The Radare community generally seems to look down upon simply running AAA
or AAAA
claiming that you need to instead learn the fine grained analysis and what they do. However, there seems to be no documentation on this.
Where do I learn what these do? And what that provides to me?
> a~analyze
| aa[?] analyze all (fcns + bbs) (aa0 to avoid sub renaming)
| a8 [hexpairs] analyze bytes
| ab[b] [addr] analyze block at given address
| abb [len] analyze N basic blocks in [len] (section.size by default)
| ac [cycles] analyze which op could be executed in [cycles]
| ad[?] analyze data trampoline (wip)
| ad [from] [to] analyze data pointers to (from-to)
| ae[?] [expr] analyze opcode eval expression (see ao)
| af[?] analyze Functions
| ao[?] [len] analyze Opcodes (or emulate it)
| as[?] [num] analyze syscall using dbg.reg
It only gets more scary with aa
,
aab - perform basic-block analysis ("Nucleus" algorithm)
aac - analyze function calls from one (selected or current function)
aaf - analyze all function calls
aar - analyze data references
aad - analyze pointers to pointers references
I would just like to see something pull these together. Is there a tutorial on these? It seems like there are hundreds of options providing fine grained control over analysis with little in the way to explain what they deliver shy of the words above.