6

I can't figure out what afl actually outputs. The docs are surprisingly uninformative.

So, I've got address on the first column and symbol on the last. What is on the 2nd, 3rd and 4th columns?

Example:

:> afl
0x08048000   29 988  -> 937  segment.LOAD0
0x080483dc    3 35           func_5
0x08048410    1 6            sym.imp.fgets
0x08048420    1 6            sym.imp.fclose
0x08048430    1 6            sym.imp.fwrite
0x08048440    1 6            sym.imp.puts
0x08048450    1 6            loc.imp.__gmon_start
0x08048460    1 6            sym.imp.exit
0x08048470    1 6            sym.imp.__libc_start_main
0x08048480    1 6            sym.imp.fopen
0x08048490    1 6            sym.imp.fileno
0x080484a0    1 6            sym.imp.ptrace
0x080484b0    1 33           entry0
0x080484e0    1 4            func_3
0x080484f0    4 42           func_4
0x08048642    4 51           func_1
0x08048675   10 83           func_2
0x080486c8    4 194          main
7

First, I'll answer your question straightly:

  • 2nd column: The number of basic blocks in the function
  • 3rd column: The size of the function (in bytes)
  • 4th column: The function's name

You might have used "4th" to spot the number that comes after the "->". If this is the case, where there is a "->" the left number is the range of the function where on the right you can find the size of the function. It happens only when the range and the size are different.


But now for a more generic approach. As you noticed, some commands of radare2 would not show you the column headers of the table, just as your example with the afl command. So what can you do to show this information?

Use the JSON output

Simply, use the JSON representation of the output. Most of radare2's informative commands can be appended with a j to format the output as JSON. Add ~{} to format the output with JSON indention for readability:

So for example:

[0x00400430]> aflj~{}                   
[                                       
  {                                     
    "offset": 4195272,                  
    "name": "sym._init",                
    "size": 26,                         
    "realsz": 26,                       
    "cc": 2,                            
    "cost": 12,                         
    "nbbs": 3,                          
    "edges": 3,                         
    "ebbs": 1,                          
    "calltype": "amd64",                
    "type": "sym",                      
    "minbound": "4195272",              
    "maxbound": "4195298",              
    "range": "26",                      
    "diff": "NEW",    
    ...
    ...               

As you can see, radare presents us with a simple JSON output that contains the headers (keys) for each value. You can easily understand what each column is, using the header name which is corresponding to the output without j.

Use a more verbose command

An alternative for afl is afll. It will list the functions of the binary in a verbose mode and in an easy to understand table:

[0x00400430]> afll
address            size  nbbs edges    cc cost          min bound range max bound          calls locals args xref frame name
================== ==== ===== ===== ===== ==== ================== ===== ================== ===== ====== ==== ==== ===== ====
0x004003c8   26     3     3     2   12 0x004003c8    26 0x004003e2     1    0      0    1     8 sym._init
0x00400400    6     1     0     1    3 0x00400400     6 0x00400406     0    0      0    1     0 sym.imp.puts
0x00400410    6     1     0     1    3 0x00400410     6 0x00400416     0    0      0    1     0 sym.imp.__libc_start_main
0x00400420    6     1     0     1    3 0x00400420     6 0x00400426     0    0      0    1     0 sub.__gmon_start_420
0x00400430   41     1     0     1   15 0x00400430    41 0x00400459     1    0      0    0     8 entry0
0x00400460   41     4     4     2   20 0x00400460    50 0x00400492     0    0      0    1     8 sym.deregister_tm_clones
0x004004a0   53     3     2    -1   20 0x004004a0    53 0x004004d5     0    0      0    2     8 sym.register_tm_clones
0x004004e0   28     3     3     2   14 0x004004e0    28 0x004004fc     1    0      0    0     0 sym.__do_global_dtors_aux
0x00400500   35     4     6     4   19 0x00400500    38 0x00400526     0    0      0    0     8 entry1.init
0x00400526   21     1     0     1   12 0x00400526    21 0x0040053b     1    0      0    1     8 sym.main
0x00400540  101     4     5     3   49 0x00400540   101 0x004005a5     1    0      0    1    56 sym.__libc_csu_init
0x004005b0    2     1     0     1    3 0x004005b0     2 0x004005b2     0    0      0    1     0 sym.__libc_csu_fini
0x004005b4    9     1     0     1    5 0x004005b4     9 0x004005bd     0    0      0    0     8 sym._fini

afll listed the functions but this time it showed you the columns' header name.

  • Very informative, thanks. Could you please clarify what the line coloring means on afll? – rgcalsaverini Jun 26 '18 at 10:21

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.