1

I have a big library in which IDA found ~84300 functions but using aa in radare2 I was just able to found ~3000.

I tried setting anal.hasnext to true, anal.from and anal.to to the start and the end of the .text section but with not luck

So is there an optimal way to analyze all the functions using radare?

By optimal I mean avoiding xrefs or other analyzis

Thanks

  • You can try to use aab as it's quite fast and does not handle xrefs. – defragger Dec 14 '18 at 6:17
  • It worked, can you create an answer so I can mark it as answered – Fabian Mendez Dec 15 '18 at 0:52
  • I'm sorry some functions that were correctly analyzed before now are just a bunch of add byte [eax], al – Fabian Mendez Dec 15 '18 at 0:59
1

To see the help of analysis you can use aa?. For a more detailed information i would always suggest visiting the sourcecode as a lot of aa commands are combinations of different steps. A good starting point is at libr/core/cmd_anal.c

aab instead is a total different approach and can create a lot of false positives.

You could also give aaa a try but i assume that will take some time to finish.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.