RIZIN(1)

✨ rizin(1) — Advanced commandline hexadecimal editor, disassembler and debugger ✨

🌸 NAME 🌸

Bestie, meet rizin: the advanced commandline hexadecimal editor, disassembler and debugger. This is the RIZIN(1) manual, and we’re about to make it make sense. 💅

✨ SYNOPSIS ✨

rizin [-ACdfLMnNqStuvwzX] [-P patch] [-p prj] [-a arch] [-b bits]
      [-i file] [-s addr ] [-B baddr] [-m maddr] [-c cmd] [-e k=v]
      file|pid|-|--|=

💅 DESCRIPTION 💅

rizin is a command-line reverse engineering framework, and its whole main character energy is analyzing and disassembling binary files. It gives you tools and features for analyzing and understanding the structure, behavior, and logic of executable files. No cap. 🔥

The options are:

🎀 OPTIONS 🎀

Tiny heads-up before the list, bestie: the synopsis has -P patch and an uppercase S chilling inside the flag cluster, but the original options list doesn’t give them separate descriptions here — so I’m keeping them visible up top and not inventing extra tea. 🫶

• -- — run rizin without opening any file
• = — equivalent of rizin malloc://512
• - — read file from stdin
• -= — perform R=! command to run all commands remotely
• -0 — print \x00 after initialization and after every command executed
• -1 — redirect stderr to stdout
• -2 — close stderr file descriptor (silent warning messages)
• -a [arch] — set the assembly architecture (x86, ppc, arm, mips, bf, java, ...)
• -A — run aaa command before prompt or patch to analyze all referenced code
• -b [bits] — set the assembly bitness (16, 32, 64)
• -B [baddr] — set the base address for Position-Independent Executables (PIE)
• -c 'cmd..' — execute the specified Rizin command
• -C — specify a file in the format "host:port" to run Rizin remotely through HTTP
• -d — debug the executable file or running process pid
• -D [backend] — enable debug mode, setting the configuration variable cfg.debug=true
• -e k=v — evaluate the specified configuration variable
• -f — set block size to be equal to file size
• -F [binplugin] — force the use of a specific rbin plugin
• -h, -hh — show help messages, with -hh showing detailed help
• -H — print information about the installation paths and configuration settings of Rizin. This option is useful for obtaining details about the installation location, directories, and various components of Rizin
• -i [file] — run the commands from the script file
• -I [file] — run script file. Before the file is loaded
• -k [OS/kern] — set the assembly operating system
• -l [lib] — load the specified plugin file
• -L — list supported IO plugins
• -m [addr] — map file at given address
• -M — disable demangling
• -n, -nn — control loading of RzBin info, with -nn only loading binary structures
• -N — disable user settings/projects from ~/.rizinrc, ~/.config/rizin/rizinrc and the scripts inside .../rizinrc.d/ directory
• -NN — disable loading any scripts or plugins
• -q — quiet mode, suppresses prompt and quits after script execution
• -qq — quit before showing the prompt. Right after all the -e -c and -i arguments are evaluated
• -Q — same as q, but exiting without freeing RzCore, this produces leaks at exit time, but saves some precious ms to run the testsuite in fast mode
• -p [prj] — set project file
• -r [rz-run] — specify dbg.profile rz-run profile to use when spawning a program for debugging
• -R [rule] — specify custom rz-run directives without having to create a rz-run profile
• -s [addr] — start seeking at this address
• -T — avoid computing the file hashes
• -u — set bin.filter=false to load rbin info without filtering names
• -v — show version information and exit (use -qv to get just the version number)
• -V — show rizin library versions
• -w — open in write mode
• -x — open the file without the execute flag
• -X — same as -e bin.usextr=false, do not use extract plugins, useful for dyldcache
• -z, -zz — do not load strings or load them even in raw

🦋 ENVIRONMENT 🦋

Environment variables are giving “secret little config besties,” so here’s every single one from the page:

• ANSICON — ansicon’s W & H of the buffer and w & h of the window in the form of: "WxH (wxh)"
• DEBUGINFOD_URLS — e bin.dbginfo.debuginfod_urls - use alternative debuginfod server
• COLUMNS — terminal columns to use
• RZ_ABORTLEVEL — target log level/severity when to abort (0:DEBUG, 1:VERBOSE, 2:INFO, 3:WARN, 4:ERROR, 5:FATAL)
• RZ_CURL — whether to use curl (for SSL support)
• RZ_DEBUG_ASSERT — set a breakpoint when hitting an assert
• RZ_DEBUG_TOOL — debug tool to use when showing error messages and crash signal
• RZ_DYLDCACHE_FILTER — dyld cache filter (MacOS dynamic libraries location(s) at runtime)
• RZ_HTTP_AUTHFILE — HTTP Authentification user file
• RZ_LOGCOLORS — should the log output use colors (TODO)
• RZ_LOGFILE — logging output filename/path
• RZ_LOGLEVEL — target log level/severity (0:DEBUG, 1:VERBOSE, 2:INFO, 3:WARN, 4:ERROR, 5:FATAL)
• RZ_LOGSHOWSOURCES — should the log output contain src info (filename:lineno)
• RZ_PIPE_IN — rzpipe cmd input (file descriptor)
• RZ_PIPE_OUT — rzpipe cmd output (file descriptor)
• RZ_PREFIX — default prefix rizin was compiled for
• RZ_RCFILE — user config file
• SFLIBPATH — SFLib syscall library path

🌈 EXAMPLE 🌈

Start rizin in analysis mode (-A) on the /bin/ls executable:

rizin -A /bin/ls

Open the file /bin/ls in write mode, allowing you to make changes to the binary:

rizin -w /bin/ls

Start rizin’s debugger (-d) on /bin/ls and passes arguments "-l" and "/tmp" to the program for debugging:

rizin -d /bin/ls -l /tmp

🔥 SEE ALSO 🔥

rz-test(1), rz-hash(1), rz-find(1), rz-bin(1), rz-diff(1), rz-asm(1), rz-ax(1), rz-gg(1), rz-run(1)

👑 AUTHORS 👑

• pancake <pancake@nopcode.org>
• byteninjaa0

---

💖 That’s the whole page, bestie — dated Aug 25, 2023 and filed under RIZIN(1). Go reverse-engineer something iconic, periodt. 💖