1

When I run aaa, Radare tells me,

[x] Use -AA or aaaa to perform additional experimental analysis.

But what does aaaa do? It's not documented under aa? nor aaa? nor

[0x000028e0]> aaa?
Usage: See aa? for more help
[0x000028e0]> aaaa?
Usage: See aa? for more help

And man radare isn't more useful only saying,

 -A  run 'aaa' command before prompt or patch to analyze all referenced code. Use -AA to run aaaa

radare --help, says

 -A run 'aaa' command to analyze all referenced code
2

When you execute the aaa command, radare is showing you what are the steps it takes. Each step has the command responsible for it inside parentheses.

[0x00000000]> aaa
[x] Analyze all flags starting with sym. and entry0 (aa)
[x] Analyze function calls (aac)
[x] Analyze len bytes of instructions for references (aar)
[x] Constructing a function name for fcn.* and sym.func.* functions (aan)
[x] Type matching analysis for all functions (afta)
[x] Use -AA or aaaa to perform additional experimental analysis.

As you can see, aaa is a command which is executing other commands. It also prints a short description of what each command is doing. A little bit more detailed information can be found under aa?. So, to append this information together:

  • aa - alias for af@@ sym.*;af@entry0;afva
  • aac - analyze function calls (af @@ `pi len~call[1]`)
  • aar - analyze len bytes of instructions for references
  • aan - autoname functions that either start with fcn.* or sym.func.*
  • afta - do type matching analysis for all functions

Similar to aaa, this information is being printed when aaaa is executed.

[0x00000000]> aaaa
[x] Analyze all flags starting with sym. and entry0 (aa)
[x] Analyze function calls (aac)
[x] Analyze len bytes of instructions for references (aar)
[x] Constructing a function name for fcn.* and sym.func.* functions (aan)
[x] Enable constraint types analysis for variables

The main change of aaaa is "[x] Enable constraint types analysis for variables". This basically enables the anal.types.constraint configuration variable.

[0x00000000]> e? anal.types.constraint
anal.types.constraint: Enable constraint types analysis for variables

On a personal note here, I would suggest not to use aaaa since it is quite buggy sometimes and probably would not be necessary.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.