radare2 CLI analysis

When it applies

You need fast, scriptable analysis of an in-scope binary (scope.txt / client-owned / your own sample — tradecraft-scope-roe) from a terminal: first-pass recon before opening a heavyweight decompiler, CI/SSH environments with no GUI, quick patches and diffs, or r2 automation. When you need pseudocode-grade reading, hand off to reverse-eng-ida or reverse-eng-ghidra — r2's job is speed and scriptability, not decompilation. For obfuscated JavaScript, that's reverse-eng-deobfuscation, not this skill.

Why it works

Every r2 operation is a composable command — the same one-liners work interactively, in batch (-c "..."), over HTTP, or via r2pipe from any language — so recon that costs minutes in a GUI costs seconds here, and every step is reproducible by construction.