RABIN2(1)

🦋 rabin2 — section 1 of the manual, bestie 🦋

okay so this is rabin2 (that's the name, and it lives in manual section 1), and she is literally the Binary Information Extractor. think of her as the friend who can look at any binary and tell you what's inside it. no cap. 💖

---

✨ NAME ✨

rabin2 — Binary Information Extractor

---

🎀 SYNOPSIS 🎀

rabin2 [-AcdeEghHiIjJlLMpqQrRsStuVvwxZ] [-a arch] [-b bits] [-B addr]
       [-C fmt:C:[D]] [-D lang sym|-] [-f subbin] [-F binfmt] [-k query]
       [-K algo] [-m addr] [-n str] [-N minlen:maxlen] [-o str]
       [-O binop] [-X fmt file ...] [-@ addr] file

---

🌸 DESCRIPTION 🌸

she's a binary information extractor, and she speaks ELF, PE, MZ and Mach-O — giving you all the tea on headers, sections, symbols, imports, exports and debug data. it's giving forensic main character energy. 🔥

also, most of these options are lowkey available inside the radare2 i command too (just type i? for help). iykyk. 💅

---

👑 OPTIONS 👑

• -@ addr — show the section, symbol or import that lives at that given address
• -A — list sub-binaries and their associated arch-bits pairs
• -a arch — set the arch (x86, arm, .. or <arch>_<bits>)
• -b bits — set the bits (32, 64, ...)
• -B addr — override the base address (for address independent binaries)
• -c — list classes
• -cc — list classes in header format
• -C [fmt:C[:D]] — create [elf,mach0,pe] with Code and Data hexpairs (see -a)
• -d — show debug/dwarf information
• -D lang symbolname|- — demangle a symbol name (or - to read from stdin) for that lang — options are cxx, ibmxl, swift, java, msvc, ..
• -e — program entrypoint
• -ee — constructor/destructor entrypoints
• -E — globally exportable symbols
• -f subbin — select the sub-binary architecture. super useful for fat-mach0 binaries 🫶
• -F binfmt — force it to use that bin plugin (ignore header check)
• -g — same as -SMZIHVResizcld -SS -SSS -ee (show all info). the "give me everything" option, obsessed.
• -G addr — load address . address to header
• -h — show this help message
• -H — header fields
• -I — binary info
• -i — imports (symbols imported from libraries)
• -j — output in json
• -J var — display an environment variable
• -k query — perform an SDB query on the loaded file. for example: '*'
• -K algo — calculate section checksums (md5, sha1, ..)
• -l — list linked libraries to the binary
• -L plugin — list supported bin plugins or plugin details
• -m addr — show the source line at addr
• -M — main (show address of main symbol)
• -n str — show the section, symbol or import named str
• -N minlen:maxlen — force min:max number of chars per string (see -z and -zz)
• -o str — output file or extraction directory for write operations
• -O binop — perform a binary operation on the target binary (dump, resize, change sections, ...). use -O help for more info:

e/0x8048000       change entrypoint
d/s/1024          dump symbols
d/S/.text         dump section
r/.data/1024      resize section
R                 remove RPATH
a/l/libfoo.dylib  add library
p/.data/rwx       change section permissions
c                 show Codesign data
C                 show LDID entitlements

• -p — show always physical addresses
• -P — show debug/pdb information
• -PP — download the pdb file for the binary
• -q — be quiet, just show less data
• -qq — show less info (no addr/size for -z for ex.)
• -Q — show load address used by dlopen (non-aslr libs)
• -r — radare output
• -R — relocations
• -s — symbols
• -S — sections
• -SS — segments
• -SSS — sections mapping to segments
• -t — display file hashes
• -T — display file signature, certificates and signing details
• -u — resources
• -v — display version and quit
• -V — show binary version information
• -w — display try/catch blocks
• -x — extract sub-binaries contained in the file (for example, architectures inside a FAT Mach-O binary). combine it with -S, -SS, or -u to extract sections, segments, or raw resources instead. so like, -xS extracts sections, -xSS extracts segments, and -xu extracts resources. resource extraction may be combined with section or segment extraction. section, segment and resource filenames include their kind, sanitized name or type, and index — and existing files are never overwritten, no worries bestie 🫶. use -o dir to pick the output directory. without it, sections, segments and resources get written below <file>.sections, <file>.segments and <file>.resources respectively. sub-binaries keep the traditional <file>.fat directory.
• -X format file ... — package the given files in fat or zip
• -z — strings (from data section)
• -Z — guess the size of the binary program
• -zz — show strings from raw bins
• -zzz — dump raw strings to stdout (for huge files)

---

🌈 ENVIRONMENT 🌈

• R2_NOPLUGINS — same as r2 -N. do not load shared plugins
• R2_PLUGINS_ORDER — plugin load order: i=internal, e=env, h=home, s=system; default=iehs; ? prints help
• RABIN2_ARGS — ignore the CLI and use these arguments instead
• RABIN2_CHARSET — set the default value charset for -z strings
• RABIN2_DEBASE64 — same as r2 -e bin.str.debase64 — try to decode all strings as base64 if possible
• RABIN2_DEMANGLE — same as r2 -e bin.demangle — demangle symbols
• RABIN2_DEMANGLE_CMD — same as r2 -e bin.demangle.cmd — try to purge false positives
• RABIN2_DEMANGLE_TRYLIB — same as r2 -e bin.demangle.trylib=<bool> — load Swift libs to demangle (default: false)
• RABIN2_FILTER — same as r2 -e bin.filter=<bool> — set to false to not rename duplicated symbols/sections (default: true)
• RABIN2_LANG — same as r2 -e bin.lang — assume lang for demangling
• RABIN2_MACHO_NOFUNCSTARTS — if set, it will ignore the FUNCSTART information
• RABIN2_MACHO_NOSWIFT — avoid parsing the swift metadata
• RABIN2_MACHO_SKIPFIXUPS — do not parse the mach-o chained fixups
• RABIN2_MAXSTRBUF — same as r2 -e bin.str.maxbuf — specify maximum buffer size
• RABIN2_PDBSERVER — same as r2 -e pdb.server — use an alternative PDB server
• RABIN2_PREFIX — same as r2 -e bin.prefix — prefix symbols/sections/relocs with a specific string
• RABIN2_RESRAW — same as r2 -e bin.resraw=true — extract resources without decoding their contents
• RABIN2_STRFILTER — same as r2 -e bin.str.filter
• RABIN2_STRPURGE — same as r2 -e bin.str.purge — try to purge false positives
• RABIN2_SYMSTORE — same as r2 -e pdb.symstore — path to downstream symbol store
• RABIN2_VERBOSE — same as r2 -e bin.verbose=true — show debugging messages from the parser

---

💜 EXAMPLES 💜

list the symbols of a program — classic, iconic:

$ rabin2 -s a.out

get the offset of a symbol:

$ rabin2 -n _main a.out

get the entrypoint:

$ rabin2 -e a.out

load symbols and imports from radare2:

$ r2 -n /bin/ls
[0x00000000]> .!rabin2 -prsi $FILE

---

🍓 SEE ALSO 🍓

radare2(1) — go say hi to her big sister 💖

---

🧚 AUTHORS 🧚

written by pancake <pancake@nopcode.org>. king behaviour, fr fr. 👑

---

that's the whole page, bestie — no gatekeeping, everything's in there. ✨

and a lil sign-off: this page is RABIN2(1), dated July 14, 2026. mwah 💋 🎀