Open and analyze a binary file, returning architecture, platform, entry point, and binary metadata as JSON.

List all functions identified by radare2 analysis with their names, addresses, sizes, and call conventions.

Disassemble instructions at the given address or function, returning assembly with opcodes and metadata.

Decompile a function to pseudo-C representation using the available decompiler backend.

Extract printable strings from the binary with their addresses, sections, and lengths.

Get all cross-references to or from a specific address, identifying callers, callees, and data references.

List all imported functions and symbols with their addresses and library origins.

List all exported functions and symbols with their addresses and types.

List all sections and segments in the binary with addresses, sizes, and permissions.

Read raw bytes from a specific address in the binary, returned as hex string or formatted hexdump.

Rename a function at the given address to a new user-defined name.

Add or update a comment at a specific address in the binary.

Get detailed metadata for a single function including cyclomatic complexity, stack frame, args, locals, and basic block count.

List all local variables, stack variables, and arguments of a function.

Patch bytes at a specific address in the binary using hex bytes or assembly instructions.

Detect cryptographic constants (AES S-boxes, CRC tables, RSA constants, SHA magic numbers) in the binary.

List PE resources (icons, manifests, version info, embedded data) from the binary.

List all relocations in the binary with their addresses, types, and target symbols.

List classes and their methods from C++, Objective-C, Java, or Swift binaries.

Perform comprehensive one-shot binary triage: file info, sections, imports, exports, strings, functions, entry points, and security features in a single call.

Deep single-function analysis: disassembly, decompilation, variables, xrefs, callers, callees, strings, and complexity metrics in one call.

Extract comparisons, conditional branches, string references, and success/fail paths from a function — ideal for crackme and CTF challenge analysis.

Trace execution using ESIL emulation, logging comparisons, branches, memory access, and register changes at each step.

Scan a binary for common vulnerability patterns: dangerous API usage, buffer overflows, format strings, integer overflows, and missing bounds checks.

Automatically attempt to solve a crackme by extracting constraints, identifying success/fail paths, and brute-forcing input character by character using ESIL emulation.

Extract Indicators of Compromise from a binary: IP addresses, URLs, domains, file paths, registry keys, email addresses, crypto wallets, and embedded payloads.

Exploit development assistant: analyze security mitigations, find dangerous functions, collect ROP gadgets, map input sources, and suggest exploitation strategies.

Compare two binary versions: find added, removed, and changed functions, imports, strings, and show instruction-level diffs for modified functions.

Analyze binary file format structures: identify format via magic bytes, parse containers (RIFF/WebP, PNG, ZIP, JPEG, PDF), and show chunk hierarchy with offsets, sizes, and metadata.

Initialize the ESIL virtual machine with stack memory and return a persistent session_id for subsequent ESIL tool calls. The session preserves ESIL state (registers, memory, PC) across calls.

Destroy a persistent ESIL session and release its resources. Use this when you are done with an emulation session.

List all active persistent ESIL sessions with their session IDs, binary paths, and creation times.

Execute one or more instruction steps in the ESIL emulator and return the updated register state. If session_id is provided, uses a persistent session; otherwise creates a fresh session.

Run ESIL emulation until a target address is reached, a breakpoint is hit, or maximum steps are exceeded. If session_id is provided, uses a persistent session; otherwise creates a fresh session.

Read all register values or a specific register from the ESIL virtual machine state. If session_id is provided, uses a persistent session; otherwise creates a fresh session.

Set a register value in the ESIL virtual machine. If session_id is provided, uses a persistent session; otherwise creates a fresh session.

Read memory contents from the ESIL emulated memory space at a given address. If session_id is provided, uses a persistent session; otherwise creates a fresh session.

Write data to the ESIL emulated memory space at a given address. If session_id is provided, uses a persistent session; otherwise creates a fresh session.

Evaluate a raw ESIL expression string and return the result. If session_id is provided, uses a persistent session; otherwise creates a fresh session.

Initialize the Rizin RzIL virtual machine and return a persistent session_id for subsequent RzIL tool calls. RzIL uses typed bitvectors (BAP Core Theory) for superior emulation fidelity compared to ESIL.

Destroy a persistent RzIL session and release its resources. Use this when you are done with a Rizin emulation session.

List all active persistent RzIL emulation sessions with their session IDs, binary paths, and creation times.

Execute one or more instruction steps in the Rizin RzIL emulator and return VM change events and updated register state. Requires a persistent session from rzil_init.

Run RzIL emulation until a target address is reached or maximum steps are exceeded. Uses aezsu for address targets. Requires a persistent session from rzil_init.

Read all register values or a specific register from the Rizin RzIL VM. Returns typed values including individual CPU flags (zf, cf, sf, etc.) as booleans — superior to ESIL which packs flags into a single register.

Set a register value in the Rizin RzIL virtual machine. Requires a persistent session from rzil_init.

Read memory contents from the Rizin RzIL emulated memory space at a given address. Requires a persistent session from rzil_init.

Write data to the Rizin RzIL emulated memory space at a given address. Requires a persistent session from rzil_init.

Step the RzIL emulator and return detailed VM change events showing exactly which variables and memory locations were read or written. Uses aezse which outputs typed events like pc_write(old, new) and var_write(name, old, new). Superior to ESIL tracing because events are typed.

Get the RzIL intermediate language AST for instructions at a given address. Each instruction is lifted to a typed RzIL expression tree with bitvector operations. This is unique to Rizin — r2 ESIL only has flat string expressions.

List type definitions from the binary using Rizin separate typed JSON endpoints (tsj/tej/ttj/tuj). Returns structs, enums, typedefs, and unions with full member details. Superior to r2 which returns all types in a single flat list.

List all symbols from the binary using Rizin. Returns enriched data including is_imported flag, library origin, flagname, and realname — more detail than r2 isj.

List all linked libraries (DLLs/shared objects) from the binary using Rizin ilj. Returns a clean JSON array of library names.

List all entry points of the binary (program entry, TLS callbacks, etc.) using Rizin iej. Returns virtual address, physical address, and entry type.

List all calling conventions available for the binary architecture using Rizin afcl. Useful for understanding function signatures and ABI details.

Analyze raw shellcode bytes by loading them as a memory blob, disassembling, and identifying syscalls and patterns.

Disassemble raw bytes into assembly instructions without loading a full binary.

Search for a hex byte pattern across the binary and return all matching addresses.

Search for a string pattern in the binary and return all matching locations.

Search for ROP gadgets in the binary matching optional instruction constraints.

Get the call graph for a function showing all callers and callees as a structured graph.

Get the control flow graph of a function as a JSON structure with basic blocks and edges.

Execute a radare2 command directly and return the raw output. Only commands starting with these prefixes are allowed: a (analysis: aa, aaa, afl, af, ag, ax), p (print: pd, px, pf, pi), i (info: ij, iS, iE, ii, iz), s (seek), f (flags), / (search: /x, /R), e (eval/config), af (analysis functions), ag (analysis graphs), ax (analysis xrefs), CC (comments), dr (debug registers), om (open file map). Blocked characters: ; | > < ` ! ~ { } ( ) $ #!.

Calculate entropy for the binary or specific sections to detect packed or encrypted regions.

Launch a binary under the radare2 debugger and return a persistent session ID for subsequent debug commands.

Attach the radare2 debugger to a running process by PID and return a persistent session ID.

Detach from the debugged process, leaving it running, and close the debug session.

Set a software breakpoint at the specified address in the debugged process.

Remove a breakpoint at the specified address or remove all breakpoints.

List all active breakpoints in the debug session with their addresses and status.

Continue execution of the debugged process until a breakpoint is hit, an address is reached, or the process exits.

Single-step the debugged process (step into or step over) and return the updated register state.

Read all register values or a specific register from the debugged process.

Set a register value in the debugged process.

List memory maps of the debugged process with addresses, sizes, and permissions.

Get the call stack backtrace of the debugged process.

List all threads in the debugged process with their status.

Get debug session information including PID, status, executable path, and command line.

Read memory from the debugged process at a specific address, returned as hex string or formatted hexdump.

Write memory in the debugged process at a specific address using hex bytes or a string.

Kill the debugged process and close the debug session.

List all active debug sessions with their session IDs, targets, and PIDs.

List type definitions from binary analysis including structs, enums, and typedefs.

Show PE/ELF/Mach-O headers with detailed field information.

Compute cryptographic hashes of the binary or a specific address range.