Command-line Options

The radare core accepts many flags from the command line.

This is an excerpt from the usage help message:

  1. $ radare2 -h
  2. Usage: r2 [-ACdfLMnNqStuvwzX] [-P patch] [-p prj] [-a arch] [-b bits] [-i file]
  3.           [-s addr] [-B baddr] [-m maddr] [-c cmd] [-e k=v] file|pid|-|--|=
  4.  --           run radare2 without opening any file
  5.  -            same as 'r2 malloc://512'
  6.  =            read file from stdin (use -i and -c to run cmds)
  7.  -=           perform !=! command to run all commands remotely
  8.  -0           print \x00 after init and every command
  9.  -2           close stderr file descriptor (silent warning messages)
  10.  -a [arch]    set asm.arch
  11.  -A           run 'aaa' command to analyze all referenced code
  12.  -b [bits]    set asm.bits
  13.  -B [baddr]   set base address for PIE binaries
  14.  -c 'cmd..'   execute radare command
  15.  -C           file is host:port (alias for -c+=http://%s/cmd/)
  16.  -d           debug the executable 'file' or running process 'pid'
  17.  -D [backend] enable debug mode (e cfg.debug=true)
  18.  -e k=v       evaluate config var
  19.  -f           block size = file size
  20.  -F [binplug] force to use that rbin plugin
  21.  -h, -hh      show help message, -hh for long
  22.  -H ([var])   display variable
  23.  -i [file]    run script file
  24.  -I [file]    run script file before the file is opened
  25.  -k [OS/kern] set asm.os (linux, macos, w32, netbsd, ...)
  26.  -l [lib]     load plugin file
  27.  -L           list supported IO plugins
  1.  -m [addr]    map file at given address (loadaddr)
  2.  -M           do not demangle symbol names
  3.  -n, -nn      do not load RBin info (-nn only load bin structures)
  4.  -N           do not load user settings and scripts
  5.  -q           quiet mode (no prompt) and quit after -i
  6.  -Q           quiet mode (no prompt) and quit faster (quickLeak=true)
  7.  -p [prj]     use project, list if no arg, load if no file
  8.  -P [file]    apply rapatch file and quit
  9.  -r [rarun2]  specify rarun2 profile to load (same as -e dbg.profile=X)
  10.  -R [rr2rule] specify custom rarun2 directive
  11.  -s [addr]    initial seek
  12.  -S           start r2 in sandbox mode
  13.  -t           load rabin2 info in thread
  14.  -u           set bin.filter=false to get raw sym/sec/cls names
  15.  -v, -V       show radare2 version (-V show lib versions)
  16.  -w           open file in write mode
  17.  -x           open without exec-flag (asm.emu will not work), See io.exec
  18.  -X           same as -e bin.usextr=false (useful for dyldcache)
  19.  -z, -zz      do not load strings or load them even in raw

Common usage patterns

Open a file in write mode without parsing the file format headers.

  1. $ r2 -nw file

Quickly get into an r2 shell without opening any file.

  1. $ r2 -

Specify which sub-binary you want to select when opening a fatbin file:

  1. $ r2 -a ppc -b 32 ls.fat

Run a script before showing interactive command-line prompt:

  1. $ r2 -i patch.r2 target.bin

Execute a command and quit without entering the interactive mode:

  1. $ r2 -qc ij hi.bin > imports.json

Set the configuration variable:

  1. $ r2 -e scr.color=0 blah.bin

Debug a program:

  1. $ r2 -d ls

Use an existing project file:

  1. $ r2 -p test