Radare2 to show code hints like IDA Pro?

Question

I am trying to disassemble a binary with radare2, as a free alternative to IDA. Here is how the IDA disassembly of that section looks like :

Here is what I am doing with Radare2 (with an additional option of e asm.cmtright=true in my .radare2rc file) :

  r2 binary 
    [0x004027c0]> aaa
│          [0x004027c0]> s 0x40baa4
│          [0x0040baa4]> pd 10
│           0x0040baa4    4200053c     a1 |= loc.00420000
│           0x0040baa8    301ea524     a1 += 7728
│           0x0040baac    08c52426     a0 = s1 - 15096
│           0x0040bab0    09f82003     call t9
│           0x0040bab4    304c02ae     [s0 + 19504] = v0
│           0x0040bab8    1800bc8f     gp = [sp + 24]
│           0x0040babc    304c048e     a0 = [s0 + 19504]
│           0x0040bac0    2c83998f     t9 = [gp - 31956]
│           0x0040bac4    00000000     
│           0x0040bac8    09f82003     call t9

whereas the disassembly from the same location in IDA looks like :

.text:0040BAA4                 la      $a1, aId         # "id"
.text:0040BAAC                 addiu   $a0, $s1, (sub_40C508 - 0x410000)
.text:0040BAB0                 jalr    $t9 ; parse_uri
.text:0040BAB4                 sw      $v0, dword_434C30
.text:0040BAB8                 lw      $gp, 0x12B8+var_12A0($sp)
.text:0040BABC                 lw      $a0, dword_434C30
.text:0040BAC0                 la      $t9, sobj_get_string
.text:0040BAC4                 nop
.text:0040BAC8                 jalr    $t9 ; sobj_get_string

Is it possible to have radare2 show similar disassembly and be more meaningful?

Another example would be :

[0x004127f8]> pd 10
│           0x004127f8    6c83998f     t9 = [gp - 31892]
│           0x004127fc    00000000     
│           0x00412800    09f82003     call t9
│           0x00412804    2000a427     a0 = sp + 32
│           0x00412808    1800bc8f     gp = [sp + 24]
│           0x0041280c    02000524     a1 = 2
│           0x00412810    5481998f     t9 = [gp - 32428]
│           0x00412814    21300000     a2 = zero
│           0x00412818    09f82003     call t9
│           0x0041281c    2120c002     a0 = s6

compared to IDA :

.text:004127F8                 la      $t9, system
.text:004127FC                 nop
.text:00412800                 jalr    $t9 ; system
.text:00412804                 addiu   $a0, $sp, 0x248+var_228  # command
.text:00412808                 lw      $gp, 0x248+var_230($sp)
.text:0041280C                 li      $a1, 2           # cmd
.text:00412810                 la      $t9, lockf
.text:00412814                 move    $a2, $zero       # len
.text:00412818                 jalr    $t9 ; lockf
.text:0041281C                 move    $a0, $s6         # fd

IDA even tells me that this is the address of system, while just looking at the radare2 code I wouldn't have had been able to find it.

Any suggestions on how I could improve the radare2 analysis or it is just one of the limitations ?

Answer 1

you probably have e asm.esil set to true and e asm.emu set to false try toggling them

radare2.exe malloc://0x4f0000
 -- Hello Mr. Anderson

[0x00000000]> s 0x40abb4
[0x0040abb4]> wx 4200053c301ea52408c5242609f82003
[0x0040abb4]> e asm.emu = true
[0x0040abb4]> e asm.esil = true
[0x0040abb4]> e asm.arch = mips


[0x0040abb4]> pd 4
            0x0040abb4      4200053c       0x420000,a1,=              ; a1=0x420000
            0x0040abb8      301ea524       7728,a1,+,a1,=             ; a1=0x421e30
            0x0040abbc      08c52426       15096,s1,-,a0,=            ; a0=0xffffffffffffc508 -> 0xffffff00
            0x0040abc0      09f82003       0,$ds,>,?{,$$,1,TRAP,BREAK,},pc,4,+,ra,=,t9,$jt,=,1,$ds,=; ra=0x40abc8 ; $jt=0x0 ; CALL: 0x0, 0x0
, 0x0, 0x0


[0x0040abb4]> e asm.esil = false
[0x0040abb4]> pd 4
            0x0040abb4      4200053c       lui a1, 0x42               ; a1=0x420000
            0x0040abb8      301ea524       addiu a1, a1, 0x1e30       ; a1=0x421e30
            0x0040abbc      08c52426       addiu a0, s1, -0x3af8      ; a0=0xffffffffffffc508 -> 0xffffff00
            0x0040abc0      09f82003       jalr t9                    ; ra=0x40abc8 ; $jt=0x0 ; CALL: 0x0, 0x0, 0x0, 0x0
[0x0040abb4]>

Answer 2

This is currently Work in progress feature. It is called type propagation analysis that allows giving hints on variables types and their name in case of using standard functions.

I cant explain how to use because it is still not finished. but you will expected to provide calling conventions profile and data-types/function prototypes profiles for target architecture, they will be used to match function arguments to each instance of call instruction stack frame and registers as described per the profiles.

This analysis round should be target architecture independent. Once it is fully implemented I will update the answer to describe how to use that analysis