I have a big library in which IDA found ~84300 functions but using aa in radare2 I was just able to found ~3000.

I tried setting anal.hasnext to true, anal.from and anal.to to the start and the end of the .text section but with not luck

So is there an optimal way to analyze all the functions using radare?

By optimal I mean avoiding xrefs or other analyzis


  • You can try to use aab as it's quite fast and does not handle xrefs.
    – defragger
    Dec 14, 2018 at 6:17
  • It worked, can you create an answer so I can mark it as answered Dec 15, 2018 at 0:52
  • I'm sorry some functions that were correctly analyzed before now are just a bunch of add byte [eax], al Dec 15, 2018 at 0:59

1 Answer 1


To see the help of analysis you can use aa?. For a more detailed information i would always suggest visiting the sourcecode as a lot of aa commands are combinations of different steps. A good starting point is at libr/core/cmd_anal.c

aab instead is a total different approach and can create a lot of false positives.

You could also give aaa a try but i assume that will take some time to finish.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.