radareorg/radare2-skills/re-source

When to use

Pick this skill when the user wants to incrementally rebuild meaning in a binary: turn sub_401000 into aes_init, write what each function does, and persist that across sessions so the next pass starts from a richer baseline.

For one-off analysis or open-ended triage, use the analysis skill. For the mechanics of writing comments/flags, use annotations.

Required: write + project

Persistence is required. Always:

radare2 -w -A <binary>        # then `sql <SQL>` / `sqlj <SQL>` at the prompt

so every comment/flag you add gets saved to the project on exit.

The re-source loop

1. Anchor — pick an unambiguous data leaf:

• a unique string ('license check failed')
• a unique import (CryptDecrypt if it appears once)
• a known constant (PE magic, RC4 sbox, …)

1. Walk back — xrefs to find the first caller, then the

caller's caller, … up to a function that's identifiable from its own surface (a public DLL export, an exception handler, a top-level dispatcher).

1. Name and comment — every named anchor becomes a

UPDATE flags SET name = … and UPDATE comments SET text = ….

1. Repeat with the next un-named anchor.

Walked example

-- (1) the anchor: a unique error string
SELECT addr FROM strings WHERE content = 'license check failed';
-- → addr = 0x412ab0
 
-- (2) one hop back: who references the string? from_func is the owning
--     function's ADDRESS, which is exactly what step (3) renames.
SELECT from_addr, from_func FROM xrefs WHERE to_addr = 0x412ab0;
-- → from_func = 0x401a10 (sub_401a10), from_addr = 0x401b34
 
-- (3) annotate that function
UPDATE flags    SET name = 'license_fail_log'           WHERE addr = 0x401a10;
UPDATE comments SET text = 'logs license-check failure' WHERE addr = 0x401a10;
INSERT INTO comments(addr, text) VALUES (0x401b34, 'msg = license check failed');
 
-- (4) two hops back: who calls license_fail_log?
SELECT cf.name FROM xrefs x
JOIN funcs f  ON f.addr  = x.to_addr
JOIN funcs cf ON cf.addr = x.from_func
WHERE f.name = 'license_fail_log' AND x.type = 'CALL';
-- → license_check_v2
 
-- (5) annotate, repeat
UPDATE comments SET text = 'top-level license check; calls license_fail_log on failure'
WHERE addr = (SELECT addr FROM funcs WHERE name = 'license_check_v2');

Multi-pass workflow

Each pass over the binary makes the next pass cheaper:

• Pass 1: name 20-50 leaf functions from strings/imports.
• Pass 2: use the named functions as your new anchors — every

xrefs walk lands on a meaningful name instead of sub_*.

• Pass 3: start naming dispatchers and state machines based on

what their callees do.

Persist explicitly with Ps NAME before exiting; the plugin does not save automatically. Reopen with -p NAME to skip re-analysis and keep building.

Type reconstruction

types and types_members surface r2's type database — useful when the binary uses well-known struct shapes (Windows headers, Linux kernel structs). Apply types to memory with tl <TYPENAME> @ <addr> through the r2js skill (a raw r2 command, not a SQL write).

Caveats

• Renames stick only if you opened with -w; otherwise they vanish

on exit and the next pass starts from sub_* again.

• The xrefs table only sees what the analysis found. Run aaaa (with

-AA) for deeper static analysis before serious re-sourcing.

• Anchors degrade — a string like 'error' is too common to follow.

Pick unique anchors first; the rare ones give straight chains.