radius2

Solve binary inputs symbolically with radare2 break and avoid points.

20|1|Updated Mar 20, 2026
One-click install
npx skills add https://github.com/radareorg/radare2-skills --skill radius2
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: radius2
Source: https://github.com/radareorg/radare2-skills/tree/main/radius2/radius2
Command: npx skills add https://github.com/radareorg/radare2-skills --skill radius2

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Finding the exact input that drives a binary to a specific “good” behavior (and avoids “bad” behavior) is slow when you only have to try possibilities manually.

Core Features & Use Cases

  • Symbolic input solving: Create symbolic variables (including stdin and argv) and let the solver derive values that satisfy program conditions.
  • Path guidance with break/avoid targets: Reach desired code by breaking on strings/addresses and avoid undesired strings/addresses to prune execution paths.
  • Constraints and state management: Apply byte-level constraints, set registers/memory, merge states for loop-heavy binaries, and generate test cases.
  • Use Case: Turn a crackme or CTF checker into a direct solving workflow where you constrain the expected flag format (prefix, printable range) and compute the exact input that reaches the success condition.

Quick Start

Ask the AI to solve your crackme by running radius2 on the target binary, defining the symbolic stdin variable, and using an avoid string to eliminate the failure path (e.g., Incorrect).

Frequently Asked Questions about radius2

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I symbolically solve a binary input to reach a specific code path?

To symbolically solve binary inputs, you define symbolic variables for stdin or argv, set break targets for desired paths, and let the solver compute exact values that satisfy program conditions. You avoid failure paths by specifying strings or addresses to prune.

How does symbolic execution help solve CTF flag checkers and crackmes?

Symbolic execution helps solve CTF flag checkers by treating input as symbolic variables and applying path constraints. You constrain expected flag formats like prefixes or printable ranges, and the solver derives the exact input reaching the success condition while avoiding failure paths.

Can I apply byte-level constraints and set registers when solving crackmes with radare2?

Yes, you can apply byte-level constraints, set registers and memory, and merge states for loop-heavy binaries. This allows you to guide execution with string or address break points and generate test cases for solved symbol values.

What is the best way to prune undesired execution paths during reverse engineering?

The best way to prune undesired execution paths is to use avoid targets. By specifying strings or addresses associated with failure behavior, you guide the symbolic solver to skip those paths and focus only on reaching desired code.

Does radius2 require a radare2-backed execution workflow for binary analysis?

Yes, radius2 requires a radare2-backed execution workflow to perform symbolic execution and binary analysis. It accepts symbolic variables, optional constraints, and produces solved symbol values, optionally in JSON format, for reaching desired code paths.