6

I compiled cpython with debugging headers and I want to perform the following analysis using radare2.

The problem I encounter is that it takes forever (at least 27 hours) to perform the aaa (analysis) part.

  • well, you could profile it and file a bug report :) – Igor Skochinsky Aug 16 '17 at 18:13
  • Hey @0x90! I see you are a veteran user in the Stack Exchange community but not as active in SE.Reverse-Engineering. It might just slipped your mind, so just a reminder, if you found this answer helpful please mark it as Accepted so we can focus on other questions which aren't answered yet and so others, coming from search engines, could benefit from this answer. – Megabeets Nov 13 '17 at 8:10
  • @Megabeets it's a good answer indeed, though I prefer to allow other people to try to answer. – 0x90 Nov 13 '17 at 15:10
  • accepting an answer does not prevent others from adding their own answers. You can even change the accepted answer later if better one appears. If you are not happy with the current answer(s), you could declare a bounty to get a (hopefully) better one. – Igor Skochinsky Nov 13 '17 at 18:18
17

It is not a good practice to run full analysis of your binary at the startup and it also isn't encourged by radare. Running aaa by default is a heavy action and absolutely not recommended or needed in most of the cases.

As stated in this execllent post from radare's blog:

Code analysis is not a quick operation, and not even predictable or taking a linear time to be processed. This makes starting times pretty heavy, compared to just loading the headers and strings information like it’s done by default.
...
We enforce users to think about their workflows in order to better understand the problem they are facing and solve it in an optimal way, saving cpu, memory and why not: cats.

To make the analysis process more efficient you can start with configuring different analysis configuration variables in radare. These configuration variables can help you to fit the analysis process to your program and to your needs. Some of the interesting variables are:

anal.afterjmp  
anal.depth  
anal.eobjmp  
anal.esil  
anal.hasnext  
anal.nopskip  
anal.from
anal.to

See the e??anal. command to get more detailed descriptions for them.

Analysis of a program isn't just performing one action and that's it -- it is combined from different analysis for different needs.
radare implements many different commands that perform different kind of analysis. Smart use of these command can help you quick the process of the analysis and analyze only the parts which you believe are the most important:

  • Find functions by prelude instructions (aap)
  • Identify functions by following calls (aac)
  • Detect jump tables and pointers to code section (/V)
  • Analyze opcode absolute and relative references (aa\r)
  • Find code/data/string references to a specific address (/r)
  • Emulate code to identify new pointer references (aae)
  • Use binary header information to find public functions (aas)
  • Assume functions are consecutive (aat)

To sums it up, you should think and plan the analysis process that fits best to your needs:

radare2 is not a click-and-run program, it’s a set of orthogonal tools and commands that allows you to understand, analyze, manipulate and play with a large list of binary types... Only experience and understanding will give you control on what you are doing.

If after reading this answer and the post in radare's blog you believe its a bug and you can point at the problem, feel free to open an issue on github.

  • Given that this answer was set to correct, it would be interesting to know what analysis switches did you use to analyze that binary specifically and how much time it took. – newlog Dec 12 '17 at 11:46

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.