binary-re:static-analysis

Static binary analysis maps a binary's structure without execution by using radare2 to enumerate functions, extract strings, and resolve cross-references. You can then use commands like `aflj` to list functions and `axtj` to inspect references for rapid triage.

Yes, you can decompile code and generate control-flow graphs by leveraging r2ghidra or Ghidra headless. This allows you to recover data-flow and decompile target routines, producing detailed decompiled views for critical functions using the `pdgj` command.

Yes, r2ghidra integrates directly with radare2 to enable deep binary investigations. It extends radare2's light analysis capabilities by allowing you to decompile functions and recover data-flow logic without leaving the radare2 environment.

To triage a proprietary binary with unclear behavior, start with light static analysis using radare2 to identify key functions and call graphs. This approach helps form hypotheses about potential data flows before committing to dynamic testing.

No, Ghidra headless is an optional dependency for decompilation. You can use r2ghidra independently within radare2 to decompile target functions and generate control-flow graphs, while Ghidra headless remains available for deeper analysis if needed.

Static analysis maps binary structure without executing the code, meaning it cannot observe runtime behavior or dynamically resolved dependencies. It is designed for forming hypotheses and verifying logic through control-flow graphs, but must be followed by dynamic testing for complete behavioral verification.