Let's say I want to find out how many instructions an arbitrary function foo decodes to, is there an easy way to do this?

I'm trying to check against a version I am compiling with a stored binary on the system. It takes more work than I'd like to spend to test to see if the binary has changed as I muck with the compile options. I'm trying to optimize for fewer instructions.

  • Out of curiosity, why are you optimizing for smallest instruction count? In many ISAs (e.g. x86) that doesn't automatically translate to smallest binary or fastest execution—the things people usually optimize for. – user2347953 Nov 15 at 17:11
  • @user2347953 fair question, because I'm trying to demonstrate vulnerabilities so speed and size isn't an issue. I'm rebuilding Protostar from source and optimizing for clarity. That means turning off things like alignment checks, canaries, and safety-wrappers __chk_* functions etc. – Evan Carroll Nov 15 at 17:48
up vote 1 down vote accepted

You can always add ~? to any radare command to count lines of the resulting output. But, like in Bash the pipe to wc -l also works, |wc -l. So in your case

[0x08049060]> pif~?
[0x08049060]> pif|wc -l

Your Answer


By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.