpoint when hitting an assert
• R2_MAGICPATH — /Users/pancake/.local/share/radare2/share/radare2/4.5.0-git/magic
• R2_NOPLUGINS — do not load r2 shared plugins
• R2_PLUGINS_ORDER — plugin load order: i=internal, e=env, h=home, s=system, c=config; default=icehs; ? prints help
• R2_RCFILE — ~/.radare2rc (user preferences, batch script)
• R2_RDATAHOME — /usr/local FILE path to the current working file.

🔗 SEE ALSO 🔗

r2r(1), rahash2(1), rafind2(1), rabin2(1), radiff2(1), rasm2(1), rax2(1), ravc2(1), ragg2(1), rarun2(1)

👑 AUTHORS 👑

pancake <pancake@nopcode.org> — the icon. 💅

---

source/version: RADARE2(1) • dated: May 20, 2025 • mwah 💋