R_CORE(3)

R_CORE(3) — the Radare2 Core Library API, bestie edition 💖

okay so picture this: it's the Library Functions Manual, it's r_core, and it's literally the whole beating heart of radare2. grab a snack, we're doing this. 🍓

---

✨ NAME ✨

r_core — the Radare2 Core Library API. that's it, that's the name, she's iconic, she contains multitudes 💅

---

✨ SYNOPSIS ✨

#include <r_core.h>

that's the whole vibe. one include and you're in. 🦋

---

✨ DESCRIPTION ✨

so the r_core library hands you the central functionality of radare2 and exposes it to programs and bindings. it's giving glue, it's giving main character. it pulls together all the subsystems: binary parsing, disassembly, analysis, emulation (ESIL), debugging, and interactive UI control — all of it, in one place, no cap.

you use RCore to drive radare2 workflows: open a binary, run analyses, query information, and programmatically mess with the project state. obsessed.

Important points for embedding and scripting — read these, they're the tea ☕:

• RCore is the single structure holding the state (io, bin, anal, debug, flags, etc.). treat it as the main entrypoint for the API. it's the mothership, fr fr.
• Commands are the primary high-level control mechanism. use r_core_cmd / r_core_cmd_str to invoke existing r2 semantics from code. why reinvent when the command already ate? 👑
• Many APIs return heap-allocated strings (for example r_core_cmd_str) — the caller is responsible for freeing them. yes bestie, you are the caller. no leaking. 🫶
• Analysis functions (r_core_anal_fcn, r_core_anal_op) populate internal structures that power higher-level operations (pdf, af, crossrefs). Run analysis before relying on function graphs. no analysis, no graph, that's just how it is 😭
• Seeking (r_core_seek) changes the current offset for subsequent commands. prefer absolute seeks for deterministic behavior in scripts — your future self will thank you.

---

✨ INITIALIZATION ✨

• RCore * r_core_new(void) — allocate and initialize a fresh RCore instance with all its subsystems (io, bin, anal, dbg, flags, etc.). the returned pointer is owned by the caller and must be freed with r_core_free. it's yours now, you take care of it 💖
• void r_core_free(RCore *core) — free an RCore instance and everything attached to it. after this call the core pointer must not be used. it's gone, she's retired, do not text her back 💀
• bool r_core_init(RCore *core) — do extra initialization on an existing RCore object. most users just call r_core_new (), which already does internal initialization for you, but this one's here for when you're embedding or recreating a core structure. lowkey niche, highkey useful.

---

✨ COMMAND EXECUTION ✨

• int r_core_cmd(RCore *core, const char *cmd, bool log) — execute a textual radare2 command. this is the primary way to drive functionality from host programs: opening files (o), running analysis (aaa), printing (pd, px), and manipulating flags. log controls whether the executed command gets recorded in the core's history/log. yes she journals 📓
• char * r_core_cmd_str(RCore *core, const char *cmd) — execute a command and return its output as a newly allocated string. the caller is responsible for freeing the returned pointer (e.g. with free ()). language bindings and scripts are obsessed with this one because they need to capture command output. don't forget the free, bestie, I'm begging 🙈
• int r_core_cmdf(RCore *core, const char *fmt, ...) — format and execute a command (convenience wrapper). perfect for building commands with addresses or sizes without doing manual string handling. let the format string cook 🧑🍳
• int r_core_cmd0(RCore *core, const char *cmd) — execute a command without recording it in the log or history. use it for internal operations or when performance matters. stealth mode, no receipts 🤫

---

✨ SEEKING ✨

• bool r_core_seek(RCore *core, ut64 addr, bool rb) — set the core's current offset to addr. seeking affects subsequent commands that use the current address (for example pd or px). rb says whether the core should try to read bytes at the destination to validate the seek. so rb is like, the vibe check on the destination ✨
• bool r_core_seek_delta(RCore *core, st64 addr) — move the current offset by a signed delta relative to where you are now. great for short relative moves in scripts. little scoots, we love a little scoot 🦋
• void r_core_seek_previous(RCore *core, const char *type) — seek to the previous item of a given type (like a previous function or basic block). this is how you implement backwards navigation in tools that iterate over analysis results. rewind time, kind of 🎀

---

✨ ANALYSIS ✨

• RAnalOp * r_core_anal_op(RCore *core, ut64 addr, int mask) — analyze a single instruction at addr and return an RAnalOp * describing it. the returned RAnalOp * is owned by the caller and must be freed with r_anal_op_free (). this API is ideal when you want structured, per-instruction info without running whole-function analysis. just one lil instruction, as a treat 🍓
• bool r_core_anal_fcn(RCore *core, ut64 at, ut64 from, int reftype, int depth) — do function-level analysis starting at address at. this populates internal function graphs, basic blocks and cross-references, and it's typically followed by printing functions (pdf) or running decompiler stages. the full glow-up pipeline 💅
• void r_core_anal_esil(RCore *core, const char *str, const char *addr) — evaluate an ESIL expression or code snippet. ESIL is radare2's emulation language, and this function helps you run small fragments or boot the ESIL VM for scripted emulation. baby emulation steps 🧚
• int r_core_esil_step(RCore *core, ut64 until_addr, const char *until_expr, ut64 *prev_addr, bool stepOver) — step the ESIL VM until an address or condition is met. use it to implement single-stepping or conditional traces programmatically. one step at a time, she's careful 👑

---

✨ DISASSEMBLY ✨

• int r_core_print_disasm(RCore *core, ut64 addr, ut8 *buf, int len, int count, enum r_pdu_condition_t pdu_condition_type, const void *pdu_condition, bool count_bytes, bool json, PJ *pj, RAnalFunction *pdf) — format and print disassembly for a buffer or address range. the high-level commands (pd, pdf) are implemented using this API, so call it when you need controlled, fast formatting — and optionally JSON output via PJ. she's the engine under the hood 🔥
• char * r_core_disassemble_instr(RCore *core, ut64 addr, int l) — return a heap-allocated string with the disassembly of a single instruction at addr. caller must free it. yes, again. free it. 😤
• char * r_core_disassemble_bytes(RCore *core, ut64 addr, int b) — disassemble b bytes starting at addr and return the output as a newly allocated string. bytes go in, string comes out, you can't explain that 🌈

---

✨ BINARY OPERATIONS ✨

• bool r_core_bin_load(RCore *core, const char *file, ut64 baseaddr) — load a binary into the core for analysis. file accepts normal file paths and special providers used in tests (for example malloc://SIZE to create an in-memory file). after loading, analysis and printing commands operate on the loaded binary. she's loaded, literally 💖
• bool r_core_bin_info(RCore *core, int action, PJ *pj, int mode, int va, RCoreBinFilter *filter, const char *chksum) — retrieve structured information about the currently loaded binary (sections, symbols, checksums). use the PJ parameter for JSON-formatted output. structured info, cute presentation ✨
• bool r_core_bin_set_cur(RCore *core, RBinFile *binfile) — set the RBinFile used as current. perfect when the caller is juggling multiple binaries, or just wants to switch the active RBinFile without reloading from disk. channel surfing, but for binaries 📺

---

✨ VISUAL MODE ✨

• void r_core_visual(RCore *core, const char *input) — enter the interactive visual mode driven by RCore. frontends can call this to open the TUI and optionally feed initial key events or commands via input. it's giving immersive 🎀
• int r_core_visual_refs(RCore *core, bool xref, bool fcnInsteadOfAddr) — show cross-references inside the visual UI. the parameters control whether to show XREFs and whether to present functions instead of raw addresses. choose your fighter 💅
• bool r_core_visual_hud(RCore *core) — display or toggle the heads-up display (HUD) that shows contextual information in visual mode. heads up bestie, info incoming 👑

---

✨ PROJECT MANAGEMENT ✨

• bool r_core_project_open(RCore *core, const char *file) — open and restore a previously saved .r2 project. projects replay seeks, flags and other persistent state so you can pick up where you left off without re-running expensive analyses. your progress is safe, breathe 😮‍💨
• bool r_core_project_save(RCore *core, const char *file) — save the current session to file. after a successful save you can restore it later with r_core_project_open. save your work, bestie, please 🙏
• int r_core_project_list(RCore *core, int mode) — list available projects. super handy for UIs that expose multiple saved sessions. a whole lineup of vibes 🌸

---

✨ UNDO SYSTEM ✨

• void r_core_undo_push(RCore *core, RCoreUndo *cu) — push an undo record representing a reversible change. frontends and scripts can use this to build undo/redo flows for user actions. ctrl+z but make it API 💜
• void r_core_undo_pop(RCore *core) — revert the last undo entry recorded in the core. restores previous state (flags, bytes, metadata) as captured in the undo record. we're going back, back to before 🌈
• void r_core_undo_print(RCore *core, int mode, RCoreUndoCondition *cond) — print or query the undo history, for display or automated rollback. receipts: available 🧾

---

✨ SEARCH ✨

• int r_core_search_cb(RCore *core, ut64 from, ut64 to, RCoreSearchCallback cb) — run a custom search between from and to, invoking the callback for each hit. this low-level API gives you full control over match handling and early termination. you're the boss here 👑
• int r_core_search_preludes(RCore *core, bool log) — scan for common function preludes and heuristics to bootstrap function discovery in stripped binaries. often used before calling r_core_anal_fcn or printing results. a lil warm-up before the main event ✨

---

✨ EXAMPLES ✨

the examples below illustrate common real-world patterns found in the tree: capturing command output, using in-memory files in tests/fuzzers, and combining seeking with single-instruction analysis. real code, real patterns, no made-up nonsense 💖

Example 1 — open, analyze and capture disassembly:

/* Example 1: open, analyze and capture disassembly */
RCore *core = r_core_new();
r_core_cmd(core, "o /bin/ls", false);  /* open file */
r_core_cmd(core, "aaa", false);        /* run full analysis */
char *out = r_core_cmd_str(core, "pd 10"); /* capture output */
printf("%s0, out);
free(out);                                /* must free returned string */
r_core_free(core);

Example 2 — in-memory file used by fuzz tests (test/fuzz/fuzz_ia.c):

/* Example 2: in-memory file used by fuzz tests (test/fuzz/fuzz_ia.c) */
RCore *r = r_core_new();
/* create an anonymous in-memory file of Size bytes */
r_core_cmdf (r, "o malloc://%zu", (size_t)4096);
/* write data into r->io using r_io_write_at (test code) */
r_core_cmd0 (r, "oba 0");  /* avoid history */
r_core_cmd0 (r, "ia");     /* run instruction analysis */
r_core_free (r);

Example 3 — seek + single-instruction analysis:

/* Example 3: seek + single-instruction analysis */
RCore *c2 = r_core_new();
/* load binary first via r_core_cmd or r_core_bin_load */
r_core_seek(c2, 0x1000, true);
RAnalOp *op = r_core_anal_op(c2, 0x1000, R_ANAL_OP_MASK_BASIC);
if (op) {
    printf("Mnemonic: %s0, op->mnemonic);
    r_anal_op_free(op);
}
r_core_free(c2);

psst — yes, the printf lines above are written exactly the way they appear in the original page. copying code character-for-character is the whole point, so no "fixing" the quotes here 💅

---

✨ SEE ALSO ✨

• r_anal(3)
• r_bin(3)
• r_cons(3)
• r_flag(3)
• r_io(3)

the whole friend group, go say hi 🫶

---

✨ AUTHORS ✨

The radare2 project team. icons only, no notes 💖

---

and that's the page!! 🎀 this one's from Debian, dated September 20, 2025, and it lives at section R_CORE(3) — so if you ever need to find her again, that's where she'll be, slaying in the manual like always. bye bestie, go free your strings 💅✨