Skip to main content
Glama

r2_analyze_target

Analyze binary files with Radare2 recursive strategies to find symbols, calls, data refs, and pointers. Choose a suitable strategy for disassembly, debugging, or vulnerability research.

Instructions

[Binary/reverse-engineering tool. Use when: disassembly, radare2, r2, debugging, vulnerability research, ELF/PE/SO/DEX analysis.] 【r2ai逆向工具】🎯 [智能分析] 执行特定的 Radare2 递归分析策略。请根据分析需求选择最轻量级的策略,避免盲目使用全量分析。 策略说明:

  • 'basic' (aa): 基础分析,识别符号和入口点。

  • 'blocks' (aab): 仅分析当前函数或地址的基本块结构(修复函数截断问题)。

  • 'calls' (aac): 递归分析函数调用目 标(发现未识别的子函数)。

  • 'refs' (aar): 分析数据引用(识别字符串引用、全局变量)。

  • 'pointers' (aad): 分析数据段指针(用于 C++ 虚表、跳转表恢复)。

  • 'full' (aaa): 全量深度分析(耗时极长,仅在小文件或必要时使用)。 【触发场景】当用户询问二进制逆向分析、反汇编、漏洞挖掘、radare2命令执行、调试相关问题时,必须优先调用此工具。 【使用规则】调用前必须确认用户提供了目标文件的绝对路径,禁止捏造不存在的文件路径或命令结果,session_id 不再使用时必须关闭。

Input Schema

TableJSON Schema
NameRequiredDescriptionDefault
addressNo可选:指定分析的起始地址或符号(例如 '0x00401000' 或 'sym.main')。如果 不填,默认分析全局或当前位置。
strategyYes分析策略模式
session_idYes会话 ID

Schema Changelog

Changes observed during successful MCP inspections.

  1. First observedv0.0.3

TDQS

A3.8/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the behavioral disclosure burden. It does add useful constraints: 'full' analysis is extremely slow, absolute file paths must be confirmed, fabricated paths/results are forbidden, and session_id must be closed when unused. But it does not disclose what the tool returns, whether it mutates the r2 session state, or what side effects running a strategy has, leaving important operational behavior under-specified.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness3/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The strategy list is well-structured and front-loaded with the use case. However, the English '[Use when...]' block and the later Chinese trigger-scenario block largely duplicate each other, and the emoji/bracket wrapper adds noise. The content earns its place, but the redundancy and mixed formatting make it less tight than it could be.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The description is strong on strategy selection, performance cautions, and usage rules. But with no output schema and no annotations, it omits the return/output contract entirely: an agent is not told what the tool produces after running a strategy, how results are presented, or how the target file is associated with session_id. This is a significant gap for a tool with this much operational nuance.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, but the description adds substantial meaning beyond the schema. Each strategy enum value is mapped to its radare2 command and purpose, the address parameter's optional/default behavior is clarified, and session_id lifecycle guidance is provided. This goes well beyond the schema's bare parameter labels.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific action: execute a selected Radare2 recursive analysis strategy (aa/aab/aac/aar/aad/aaa), which is more specific than the tool name alone. It clearly positions the tool in the binary/reverse-engineering domain, but it does not explicitly distinguish itself from siblings like r2_analyze_file or r2_disassemble, so it falls short of a 5.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It provides an explicit 'Use when' list and a trigger-scenario rule saying this tool must be prioritized for reverse-engineering, disassembly, and debugging requests. It also advises choosing the lightest strategy and reserving 'full' for small files. However, it does not state when to prefer siblings such as r2_disassemble or r2_run_command, so exclusion guidance is missing.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.