First, I'll answer your question straightly:
- 2nd column: The number of basic blocks in the function
- 3rd column: The size of the function (in bytes)
- 4th column: The function's name
You might have used "4th" to spot the number that comes after the "->". If this is the case, where there is a "->" the left number is the range of the function where on the right you can find the size of the function. It happens only when the range and the size are different.
But now for a more generic approach. As you noticed, some commands of radare2 would not show you the column headers of the table, just as your example with the afl command. So what can you do to show this information?
Use the JSON output
Simply, use the JSON representation of the output. Most of radare2's informative commands can be appended with a j to format the output as JSON. Add ~{} to format the output with JSON indention for readability:
So for example:
[0x00400430]> aflj~{}
[
{
"offset": 4195272,
"name": "sym._init",
"size": 26,
"realsz": 26,
"cc": 2,
"cost": 12,
"nbbs": 3,
"edges": 3,
"ebbs": 1,
"calltype": "amd64",
"type": "sym",
"minbound": "4195272",
"maxbound": "4195298",
"range": "26",
"diff": "NEW",
...
...
As you can see, radare presents us with a simple JSON output that contains the headers (keys) for each value. You can easily understand what each column is, using the header name which is corresponding to the output without j.
Use a more verbose command
An alternative for afl is afll. It will list the functions of the binary in a verbose mode and in an easy to understand table:
[0x00400430]> afll
address size nbbs edges cc cost min bound range max bound calls locals args xref frame name
================== ==== ===== ===== ===== ==== ================== ===== ================== ===== ====== ==== ==== ===== ====
0x004003c8 26 3 3 2 12 0x004003c8 26 0x004003e2 1 0 0 1 8 sym._init
0x00400400 6 1 0 1 3 0x00400400 6 0x00400406 0 0 0 1 0 sym.imp.puts
0x00400410 6 1 0 1 3 0x00400410 6 0x00400416 0 0 0 1 0 sym.imp.__libc_start_main
0x00400420 6 1 0 1 3 0x00400420 6 0x00400426 0 0 0 1 0 sub.__gmon_start_420
0x00400430 41 1 0 1 15 0x00400430 41 0x00400459 1 0 0 0 8 entry0
0x00400460 41 4 4 2 20 0x00400460 50 0x00400492 0 0 0 1 8 sym.deregister_tm_clones
0x004004a0 53 3 2 -1 20 0x004004a0 53 0x004004d5 0 0 0 2 8 sym.register_tm_clones
0x004004e0 28 3 3 2 14 0x004004e0 28 0x004004fc 1 0 0 0 0 sym.__do_global_dtors_aux
0x00400500 35 4 6 4 19 0x00400500 38 0x00400526 0 0 0 0 8 entry1.init
0x00400526 21 1 0 1 12 0x00400526 21 0x0040053b 1 0 0 1 8 sym.main
0x00400540 101 4 5 3 49 0x00400540 101 0x004005a5 1 0 0 1 56 sym.__libc_csu_init
0x004005b0 2 1 0 1 3 0x004005b0 2 0x004005b2 0 0 0 1 0 sym.__libc_csu_fini
0x004005b4 9 1 0 1 5 0x004005b4 9 0x004005bd 0 0 0 0 8 sym._fini
afll listed the functions but this time it showed you the columns' header name.
