I understand that I can execute my script within a session using [0x401000]> . server.py and the pipe will be connected to it when I call r2pipe.open() with no arguments.

Ideally I would like to spawn a simple tcp server in python which waits for specific commands from a client. The client is invoked from a live r2 session like [0x401000]> . client.py --command doAnalysis. The command is passed to the server which opens a pipe to my r2 session, performs the analysis, then maybe updates my session (really to just be able to run commands from the server which was not opened from my r2 session). The reason I require the server to always be running is because it will be collecting data and I don't want to be re-collecting that data every time I need to do some analysis. I can't invoke the server from my r2 session because the session will be blocked by the server.

It would be great if the server could open an r2pipe directly to my r2 session but I don't know how to do that or if is even possible. I tried using pickle to send the r2 instance over a socket but it couldn't pickle it. Any thoughts?

1 Answer 1


I'm not sure I fully understood you, but I'll give it a try anyway.

The following instructions will explain how to achieve something like this:|

enter image description here

radare2 comes with its own webserver. Although at first, it might seems like an overkill, its actually quite useful, especially when you want to debug embedded systems, or simply to execute commands from a remote terminal.

Simply launch the web server with =h <port> and connect to it with any HTTP client.

You can print the help for this command by using =h?:

[0x00000000]> =h?
|Usage:  =[hH] [...] # http server
| http server:
| =h port       listen for http connections (r2 -qc=H /bin/ls)
| =h-           stop background webserver
| =h--          stop foreground webserver
| =h*           restart current webserver
| =h& port      start http server in background
| =H port       launch browser and listen for http
| =H& port      launch browser and listen for http in background

So let's use a oneliner command to spawn a radare2 web server with a session to our beloved /bin/ls/:

$ r2 -c=h /bin/ls
Starting http server...
open http://localhost:9090/
r2 -C http://localhost:9090/cmd/

Good, now that we have an HTTP server running with an open session, let's connect to it.

You can do this with curl:

$ curl,World!
 .--.     .--------------.
 | _|     |              |
 | O O   <  Hello,World! |
 |  |  |  |              |
 || | /   `--------------'

You can even do this from your favorite browser:

enter image description here

Although it's cool, it isn't helping you -- you asked for a solution using r2pipe. Well... there is!

What is r2pipe?

The r2pipe APIs are based on a single r2 primitive found behind r_core_cmd_str() which is a function that accepts a string parameter describing the r2 command to run and returns a string with the result.

Source: r2pipe repository

As you probably know, using python, you can just do import r2pipe and r2pipe.open("/bin/ls") to open a radare2 session with "/bin/ls". Did you know that you can connect with r2pipe to a remote web server? Yup.

Let's write a quick script to do so:

import r2pipe

print("[+] Connecting with python r2pipe")

r2_remote = r2pipe.open("")
command = "?E Welcome from server!"

while command != "stop":
    print (r2_remote.cmd(command))
    command = raw_input("r2cmd > ")

Save the script to poc.py on you drive.

Now let's run r2 -c=h /bin/ls in one terminal and python poc.py in another one:

enter image description here

Yes, radare2 can also print QR codes.

  • Sorry I have trouble explaining myself sometimes. Is there a way to use Visual Mode using this method? or is it possible to throw the webserver in the background and use r2 normally in a single terminal? Then if I want to invoke a task in my script from the r2 in that terminal, the script can connect to the webserver instead and do its thing. That would be perfect. Your answer is exactly what I'm looking for btw thanks a bunch!!
    – Nux
    May 23, 2018 at 22:08
  • 2
    Hold up! I got it. I open a file with r2. Then do e http.sandbox=false (so I can run scripts) and =h& and boom webservice in background and r2 still running normally! The setup I'm after may seem a little strange but everything works like I originally wanted. My python server runs and when a command is received it connects to the webservice and forwards any r2.cmd()'s to it! Thanks again for your help!
    – Nux
    May 23, 2018 at 23:36
  • 1
    wow. Didn't know you can r2pipe to a web server. Good to know that! May 24, 2018 at 9:23

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.