Radare2 Quick Reference
=======================

STARTING
  r2 binary                      Open binary
  r2 -d binary                   Debug mode
  r2 -A binary                   Auto-analyze on open
  r2 -w binary                   Write mode

ANALYSIS
  aaa                            Full analysis
  afl                            List functions
  afl~main                       Find main function
  afn name addr                  Rename function
  axt addr                       Cross-references to
  axf addr                       Cross-references from

NAVIGATION
  s main                         Seek to function
  s 0x401000                     Seek to address
  s+10 / s-10                    Seek forward/back

DISASSEMBLY
  pd 20                          Disassemble 20 instructions
  pdf                            Disassemble current function
  pdf @ main                     Disassemble main
  pD 100                         Disassemble 100 bytes

PRINT DATA
  px 64                          Hex dump 64 bytes
  ps @ addr                      Print string
  pf d @ addr                    Print as integer
  p8 16                          Print 16 hex bytes

VISUAL MODE
  V                              Enter visual mode
  VV                             Graph mode
  p/P                            Cycle views in visual
  q                              Quit visual

SEARCHING
  / string                       Search for string
  /x 90909090                    Search hex pattern
  /R pop rdi                     Search ROP gadget
  iz                             List strings in data
  izz                            List all strings

INFORMATION
  i                              File info
  ie                             Entry point
  iS                             Sections
  ii                             Imports
  iE                             Exports
  is                             Symbols
  il                             Libraries

FLAGS / COMMENTS
  f name @ addr                  Set flag (bookmark)
  CC comment @ addr              Add comment
  CCu                            Remove comment

WRITE MODE (r2 -w)
  wx 9090 @ addr                 Write hex bytes
  wa "nop" @ addr                Write assembly

DEBUG
  db addr                        Breakpoint
  dc                             Continue
  ds                             Step
  dr                             Show registers
  dr rax=0                       Set register

COMMON CTF PATTERNS
  # Quick analysis
  r2 -A binary
  afl              # list functions
  s main           # go to main
  pdf              # disassemble

  # Find strings
  iz~flag
  iz~password

  # Decompile (with r2ghidra)
  pdg @ main       # Ghidra decompiler output
