Skip to content

Instantly share code, notes, and snippets.

What would you like to do?


load without any analysis (file header at offset 0x0): r2 -n /path/to/file

  • analyze all: aa
  • show sections: iS
  • list functions: afl
  • list imports: ii
  • list entrypoints: ie
  • seek to function: s sym.main

project management

  • open project: Po <name>
  • save project: Ps <name>
  • edit project notes: Pn -

inspecting a function

  • show basic block disassembly: pdb
  • show function disassembly: pdf
  • show function arguments: afa
  • show function variables: afv
  • rename function variable: afvn
  • set function variable type: afvt
  • add/analyze function: af


by default, these get displayed in disassembly listings to the right of a line. disable them in V visual mode using ' (single quote).

multiline comments are not rendered handled well. they don't look pretty.

  • add comment (using editor): CC!
    • note: multiline comments are not formatted nicely
  • append comment: CC <text>
  • overwrite comment: CCu <text>
  • show comment: CC.
  • show comment in this function: CCf

visual mode

  • enter visual mode: V
  • select function, variable, xref: v
  • quick command/seek: _ <search string>
  • custom quick command list: ??
  • show cursor: c
  • set function name: d
  • add comment: ;
  • remove comment: ;-

"flag" means give something a type. like function or symbol.

graph mode

graph mode is not visual mode!

  • enter graph modes: VV

  • cycle types of graphs:

    • forward: p
    • backwards: P
  • types of graphs:

    • graph view
    • graph view + opcode bytes
    • esil
    • esil + comments
    • overview
  • seek to function: g<identifier>

  • undo seek: u

  • show comments: '

  • add comment: /

  • add comment (complex): :CC!

  • select bb: ???

  • seek to next bb: tab

  • seek to previous bb: TAB

  • if bb has conditional branch:

    • seek to True target: t
    • seek to False target: f


recommended contents of ~/.radare2rc:

# Show comments at right of disassembly if they fit in screen
e asm.cmt.right=true

# Shows pseudocode in disassembly. Eg mov eax, str.ok = > eax = str.ok
e asm.pseudo = true

# Solarized theme
eco solarized

# Use UTF-8 to show cool arrows that do not look like crap :)
e scr.utf8 = true



This comment has been minimized.

Copy link

@mpvolt mpvolt commented Sep 23, 2018

You dick


This comment has been minimized.

Copy link

@ashr ashr commented Nov 14, 2018

Whats wrong with his dick ?


This comment has been minimized.

Copy link

@pvalois pvalois commented Oct 27, 2019

thx a lot for this doc


This comment has been minimized.

Copy link

@nobodynuf nobodynuf commented Jan 24, 2020

You dick

Best comment.

Also, thanks for the sweet cheatsheet


This comment has been minimized.

Copy link

@shankaraman shankaraman commented Apr 10, 2020

r_config_set: variable 'asm.cmtright' not found

Now configuration for comments has changed to asm.cmt.right=true


This comment has been minimized.

Copy link
Owner Author

@williballenthin williballenthin commented Apr 10, 2020

thanks @shankaraman


This comment has been minimized.

Copy link

@chankruze chankruze commented May 11, 2020

Really appreciate !


This comment has been minimized.

Copy link

@YusufHegazy YusufHegazy commented Jun 10, 2020

Great Cheat Sheet, much love.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
You can’t perform that action at this time.