agentsclimarketplace
Sign in

Automating analysis with r2pipe

Skill meltedinhex/analyst-ai-pack/skills/automating-analysis-with-r2pipe

Automates radare2/rizin analysis through r2pipe to script function enumeration, string and import extraction, and cross-reference queries across samples programmatically. Activates for requests to automate radare2 with r2pipe, script rizin analysis, or batch-extract functions and xrefs from binaries.From its SKILL.md

Install
npx -y skills add meltedinhex/analyst-ai-pack --skill automating-analysis-with-r2pipe

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

One thing to look at

  • 19 stars19 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

What its file declares

Copied from the file, not written here

The file declares its own license as Apache-2.0. That is the author’s claim about this one file, and it is not the same thing as the license GitHub reports for the repository, which is listed with the other numbers below.

SKILL.md

2.6 KB, 456 tokens by cl100k_base, as published. Nobody here has run it

Automating Analysis With r2pipe

When to Use

  • You want to script radare2/rizin to extract functions, imports, strings, and cross-references programmatically, across one or many samples.
  • You are building a repeatable triage pipeline on top of r2's analysis commands.

Do not use r2 to debug/run the sample here — this skill drives static analysis commands (aaa, aflj, izj, iij). Run inside an isolated environment.

Prerequisites

  • radare2 (or rizin) installed and the r2pipe Python package (the script degrades gracefully and reports unavailability if absent).

Safety & Handling

  • r2 static analysis does not execute the sample; keep the working directory isolated.

Workflow

Step 1: Confirm r2pipe availability

python scripts/analyst.py check

Reports whether r2pipe and an r2/rizin binary are available.

Step 2: Extract an analysis summary

python scripts/analyst.py summary sample.bin

Opens the binary, runs analysis (aaa), and collects functions (aflj), imports (iij), and strings (izj) as structured JSON.

Step 3: Query cross-references

For a function of interest, gather xrefs to/from to map call relationships.

Step 4: Aggregate

Combine per-sample summaries for comparison and signature development.

Validation

  • The summary returns non-empty functions/imports for a normal binary.
  • JSON commands (*j) are parsed, not screen-scraped text.
  • Missing r2pipe/r2 is reported clearly rather than crashing.

Pitfalls

  • Forgetting to run aaa before querying functions (empty results).
  • Mixing radare2 and rizin command differences in scripted output.
  • Very large binaries making aaa slow — scope analysis as needed.

References

What ships with it: 3 files

3.9 KB alongside SKILL.md, 1 of them executable

references/

scripts/

Keep looking

Skills are one crate of 326,970. Ordering is by how many stacks a row turns up in, so the top of any crate is what has actually been picked rather than what has the most stars.