菜单
Use this skill when binary reverse engineering needs radare2 for binary analysis, expression or string search, binary diffing, debugging, ESIL emulation, or hex utilities.
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
Use this skill when MaxTAC Source should use the plugin-bundled codebase-memory-mcp MCP integration or CLI fallback for repository indexing, architecture overview, structural search, call-path tracing, diff impact mapping, ADR lookup, or code graph evidence before SAST triage, CFG work, OpenGrep authoring, or source scans.
Use this skill when MaxTAC Android needs a loop that models an Android app's user-facing resources and systematically walks activities, deep links, forms, WebViews, share targets, notifications, and other user-facing inputs for security auditing while respecting scope and safety constraints.
Use this skill when Apple Systems research needs a loop over IPSW or OTA firmware diffs, Apple security advisories, CVEs, build provenance, and binary/source patch archaeology to identify patched Apple components, infer why they changed, and enrich an ASB threat model.
Use this skill when MaxTAC Binary needs a loop to model how a binary was compiled and loaded, preserve reverse-engineering provenance, prioritize executable functions by reachability or call frequency, systematically decompile or parse functions and data structures, and produce durable functionality and security evidence.
Use this skill when MaxTAC research needs a durable security model, invariant dictionary, invariant receipts with proof obligations and refutation conditions, architecture understanding, first-order-logic-style assertions, unknown tracking, contradiction tracking, or model-backed auditor handoffs across source, web, cloud, binary, supply-chain, Android, Apple, or Microsoft targets.
Use this skill when MaxTAC research needs goal-bounded auditor subagents, verifier debate subagents, specialist bug-class review, mitigation review, or independent votes on a vulnerability hypothesis or PoV.
| name | maxtac-re-radare2 |
| description | Use this skill when binary reverse engineering needs radare2 for binary analysis, expression or string search, binary diffing, debugging, ESIL emulation, or hex utilities. |
Use radare2 when binary triage, search, diffing, ESIL, quick disassembly, or terminal-first automation is more useful than a persistent GUI project.
Check the installed tool surface:
r2 -v
rabin2 -v
rahash2 -v
If radare2 is not installed or a source build is needed, ask first, then read <skill-dir>/references/radare2-install-build.md.
Use the generic RE readiness helper from the Ghidra skill to record tool versions and target hashes before report-grade RE work:
python3 <plugin-root>/skills/maxtac-re-ghidra/scripts/re-readiness.py --tool radare2 --target ./target.bin --output re-readiness.md
Use python3 <skill-dir>/scripts/r2-triage.py to collect repeatable binary triage evidence with rabin2, rahash2, and optional read-only r2 analysis:
python3 <skill-dir>/scripts/r2-triage.py ./target.bin --output-dir ./r2-evidence
Use --skip-r2 when only metadata/hashes are needed, and --deep only when deeper r2 analysis is worth the runtime.
Store r2 scripts, command transcripts, JSON, disassembly dumps, graph exports, and hashes as artifacts. When RE establishes reusable subsystem behavior, rewrite the conclusion into the stable research-library markdown and link to the artifact directory. Avoid creating research/<component>/r2/ as a research submodule unless radare2 itself is the target.
Includes rabin2 -I/-j/-i/-E/-s/-l/-S/-z/-P/-PP for metadata, hardening flags, imports, symbols, libraries, sections, strings, DWARF/PDB. rabin2 -I is especially useful because it exposes NX, RELRO, canary, PIE/PIC, RPATH, stripped/static state, arch, bits, endian, and format data.
See: <skill-dir>/references/radare2-binary-triage.md
Includes rafind2 plus in-session / searching for strings, wide strings, regex, byte patterns, aligned/ranged hits, magic/file carving, JSON output, and r2-command output. Add vulnerability-specific sections for suspicious strings, format strings, command paths, deserialization markers, crypto material, and gadget discovery.
See: <skill-dir>/references/radare2-search.md
Includes aa/aaa/aab/aaaa, r2 -A/-AA, af*, afl/aflj, afi, afv, aft, ax*, CFG/call graph workflows, and "do not overtrust auto-analysis" guidance. Use different analysis depths and fine-grained anal.* / emu.* configuration.
See: <skill-dir>/references/radare2-analysis-workflow.md
Includes ESIL for partial emulation, indirect branch resolution, branch likelihood, computed pointer references, syscall/import simulation, and function-slice execution. This is high-value for exploitability reasoning when source is absent.
See: <skill-dir>/references/radare2-esil-emulation.md
Includes local debugging commands (r2 -d, db, dc, dr, drr, ds, dso, dbt, dm, ood), plus memory maps, heap, remote GDB/WinDbg as advanced sections.
See: <skill-dir>/references/radare2-debugging.md
Includes radiff2 for patched-vs-vulnerable comparison: raw diff, delta diff, code graph diff, imports/strings diff, architecture/bits settings, JSON output, and r2 patch-script output.
See: <skill-dir>/references/radare2-diffing.md
Includes rax2, rasm2, rahash2, maybe ragg2. Prioritize rax2 for conversions/endian/base64/raw-hex tasks and rasm2 for multi-arch assemble/disassemble and ESIL expression output.
See: <skill-dir>/references/radare2-utilities.md
Includes r2pipe, JSON-first command usage, repeatable command scripts, project/annotation notes. r2pipe supports spawn pipes, HTTP, TCP, and JSON-friendly workflows, which fits MaxTAC evidence collection well.
See: <skill-dir>/references/radare2-automation.md