--- name: "radare2" section: "1" platform: "linux" package: "radare2" version: "6.2.2-1" release: "Arch Linux 2026-11-01" platforms: ["linux"] url: "https://new.carta.tech/radare2" --- # radare2(1) Advanced command-line hexadecimal editor, disassembler and debugger ## NAME **radare2** – Advanced command-line hexadecimal editor, disassembler and debugger ## SYNOPSIS **radare2** \[**-a** *arch*\] \[**-b** *bits*\] \[**-B** *baddr*\] \[**-c** *cmd*\] \[**-e** *k=v*\] \[**-i** *file*\] \[**-I** *prefile*\] \[**-k** *kernel*\] \[**-m** *addr*\] \[**-p** *project*\] \[**-P** *patch*\] \[**-r** *rarun2*\] \[**-R** *rr2rule*\] \[**-s** *addr*\] \[**-012AdDEjwntLquvVxX**\] *-\|--\|=\|file* ## DESCRIPTION An advanced command-line hex editor, disassembler, and debugger, providing interactive reverse engineering, scripting, and automation capabilities for binary analysis and vulnerability research. The alias 'r2' may be used as a shorthand for radare2. The options are: - **-****-** Open radare2 on an empty file - **-** Equivalent of 'r2 malloc://512' - **-0** Print \\x00 after initialization and after every command executed - **-1** Redirect stderr to stdout - **-2** Close stderr before starting RCore - **-a** *arch* force asm.arch (x86, ppc, arm, mips, bf, java, ...) - **-A** run 'aaa' command before prompt or patch to analyze all referenced code. Use -AA to run aaaa - **-b** *bits* force asm.bits (16, 32, 64) - **-B** *baddr* Specify the base address to be used when loading a new binary. See 'e?bin.baddr' - **-c** *cmd* Execute the given command before giving prompt - **-d** Start in debugger mode - **-D** *dbg.backend* Enable debug mode. Set cfg.debug=true - **-e** *k=v* Set configuration eval variable key=value. For example -e scr.color=false. When -e is passed after -j, it will set the script source to run instead of setting eval vars. - **-E** Edit the user startup script using the cfg.editor (EDITOR env) of choice - **-f** Blocksize = file size - **-j** Run QJS script if an argument is passed or enter the qjs shell if no file is specified. You can evaluate expressions when passing the -e flag after the -j. - **-i** *file* Run script, lang program or radare2 plugin file. After the file is loaded - **-I** *file* Run script, lang program or radare2 plugin file. Before the file is loaded - **-k** *kernel* Select kernel (asm.os) for syscall resolution - **-L** List loaded IO plugins. - **-LL** List loaded core plugins. - **-m** *addr* map file at given address - **-M** Disable demangling - **-n** Do not perform any analysis (r\_bin). Just load the raw file - **-nn** Only load the rbin structures (elf, mach0, ...) - **-N** Do not load user settings/projects from ~/.radare2rc, ~/.config/radare2/rc and the scripts inside ~/.config/radare2/rc.d/ directory. - **-NN** Same as -N but also disables the automatic loading of plugins on startup time - **-q** Quiet mode (no prompt) and quit after running the commands specified with -i or -c - **-qq** Quit before showing the prompt. Right after all the -e -c and -i arguments are evaluated. - **-Q** Same as q, but exiting without freeing RCore, this produces leaks at exit time, but saves some precious ms to run the testsuite in fast mode. - **-p** *prj* Set project file - **-P** *file* Apply rapatch file and quit (see doc/rapatch.md for more details) - **-r** *rarun2* Specify dbg.profile rarun2 profile to use when spawning a program for debugging - **-R** *rarun2-directive* Specify custom rarun2 directives without having to create a rarun2 profile - **-s** *addr* Start seeking at this address - **-S** Enable sandboxed mode (same as -e cfg.sandbox=true) - **-t** Get binary information and analyze binary in a background thread - **-T** Avoid computing the file hashes - **-u** Set bin.filter=false to load rbin info without filtering names - **-v** Show version information and exit (Use -qv to get just the version number) - **-V** Show radare2 library versions (prints JSON format if -j is used) - **-w** Open in write mode - **-h** Show help message - **-H** \[variable\] Show files and environment help, or print the selected variable - **-x** Open the file map without executable permissions - **-X** Same as -e bin.usextr=false, do not use extract plugins, useful for dyldcache ## SHELL Type '?' for help ## VISUAL To enter visual mode use the 'V' command. Then press '?' for help ## DEBUGGER In r2 the debugger commands are implemented under the 'd' command. Type 'd?' for help Useful debugger additions include: - **dts+** Start recording reversible debugger session state. - **dtsc** \[*label*\] Create a checkpoint from the current live state. Checkpoints carry a stable id and may branch from the current checkpoint. - **dtsr** *id* Restore a checkpoint by id and continue from that branch. - **dtsd** *id* Delete a non-current leaf checkpoint. - **dtst** *dir* / **dtsf** *dir* Save and load the current debug session, including checkpoint ids and parent links. - **dtsw** *id* *fd* *hex* / **dtswc** *id* \[*fd* / **dtswj**\] Queue replay bytes on a checkpoint file descriptor, clear queued bytes, and inspect replay state in JSON form. ## ENVIRONMENT R2\_ARGS run radare2 with defined arguments in environment and ignore cli ones\ R2\_IGNVER load plugins ignoring the specified version. (be careful)\ R2\_DEBUG if defined, show error messages and crash signal\ R2\_DEBUG\_ASSERT=1 set a breakpoint when hitting an assert\ R2\_MAGICPATH /Users/pancake/.local/share/radare2/share/radare2/4.5.0-git/magic\ R2\_NOPLUGINS do not load r2 shared plugins\ R2\_PLUGINS\_ORDER plugin load order: i=internal, e=env, h=home, s=system, c=config; default=icehs; ? prints help\ R2\_RCFILE ~/.radare2rc (user preferences, batch script)\ R2\_RDATAHOME /usr/local *FILE* path to the current working file. ## SEE ALSO r2r(1), [rahash2(1)](/rahash2/1.md), [rafind2(1)](/rafind2/1.md), [rabin2(1)](/rabin2/1.md), [radiff2(1)](/radiff2/1.md), [rasm2(1)](/rasm2/1.md), [rax2(1)](/rax2/1.md), [ravc2(1)](/ravc2/1.md), [ragg2(1)](/ragg2/1.md), [rarun2(1)](/rarun2/1.md), ## AUTHORS pancake \