Radare2

Radare2 grew out of a very practical problem. In 2006 Sergi Àlvarez, better known as pancake, was working as a forensic analyst and needed to recover deleted files from an HFS partition. The hex editor he wrote for the job, called radare, was redesigned from 2009 onwards and became radare2, a modular command-line toolkit for reverse engineering. The code is published on GitHub by the radareorg organisation under the LGPL v3.

According to the history page on radare.org, the project became community-driven around 2014, and its contributors have met every year since 2016 in Barcelona for the r2con conference. The site promises a release about every six weeks, and version 6.2.4 came out on 5 October 2026.

What Radare2 is for

Radare2 combines a set of libraries with a family of programs that cover nearly every low-level analysis task. You can open an executable, a firmware image, a disk image or the memory of a running process, then disassemble it, search for patterns or signatures, patch bytes and step through execution with the built-in debugger, which can also talk to GDB or WinDbg. An emulation engine based on ESIL, the project’s own intermediate language, simulates chunks of code without actually running them.

The design follows the Unix tradition. Every action is a short command that can be chained, redirected or scripted, and standalone utilities such as rabin2, which reports information about a binary, and rasm2, which assembles and disassembles instructions, slot neatly into shell scripts. A full-screen visual mode in the terminal shows panels and control flow graphs drawn in ASCII characters, and an embedded web server provides a browser interface. Automation goes through r2pipe, which drives radare2 from Python, JavaScript and many other languages.

The r2pm package manager installs plugins that extend the core. r2ghidra brings in Ghidra’s decompiler, r2dec offers a decompiler written in JavaScript, and r2frida connects to Frida’s dynamic instrumentation. The project also maintains iaito, a Qt graphical interface that should not be confused with Cutter, which is built on Rizin, a radare2 fork started in 2020. Next to Ghidra or IDA Pro, radare2 is much lighter, starts instantly, runs on a wide variety of systems and fits easily into automated pipelines, at the cost of less visual comfort.

Who is it for?

Radare2 is aimed at malware analysts, vulnerability researchers, capture the flag regulars and embedded specialists who deal with unusual architectures. Its small footprint also makes it handy on a headless server or a remote machine, where a Java desktop application would be cumbersome.

It has a reputation for a steep learning curve. Commands are often just two or three letters long and only stick with practice and time spent in the online book at book.rada.re. The fast release pace also brings frequent changes, and some plugins carry their own licences. Anyone who wants a polished graphical interface with a decompiler ready out of the box will be more comfortable with Cutter or Ghidra, and analysing a machine’s live memory calls for a dedicated tool such as Volatility.

Download Radare2 safely

Official binaries are published in the releases section of the radareorg/radare2 repository. For 6.2.4 you will find zip archives for 32-bit, 64-bit and ARM64 Windows, pkg installers for Intel and Apple Silicon Macs, deb packages for Debian and Ubuntu, command-line archives for Android, a WebAssembly build and the source code, together with a checksums.txt file. On Linux and macOS the project actually recommends cloning the Git repository and running the sys/install.sh script, which installs the very latest code.

Radare2 is completely free, with no commercial edition. Since it is used precisely to inspect suspicious files and its debugger can attach to other processes, avoid builds redistributed by third-party sites and compare your download against the published checksums. Plugins are installed with r2pm, which fetches their code from their authors’ own repositories.

Frequently asked questions