Radare2 Reference Card

Those are the basic commands you will want to know and use for moving around a binary and getting information about it.

Flags

Flags are like bookmarks, but they carry some extra information like size, tags or associated flagspace. Use the command to list, set, get them.

Flagspaces

Flags are created into a flagspace, by default none is selected, and listing flags will list them all. To display a subset of flags you can use the fs command to restrict it.

Print string

There are different ways to represent a string in memory. The ps command allows us to print it in utf-16, pascal, zero terminated, .. formats.

Visual mode

The visual mode is the standard interactive interface of radare2.

To enter in visual mode use the v or V command, and then you’ll only have to press keys to get the actions happen instead of commands.

This feature has broken and not been resolved at the time of writing these words (Nov.16th 2020). check #Issue 6945: META - Project files and for more details.

To save your analysis for now, write your own script which records the function name, variable name, etc. for example:

vim sample_A.r2
s 0x000403ce0
s fcn.00403130
afn return_delta_to_heapaddr
afvn iter var_04h

The ?$? command will display the variables that can be used in any math operation inside the r2 shell. For example, using the command to evaluate a number or ?v to just the value in one format.