radareorg/r2ai

What it solves

It simplifies the process of reverse engineering by integrating Large Language Models (LLMs) directly into the radare2 framework. This allows analysts to use AI to explain complex functions, identify vulnerabilities, and suggest better variable or function names for disassembled code.

How it works

It operates as a plugin for radare2, providing a native AI interface (r2ai) and a specialized decompilation plugin (decai). It can connect to both local models (via Ollama) and remote APIs (such as OpenAI, Anthropic, and Grok). The tool supports a ReAct (Reasoning and Acting) mode for autonomous task solving via function calling and includes a native vector database for RAG (Retrieval-Augmented Generation) using markdown, code, or text files.

Who it’s for

Security researchers, malware analysts, and reverse engineers who use radare2 and want to leverage LLMs to accelerate the understanding of binary code.

Highlights

• Augmented Decompilation: Uses LLMs to make decompiled code more readable and understandable.
• Customizable Prompts: Allows users to define specific roles and prompts for tasks like finding vulnerabilities or explaining devices.
• Integrated RAG: Features a native vector database to resolve questions based on external documentation or code files.
• Flexible Model Support: Compatible with a wide range of local and remote LLM providers.
• Scriptable Interface: Can be controlled via r2pipe for automated workflows.