radare2 (often shortened to r2) is a reverse engineering framework that does everything a GUI disassembler does — disassembly, control-flow graphs, debugging, binary patching — but entirely through a terminal and its own command language. The learning curve is steeper than pointing and clicking, but every action becomes a short, scriptable command instead of a menu to hunt through.
Opening a binary and getting your bearings
r2 ./challenge
[0x00001040]> aaa
[0x00001040]> aflaaa runs r2's automatic analysis (functions, strings, cross-references) — almost always the first command you run on a new binary. afl ("analyze function list") then shows every function it found, which is usually faster to scan than clicking through a GUI's function tree.
Disassembling a specific function
[0x00001040]> pdf @ mainpdf ("print disassembly of function") shows a function's full disassembly; @ main temporarily points r2 at main without permanently moving your cursor there. For a visual layout instead of a flat listing, VV opens an interactive graph view of the current function right in the terminal.
Searching strings and finding what calls them
[0x00001040]> iz
[0x00001040]> axt 0x00002100iz lists strings defined in the binary's data sections — a fast way to spot something like a hardcoded flag format or a suspicious prompt. axt ("cross-references to") then shows every instruction that references a given address, which is how you trace from a string back to the function that prints it.
Debugging inside r2
r2 -d ./challenge
[0x7f...]> db main
[0x7f...]> dc-d launches the binary under r2's own debugger instead of just opening it statically. db sets a breakpoint, and dc ("debug continue") runs until it's hit — letting you inspect registers and memory at exactly the point that matters, without leaving the same tool you used to disassemble it.
Why it's worth learning
r2's command language feels unfamiliar at first precisely because it's dense — most actions are two or three letters. That density is also the payoff: once the common commands (aaa, pdf, afl, iz, db/dc) are muscle memory, analyzing a binary over SSH on a remote box or inside a script becomes just as fast as doing it in a full GUI.