reverse-skill/skills/radare2/references/cheatsheet.md

radare2 速查表

基础侦察

rabin2 -I sample.exe
rabin2 -S sample.exe
rabin2 -i sample.exe
rabin2 -E sample.exe
rabin2 -zz sample.exe

进入交互

r2 sample.exe

aaa
afl
iz
iS
is
s entry0
pdf
q

字符串和引用

iz~http
iz~error
axt <addr>
s <addr>
pdf

常用查看

px 64
pd 20
psz
pxa

patch

r2 -w sample.exe

s 0x401000
wa nop
wx 9090
wq

非交互模式

r2 -A -q -c "afl;iz;ii;q" sample.exe

其他工具

rasm2

rasm2 -d "9090"
rasm2 -a x86 -b 64 "xor eax, eax"

radiff2

radiff2 old.exe new.exe
radiff2 -C old.exe new.exe

rahash2

rahash2 -a md5 sample.exe
rahash2 -a sha256 sample.exe

rax2

rax2 0x401000
rax2 4198400
rax2 -s hello

radare2-skills 生态命令

r2xsql 查询示例

r2xsql -s sample.exe -q "SELECT name, module FROM imports WHERE name LIKE '%Crypt%'"
r2xsql -s sample.exe -q "SELECT addr, content FROM strings WHERE content LIKE '%http%'"

r2http / r2mcp 会话

r2 -N -e http.bind=localhost -e http.port=9393 -e http.sandbox=false -q -c=h sample.exe
curl.exe -sS --data-binary 'aaa' http://127.0.0.1:9393/cmd
curl.exe -sS --data-binary 'aflj' http://127.0.0.1:9393/cmd

radius2 符号执行

radius2 -p sample.exe -s stdin 96 -X Incorrect
radius2 -p sample.exe -s flag 256 -A . flag -B Correct -X Wrong -j

r2pm 插件安装

r2pm -ci r2ghidra
r2pm -ci r2dec
r2pm -l