FreeBSD Manual Pages
R_CORE(3) Library Functions Manual R_CORE(3) NAME r_core -- Radare2 Core Library API SYNOPSIS #include <r_core.h> DESCRIPTION The r_core library provides the central functionality of radare2 and ex- poses it to programs and bindings. It integrates subsystems such as binary parsing, disassembly, analysis, emulation (ESIL), debugging, and interac- tive UI control. Callers use `RCore` to drive radare2 workflows: open a bi- nary, run analyses, query information, and programmatically manipulate the project state. Important points for embedding and scripting: * RCore is the single structure containing the state (io, bin, anal, de- bug, flags, etc.). Treat it as the main entrypoint for the API. * Commands are the primary high-level control mechanism; use `r_core_cmd`/`r_core_cmd_str` to invoke existing r2 semantics from code. * Many APIs return heap-allocated strings (for example `r_core_cmd_str`); the caller is responsible for freeing them. * Analysis functions (`r_core_anal_fcn`, `r_core_anal_op`) populate in- ternal structures that power higher-level operations (`pdf`, `af`, crossrefs). Run analysis before relying on function graphs. * Seeking (`r_core_seek`) changes the current offset for subsequent com- mands; prefer absolute seeks for deterministic behavior in scripts. INITIALIZATION RCore * r_core_new(void) Allocate and initialize a fresh `RCore` instance with its subsystems (io, bin, anal, dbg, flags, etc.). The returned pointer is owned by the caller and must be freed with `r_core_free`. void r_core_free(RCore *core) Free an `RCore` instance and all associated resources. After calling this, the core pointer must not be used. bool r_core_init(RCore *core) Perform additional initialization on an existing `RCore` object. Most users call `r_core_new ()` which performs internal initialization already, but this is useful when embedding or recreating a core structure. COMMAND EXECUTION int r_core_cmd(RCore *core, const char *cmd, bool log) Execute a textual radare2 command. This is the primary way to drive func- tionality from host programs: opening files (`o`), running analysis (`aaa`), printing (`pd`, `px`), and manipulating flags. `log` controls whether the executed command is recorded in the core's history/log. char * r_core_cmd_str(RCore *core, const char *cmd) Execute a command and return its output as a newly allocated string. The caller is responsible for freeing the returned pointer (e.g., with `free ()`). This function is heavily used by language bindings and scripts that need to capture command output. int r_core_cmdf(RCore *core, const char *fmt, ...) Format and execute a command (convenience wrapper). Useful to build com- mands with addresses or sizes without manual string handling. int r_core_cmd0(RCore *core, const char *cmd) Execute a command without recording it in the log or history. Use for in- ternal operations or when performance matters. SEEKING bool r_core_seek(RCore *core, ut64 addr, bool rb) Set the core's current offset to `addr`. Seeking affects subsequent com- mands that use the current address (for example `pd` or `px`). `rb` indi- cates whether the core should attempt to read bytes at the destination to validate the seek. bool r_core_seek_delta(RCore *core, st64 addr) Move the current offset by a signed delta relative to the current position. Useful for short relative moves in scripts. void r_core_seek_previ- ous(RCore *core, const char *type) Seek to the previous item of a given `type` (for example a previous func- tion or basic block). Useful to implement backwards navigation in tools that iterate over analysis results. ANALYSIS RAnalOp * r_core_anal_op(RCore *core, ut64 addr, int mask) Analyze a single instruction at `addr` and return an `RAnalOp *` describing it. The returned `RAnalOp *` is owned by the caller and must be freed with `r_anal_op_free ()`. This API is ideal when you need structured, per-in- struction information without running whole-function analysis. bool r_core_anal_fcn(RCore *core, ut64 at, ut64 from, int reftype, int depth) Perform function-level analysis starting at address `at`. This populates internal function graphs, basic blocks and cross-references and is typi- cally followed by printing functions (`pdf`) or running decompiler stages. void r_core_anal_esil(RCore *core, const char *str, const char *addr) Evaluate an ESIL expression or code snippet. ESIL is radare2's emulation language; this function helps run small fragments or boot the ESIL VM for scripted emulation. int r_core_esil_step(RCore *core, ut64 until_addr, const char *until_expr, ut64 *prev_addr, bool stepOver) Step the ESIL VM until an address or condition is met. Useful to implement single-stepping or conditional traces programmatically. DISASSEMBLY int r_core_print_disasm(RCore *core, ut64 addr, ut8 *buf, int len, int count, enum r_pdu_condition_t pdu_condition_type, const void *pdu_condi- tion, bool count_bytes, bool json, PJ *pj, RAnalFunction *pdf) Format and print disassembly for a buffer or address range. High-level com- mands (`pd`, `pdf`) are implemented using this API; call it when you need controlled, fast formatting and optionally JSON output via `PJ`. char * r_core_disassemble_instr(RCore *core, ut64 addr, int l) Return a heap-allocated string containing the disassembly of a single in- struction at `addr`. Caller must free it. char * r_core_disassem- ble_bytes(RCore *core, ut64 addr, int b) Disassemble `b` bytes starting at `addr` and return the output as a newly allocated string. BINARY OPERATIONS bool r_core_bin_load(RCore *core, const char *file, ut64 baseaddr) Load a binary into the core for analysis. `file` accepts normal file paths and special providers used in tests (for example `malloc://SIZE` to create an in-memory file). After loading, analysis and printing commands operate on the loaded binary. bool r_core_bin_info(RCore *core, int action, PJ *pj, int mode, int va, RCoreBinFilter *filter, const char *chksum) Retrieve structured information about the currently loaded binary (sec- tions, symbols, checksums). Use the `PJ` parameter for JSON formatted out- put. bool r_core_bin_set_cur(RCore *core, RBinFile *binfile) Set the `RBinFile` used as current. Useful when the caller manages multiple binaries or wants to switch the active `RBinFile` without reloading from disk. VISUAL MODE void r_core_visual(RCore *core, const char *input) Enter the interactive visual mode driven by `RCore`. Frontends can call this to open the TUI and optionally feed initial key events or commands via `input`. int r_core_visual_refs(RCore *core, bool xref, bool fcnInsteadO- fAddr) Show cross-references inside the visual UI. Parameters control whether to show XREFs and whether to present functions instead of raw addresses. bool r_core_visual_hud(RCore *core) Display or toggle the heads-up display (HUD) that shows contextual informa- tion in visual mode. PROJECT MANAGEMENT bool r_core_project_open(RCore *core, const char *file) Open and restore a previously saved `.r2` project. Projects replay seeks, flags and other persistent state so you can continue work without re-run- ning expensive analyses. bool r_core_project_save(RCore *core, const char *file) Save the current session to `file`. After a successful save you can restore it later with `r_core_project_open`. int r_core_project_list(RCore *core, int mode) List available projects. This is handy for UIs exposing multiple saved ses- sions. UNDO SYSTEM void r_core_undo_push(RCore *core, RCoreUndo *cu) Push an undo record representing a reversible change. Frontends and scripts can use this to implement undo/redo flows for user actions. void r_core_undo_pop(RCore *core) Revert the last undo entry recorded in the core. Restores previous state (flags, bytes, metadata) as captured in the undo record. void r_core_undo_print(RCore *core, int mode, RCoreUndoCondition *cond) Print or query the undo history for display or automated rollback. SEARCH int r_core_search_cb(RCore *core, ut64 from, ut64 to, RCoreSearchCallback cb) Run a custom search between `from` and `to`, invoking the callback for each hit. This low-level API gives full control over match handling and early termination. int r_core_search_preludes(RCore *core, bool log) Scan for common function preludes and heuristics to bootstrap function dis- covery in stripped binaries. Often used before calling `r_core_anal_fcn` or printing results. EXAMPLES The examples below illustrate common real-world patterns found in the tree: capturing command output, using in-memory files in tests/fuzzers and com- bining seeking with single-instruction analysis. /* Example 1: open, analyze and capture disassembly */ RCore *core = r_core_new(); r_core_cmd(core, "o /bin/ls", false); /* open file */ r_core_cmd(core, "aaa", false); /* run full analysis */ char *out = r_core_cmd_str(core, "pd 10"); /* capture output */ printf("%s0, out); free(out); /* must free returned string */ r_core_free(core); /* Example 2: in-memory file used by fuzz tests (test/fuzz/fuzz_ia.c) */ RCore *r = r_core_new(); /* create an anonymous in-memory file of Size bytes */ r_core_cmdf (r, "o malloc://%zu", (size_t)4096); /* write data into r->io using r_io_write_at (test code) */ r_core_cmd0 (r, "oba 0"); /* avoid history */ r_core_cmd0 (r, "ia"); /* run instruction analysis */ r_core_free (r); /* Example 3: seek + single-instruction analysis */ RCore *c2 = r_core_new(); /* load binary first via r_core_cmd or r_core_bin_load */ r_core_seek(c2, 0x1000, true); RAnalOp *op = r_core_anal_op(c2, 0x1000, R_ANAL_OP_MASK_BASIC); if (op) { printf("Mnemonic: %s0, op->mnemonic); r_anal_op_free(op); } r_core_free(c2); SEE ALSO r_anal(3), r_bin(3), r_cons(3), r_flag(3), r_io(3) AUTHORS The radare2 project team. FreeBSD ports 15.quarterly September 20, 2025 R_CORE(3)
NAME | SYNOPSIS | DESCRIPTION | INITIALIZATION | COMMAND EXECUTION | SEEKING | ANALYSIS | DISASSEMBLY | BINARY OPERATIONS | VISUAL MODE | PROJECT MANAGEMENT | UNDO SYSTEM | SEARCH | EXAMPLES | SEE ALSO | AUTHORS
Want to link to this manual page? Use this URL:
<https://man.freebsd.org/cgi/man.cgi?query=r_core&sektion=3&manpath=FreeBSD+Ports+15.1.quarterly>