1

I have a big library in which IDA found ~84300 functions but using aa in radare2 I was just able to found ~3000.

I tried setting anal.hasnext to true, anal.from and anal.to to the start and the end of the .text section but with not luck

So is there an optimal way to analyze all the functions using radare?

By optimal I mean avoiding xrefs or other analyzis

Thanks

Improve this question
3
  • You can try to use aab as it's quite fast and does not handle xrefs.
    – defragger
    Dec 14, 2018 at 6:17
  • It worked, can you create an answer so I can mark it as answered
    – Fabian Mendez
    Dec 15, 2018 at 0:52
  • I'm sorry some functions that were correctly analyzed before now are just a bunch of add byte [eax], al
    – Fabian Mendez
    Dec 15, 2018 at 0:59

1 Answer 1

Reset to default
1

To see the help of analysis you can use aa?. For a more detailed information i would always suggest visiting the sourcecode as a lot of aa commands are combinations of different steps. A good starting point is at libr/core/cmd_anal.c

aab instead is a total different approach and can create a lot of false positives.

You could also give aaa a try but i assume that will take some time to finish.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.