Radare2 / Cutter
toolsintermediate
Use radare2 and Cutter for CTF reverse engineering - disassembly, analysis, patching, and scripting.
toolsradare2cutterreversingdisassemblyrebinary-analysis
Radare2 / Cutter
Radare2 (r2) is a powerful open-source RE framework. Cutter is its GUI frontend. Together they offer an alternative to Ghidra - often faster for quick analysis and excellent for scripting and binary patching.
r2 vs Ghidra
Installation
# Radare2
sudo apt install radare2
# Or latest from source:
git clone https://github.com/radareorg/radare2
cd radare2 && sys/install.sh
# Cutter (GUI)
# Download from: https://cutter.re/
# Or: sudo apt install cutterOpening a Binary
r2 ./binary # Standard read-only
r2 -A ./binary # Auto-analyze on open (equivalent to running aaa)Essential Commands
r2pipe Scripting
import r2pipe
r2 = r2pipe.open('./binary')
r2.cmd('aaa') # analyze
funcs = r2.cmdj('aflj') # list functions as JSON
print([f['name'] for f in funcs])
strings = r2.cmdj('izzj') # all strings as JSON
for s in strings:
if 'flag' in s.get('string', '').lower():
print(s)
r2.quit()Cutter (GUI)
cutter ./binaryKey panels: Disassembly, Graph (CFG), Decompiler (via r2ghidra plugin), Strings, Functions, Imports.
# Install Ghidra decompiler plugin for Cutter:
r2pm -ci r2ghidraChecklist
-
r2 -A ./binary- auto-analyze on open -
afl- list all functions -
s main+pdf- navigate and disassemble -
izz- search all strings -
VV- visual CFG mode -
/flag- search for flag string -
r2 -wfor patching →wx 90,wa nop
Last updated on