Rizin plugins — rz-pm ecosystem overview

Last updated: · By the BinBench editorial team · Stars and releases checked via the GitHub API
For legal, authorized and educational use only. Only analyze software you own or have written permission to examine.
Quick answer

Rizin (rizin.re) is a free reverse-engineering framework. rz-pm installs community and official extras into the right plugin directories so labs can extend analysis without forking the core. Use plugins only on binaries you are authorized to examine.

On this page

Snapshot

FieldValue
HostRizin (+ Cutter GUI)
Package managerrz-pm (see rizinorg/rz-pm releases)
Databaserizinorg/rz-pm-db
PeersCutter plugins, rz-ghidra, radare2 plugins / r2pm

Allowed framing

  • Installing a maintained decompiler helper (for example jsdec-class packages when listed in rz-pm-db) for course samples.
  • Teaching students to search / install / list before trusting a random GitHub .so.
  • Choosing Rizin plugins for loaders/arches and Cutter plugins for Qt UI — keep the boundary clear.

Scope we will not cover

  • No crack/keygen / license-bypass plugins.
  • No exploit PoC plugins framed as tutorials.
  • No claiming every rz-pm-db entry builds on every OS — bring the toolchain the package needs.
  • No anti-debug defeat recipes.

Beginner path (authorized only)

  1. Install Rizin from an official channel; confirm rizin -v (or your distro equivalent).
  2. Install rz-pm from the project's release page; make it executable.
  3. Refresh/search the database (rz-pm help shows current flags — CLI evolved from older book screenshots).
  4. Install one well-documented package into the user plugin path; restart Rizin/Cutter and verify.
  5. For GUI-only needs, prefer Cutter plugins instead of forcing a core plugin.
Which to pick
  • Use rz-pm to extend authorized Rizin labs from the official database.
  • Prefer r2pm only when you stay on radare2.
  • Refuse crack and exploit plugin framing.

For legal, authorized and educational use only.

FAQ

What is rz-pm?

rz-pm is Rizin's package manager for discovering, building/installing, updating and removing plugins and tools. Upstream install docs point to downloading the rz-pm binary for your OS and using the rz-pm-db package list.

How does it differ from radare2's r2pm?

Same job, different project. Rizin forked away from radare2; use rz-pm with Rizin/Cutter stacks and r2pm with radare2. See rizin vs radare2.

Where is the package database?

Official database lives in rizinorg/rz-pm-db. rz-pm typically refreshes it; you can point at a custom DB URL only if your lab policy allows.

Cutter plugin or Rizin plugin?

UI dock widgets often belong in Cutter plugins; new formats/architectures belong in Rizin plugins. See Cutter plugins overview.

Does this teach malware weaponization via plugins?

No. Authorized extension and education only — BinBench will not supply crack plugins, DRM bypasses or exploit PoCs.

Sources