When you execute the aaa command, radare is showing you what are the steps it takes. Each step has the command responsible for it inside parentheses.
[0x00000000]> aaa
[x] Analyze all flags starting with sym. and entry0 (aa)
[x] Analyze function calls (aac)
[x] Analyze len bytes of instructions for references (aar)
[x] Constructing a function name for fcn.* and sym.func.* functions (aan)
[x] Type matching analysis for all functions (afta)
[x] Use -AA or aaaa to perform additional experimental analysis.
As you can see, aaa is a command which is executing other commands. It also prints a short description of what each command is doing. A little bit more detailed information can be found under aa?. So, to append this information together:
- aa - alias for
af@@ sym.*;af@entry0;afva
- aac - analyze function calls (
af @@ `pi len~call[1]`)
- aar - analyze len bytes of instructions for references
- aan - autoname functions that either start with
fcn.* or sym.func.*
- afta - do type matching analysis for all functions
Similar to aaa, this information is being printed when aaaa is executed.
[0x00000000]> aaaa
[x] Analyze all flags starting with sym. and entry0 (aa)
[x] Analyze function calls (aac)
[x] Analyze len bytes of instructions for references (aar)
[x] Constructing a function name for fcn.* and sym.func.* functions (aan)
[x] Enable constraint types analysis for variables
The main change of aaaa is "[x] Enable constraint types analysis for variables". This basically enables the anal.types.constraint configuration variable.
[0x00000000]> e? anal.types.constraint
anal.types.constraint: Enable constraint types analysis for variables
On a personal note here, I would suggest not to use aaaa since it is quite buggy sometimes and probably would not be necessary.
