Why does -A (aaa) analysis show much more information, when using the -d (debug) CLI option in Radare2?

Question

Why does -A (aaa) analysis show much more information, when using the -d (debug) CLI option in Radare2?

I'm using the newest version of Radare2 to analyze the Windows application.

As can be seen below, using the -d (debug) option with -A (aaa) yields more information on the application, e.g. symbols. Why is that?

Without the -d (debug) CLI option:

$ r2 -A WindowsService.exe
Metadata Signature: 0x8bc 0x10001424a5342 12
.NET Version: v4.0.30319
[x] Analyze all flags starting with sym. and entry0 (aa)
[x] Analyze function calls (aac)
[x] Analyze len bytes of instructions for references (aar)
[x] Constructing a function name for fcn.* and sym.func.* functions (aan)
[x] Type matching analysis for all functions (afta)
[x] Use -AA or aaaa to perform additional experimental analysis.
 -- I didn't say that it was working, I said that it's implemented
[0x00403e92]> afll
address    size  nbbs edges    cc cost  min bound range max bound  calls locals args xref frame name
========== ==== ===== ===== ===== ==== ========== ===== ========== ===== ====== ==== ==== ===== ====
0x00403e92    6     1     0     1    3 0x00403e92     6 0x00403e98     0    0      0    1     0 entry0

With the -d (debug) CLI option:

$ r2 -d -A WindowsService.exe
Process with PID 21499 started...
= attach 21499 21499
bin.baddr 0x561296b89000
Using 0x561296b89000
asm.bits 64
[x] Analyze all flags starting with sym. and entry0 (aa)
[x] Analyze function calls (aac)
[x] Analyze len bytes of instructions for references (aar)
[x] Constructing a function name for fcn.* and sym.func.* functions (aan)
[TOFIX: afta can't run in debugger mode.ions (afta)
[x] Type matching analysis for all functions (afta)
[x] Use -AA or aaaa to perform additional experimental analysis.
= attach 21499 21499
21499
 -- Use zoom.byte=entropy and press 'z' in visual mode to zoom out to see the entropy of the whole file
[0x7fb177974090]> afll
address            size  nbbs edges    cc cost          min bound range max bound          calls locals args xref frame name
================== ==== ===== ===== ===== ==== ================== ===== ================== ===== ====== ==== ==== ===== ====
0x0000561296b89000  285     3     2     3  134 0x0000561296b89000   292 0x0000561296b89124     0    0      1    0    24 sym.imp.__libc_start_main
0x0000561296b8d290    6     1     0     1    3 0x0000561296b8d290     6 0x0000561296b8d296     0    0      0    0     0 sym.imp.sigprocmask
0x0000561296b8d2a0    6     1     0     1    3 0x0000561296b8d2a0     6 0x0000561296b8d2a6     0    0      0    0     0 sym.imp.raise
0x0000561296b8d2b0    6     1     0     1    3 0x0000561296b8d2b0     6 0x0000561296b8d2b6     0    0      0    0     0 sym.imp.free
0x0000561296b8d2c0    6     1     0     1    3 0x0000561296b8d2c0     6 0x0000561296b8d2c6     0    0      0    0     0 sym.imp.strcasecmp
0x0000561296b8d2d0    6     1     0     1    3 0x0000561296b8d2d0     6 0x0000561296b8d2d6     0    0      0    0     0 sym.imp.abort
0x0000561296b8d2e0    6     1     0     1    3 0x0000561296b8d2e0     6 0x0000561296b8d2e6     0    0      0    1     0 sym.imp.__errno_location
0x0000561296b8d2f0    6     1     0     1    3 0x0000561296b8d2f0     6 0x0000561296b8d2f6     0    0      0    0     0 sym.imp._exit
0x0000561296b8d300    6     1     0     1    3 0x0000561296b8d300     6 0x0000561296b8d306     0    0      0    0     0 sym.imp.strcpy
0x0000561296b8d310    6     1     0     1    3 0x0000561296b8d310     6 0x0000561296b8d316     0    0      0    0     0 sym.imp.qsort
0x0000561296b8d320    6     1     0     1    3 0x0000561296b8d320     6 0x0000561296b8d326     0    0      0    0     0 sym.imp.isatty
0x0000561296b8d330    6     1     0     1    3 0x0000561296b8d330     6 0x0000561296b8d336     0    0      0    0     0 sym.imp.sigaction
0x0000561296b8d340    6     1     0     1    3 0x0000561296b8d340     6 0x0000561296b8d346     0    0      0    0     0 sym.imp.strtod
0x0000561296b8d350    6     1     0     1    3 0x0000561296b8d350     6 0x0000561296b8d356     0    0      0    0     0 sym.imp.strchrnul
0x0000561296b8d360    6     1     0     1    3 0x0000561296b8d360     6 0x0000561296b8d366     0    0      0    0     0 sym.imp.faccessat
0x0000561296b8d370    6     1     0     1    3 0x0000561296b8d370     6 0x0000561296b8d376     0    0      0    0     0 sym.imp.fcntl
0x0000561296b8d380    6     1     0     1    3 0x0000561296b8d380     6 0x0000561296b8d386     0    0      0    0     0 sym.imp.write
0x0000561296b8d390    6     1     0     1    3 0x0000561296b8d390     6 0x0000561296b8d396     0    0      0    1     0 sym.imp.getpid
0x0000561296b8d3a0    6     1     0     1    3 0x0000561296b8d3a0     6 0x0000561296b8d3a6     0    0      0    0     0 sym.imp.__strtol_internal
0x0000561296b8d3b0    6     1     0     1    3 0x0000561296b8d3b0     6 0x0000561296b8d3b6     0    0      0    0     0 sym.imp.__xstat64
0x0000561296b8d3c0    6     1     0     1    3 0x0000561296b8d3c0     6 0x0000561296b8d3c6     0    0      0    0     0 sym.imp.wait3
0x0000561296b8d3d0    6     1     0     1    3 0x0000561296b8d3d0     6 0x0000561296b8d3d6     0    0      0    0     0 sym.imp.opendir
0x0000561296b8d3e0    6     1     0     1    3 0x0000561296b8d3e0     6 0x0000561296b8d3e6     0    0      0    0     0 sym.imp.stpcpy
0x0000561296b8d3f0    6     1     0     1    3 0x0000561296b8d3f0     6 0x0000561296b8d3f6     0    0      0    0     0 sym.imp.strlen
0x0000561296b8d400    6     1     0     1    3 0x0000561296b8d400     6 0x0000561296b8d406     0    0      0    0     0 sym.imp.chdir
0x0000561296b8d410    6     1     0     1    3 0x0000561296b8d410     6 0x0000561296b8d416     0    0      0    0     0 sym.imp.__stack_chk_fail
0x0000561296b8d420    6     1     0     1    3 0x0000561296b8d420     6 0x0000561296b8d426     0    0      0    1     0 sym.imp.getuid
0x0000561296b8d430    6     1     0     1    3 0x0000561296b8d430     6 0x0000561296b8d436     0    0      0    0     0 sym.imp.dup2
0x0000561296b8d440    6     1     0     1    3 0x0000561296b8d440     6 0x0000561296b8d446     0    0      0    0     0 sym.imp.strchr
0x0000561296b8d450    6     1     0     1    3 0x0000561296b8d450     6 0x0000561296b8d456     0    0      0    0     0 sym.imp.warnx
0x0000561296b8d460    6     1     0     1    3 0x0000561296b8d460     6 0x0000561296b8d466     0    0      0    0     0 sym.imp.__strtoul_internal
0x0000561296b8d470    6     1     0     1    3 0x0000561296b8d470     6 0x0000561296b8d476     0    0      0    0     0 sym.imp.fnmatch
0x0000561296b8d480    6     1     0     1    3 0x0000561296b8d480     6 0x0000561296b8d486     0    0      0    0     0 sym.imp.geteuid
0x0000561296b8d490    6     1     0     1    3 0x0000561296b8d490     6 0x0000561296b8d496     0    0      0    0     0 sym.imp.getcwd
0x0000561296b8d4a0    6     1     0     1    3 0x0000561296b8d4a0     6 0x0000561296b8d4a6     0    0      0    0     0 sym.imp.close
0x0000561296b8d4b0    6     1     0     1    3 0x0000561296b8d4b0     6 0x0000561296b8d4b6     0    0      0    0     0 sym.imp.pipe
0x0000561296b8d4c0    6     1     0     1    3 0x0000561296b8d4c0     6 0x0000561296b8d4c6     0    0      0    0     0 sym.imp.strspn
0x0000561296b8d4d0    6     1     0     1    3 0x0000561296b8d4d0     6 0x0000561296b8d4d6     0    0      0    0     0 sym.imp.closedir
0x0000561296b8d4e0    6     1     0     1    3 0x0000561296b8d4e0     6 0x0000561296b8d4e6     0    0      0    0     0 sym.imp.strcspn
0x0000561296b8d4f0    6     1     0     1    3 0x0000561296b8d4f0     6 0x0000561296b8d4f6     0    0      0    0     0 sym.imp.read
0x0000561296b8d500    6     1     0     1    3 0x0000561296b8d500     6 0x0000561296b8d506     0    0      0    1     0 sym.imp._setjmp
0x0000561296b8d510    6     1     0     1    3 0x0000561296b8d510     6 0x0000561296b8d516     0    0      0    0     0 sym.imp.execve
0x0000561296b8d520    6     1     0     1    3 0x0000561296b8d520     6 0x0000561296b8d526     0    0      0    0     0 sym.imp.__fxstat64
0x0000561296b8d530    6     1     0     1    3 0x0000561296b8d530     6 0x0000561296b8d536     0    0      0    0     0 sym.imp.strcmp
0x0000561296b8d540    6     1     0     1    3 0x0000561296b8d540     6 0x0000561296b8d546     0    0      0    0     0 sym.imp.signal
0x0000561296b8d550    6     1     0     1    3 0x0000561296b8d550     6 0x0000561296b8d556     0    0      0    0     0 sym.imp.getpwnam
0x0000561296b8d560    6     1     0     1    3 0x0000561296b8d560     6 0x0000561296b8d566     0    0      0    0     0 sym.imp.umask
0x0000561296b8d570    6     1     0     1    3 0x0000561296b8d570     6 0x0000561296b8d576     0    0      0    0     0 sym.imp.strtol
0x0000561296b8d580    6     1     0     1    3 0x0000561296b8d580     6 0x0000561296b8d586     0    0      0    0     0 sym.imp.sigfillset
0x0000561296b8d590    6     1     0     1    3 0x0000561296b8d590     6 0x0000561296b8d596     0    0      0    0     0 sym.imp.memcpy
0x0000561296b8d5a0    6     1     0     1    3 0x0000561296b8d5a0     6 0x0000561296b8d5a6     0    0      0    0     0 sym.imp.kill
0x0000561296b8d5b0    6     1     0     1    3 0x0000561296b8d5b0     6 0x0000561296b8d5b6     0    0      0    1     0 sym.imp.getgid
0x0000561296b8d5c0    6     1     0     1    3 0x0000561296b8d5c0     6 0x0000561296b8d5c6     0    0      0    0     0 sym.imp.tcgetpgrp
0x0000561296b8d5d0    6     1     0     1    3 0x0000561296b8d5d0     6 0x0000561296b8d5d6     0    0      0    0     0 sym.imp.__xstat
0x0000561296b8d5e0    6     1     0     1    3 0x0000561296b8d5e0     6 0x0000561296b8d5e6     0    0      0    0     0 sym.imp.readdir
0x0000561296b8d5f0    6     1     0     1    3 0x0000561296b8d5f0     6 0x0000561296b8d5f6     0    0      0    0     0 sym.imp.malloc
0x0000561296b8d600    6     1     0     1    3 0x0000561296b8d600     6 0x0000561296b8d606     0    0      0    0     0 sym.imp.killpg
0x0000561296b8d610    6     1     0     1    3 0x0000561296b8d610     6 0x0000561296b8d616     0    0      0    0     0 sym.imp.getegid
0x0000561296b8d620    6     1     0     1    3 0x0000561296b8d620     6 0x0000561296b8d626     0    0      0    0     0 sym.imp.strpbrk
0x0000561296b8d630    6     1     0     1    3 0x0000561296b8d630     6 0x0000561296b8d636     0    0      0    0     0 sym.imp.sigsuspend
0x0000561296b8d640    6     1     0     1    3 0x0000561296b8d640     6 0x0000561296b8d646     0    0      0    0     0 sym.imp.__vsnprintf_chk
0x0000561296b8d650    6     1     0     1    3 0x0000561296b8d650     6 0x0000561296b8d656     0    0      0    0     0 sym.imp.setrlimit
0x0000561296b8d660    6     1     0     1    3 0x0000561296b8d660     6 0x0000561296b8d666     0    0      0    0     0 sym.imp.strsignal
0x0000561296b8d670    6     1     0     1    3 0x0000561296b8d670     6 0x0000561296b8d676     0    0      0    0     0 sym.imp.realloc
0x0000561296b8d680    6     1     0     1    3 0x0000561296b8d680     6 0x0000561296b8d686     0    0      0    0     0 sym.imp.sigsetmask
0x0000561296b8d690    6     1     0     1    3 0x0000561296b8d690     6 0x0000561296b8d696     0    0      0    0     0 sym.imp.__longjmp_chk
0x0000561296b8d6a0    6     1     0     1    3 0x0000561296b8d6a0     6 0x0000561296b8d6a6     0    0      0    0     0 sym.imp.open64
0x0000561296b8d6b0    6     1     0     1    3 0x0000561296b8d6b0     6 0x0000561296b8d6b6     0    0      0    0     0 sym.imp.mempcpy
0x0000561296b8d6c0    6     1     0     1    3 0x0000561296b8d6c0     6 0x0000561296b8d6c6     0    0      0    0     0 sym.imp.memmove
0x0000561296b8d6d0    6     1     0     1    3 0x0000561296b8d6d0     6 0x0000561296b8d6d6     0    0      0    0     0 sym.imp.setgid
0x0000561296b8d6e0    6     1     0     1    3 0x0000561296b8d6e0     6 0x0000561296b8d6e6     0    0      0    0     0 sym.imp.getpgrp
0x0000561296b8d6f0    6     1     0     1    3 0x0000561296b8d6f0     6 0x0000561296b8d6f6     0    0      0    0     0 sym.imp.tcsetpgrp
0x0000561296b8d700    6     1     0     1    3 0x0000561296b8d700     6 0x0000561296b8d706     0    0      0    0     0 sym.imp.open
0x0000561296b8d710    6     1     0     1    3 0x0000561296b8d710     6 0x0000561296b8d716     0    0      0    0     0 sym.imp.times
0x0000561296b8d720    6     1     0     1    3 0x0000561296b8d720     6 0x0000561296b8d726     0    0      0    0     0 sym.imp.strtok
0x0000561296b8d730    6     1     0     1    3 0x0000561296b8d730     6 0x0000561296b8d736     0    0      0    0     0 sym.imp.sysconf
0x0000561296b8d740    6     1     0     1    3 0x0000561296b8d740     6 0x0000561296b8d746     0    0      0    0     0 sym.imp.__lxstat64
0x0000561296b8d750    6     1     0     1    3 0x0000561296b8d750     6 0x0000561296b8d756     0    0      0    0     0 sym.imp.setpgid
0x0000561296b8d760    6     1     0     1    3 0x0000561296b8d760     6 0x0000561296b8d766     0    0      0    0     0 sym.imp.getppid
0x0000561296b8d770    6     1     0     1    3 0x0000561296b8d770     6 0x0000561296b8d776     0    0      0    0     0 sym.imp.getrlimit
0x0000561296b8d780    6     1     0     1    3 0x0000561296b8d780     6 0x0000561296b8d786     0    0      0    0     0 sym.imp.setuid
0x0000561296b8d790    6     1     0     1    3 0x0000561296b8d790     6 0x0000561296b8d796     0    0      0    0     0 sym.imp.strdup
0x0000561296b8d7a0    6     1     0     1    3 0x0000561296b8d7a0     6 0x0000561296b8d7a6     0    0      0    0     0 sym.imp.strerror
0x0000561296b8d7b0    6     1     0     1    3 0x0000561296b8d7b0     6 0x0000561296b8d7b6     0    0      0    0     0 sym.imp.fork
0x0000561296b8d7c0    6     1     0     1    3 0x0000561296b8d7c0     6 0x0000561296b8d7c6     0    0      0    0     0 sym.imp.__ctype_b_loc
0x0000561296b8d7d0    6     1     0     1    3 0x0000561296b8d7d0     6 0x0000561296b8d7d6     0    0      0    1     0 sub.__cxa_finalize_7d0
0x0000561296b8d850  455    25    42    17  155 0x0000561296b8d850   455 0x0000561296b8da17    20    6      2    1   280 main
0x0000561296b8da20   43     1     0     1   17 0x0000561296b8da20    43 0x0000561296b8da4b     1    0      1    0     8 entry0
0x0000561296b8da50   40     4     4     4   19 0x0000561296b8da50    50 0x0000561296b8da82     0    0      0    1     8 sub.__environ_32_a50
0x0000561296b8da90   57     4     4     4   24 0x0000561296b8da90    66 0x0000561296b8dad2     0    0      0    1     8 loc.561296b8da90
0x0000561296b8dae0   51     5     5     4   24 0x0000561296b8dae0    58 0x0000561296b8db1a     2    0      0    0     0 entry2.fini
0x0000561296b8db20  124     5     5     4   30 0x0000561296b8da90    10 0x0000561296b8db2a     0    0      0    0     8 entry1.init
0x0000561296da5fd8   72     1     0     1   33 0x0000561296da5fd8    72 0x0000561296da6020     0    0      0    1     0 reloc.__libc_start_main

Answer 1

It is probably due to the fact that you are trying to use r2 - a native disassembler/debugger to a .NET assembly which written in managed language and executed under CLR - Common Language Runtime. This line from your output gives that away

.NET Version: v4.0.30319

How .NET works is, that before execution, there should be no user provided native code (there are some exceptions that one can force compilation to a native platform) and only an entry point is visible - which you see without debugging. After running the file - it starts from the entry point and by using a JIT (Just-in-time compiler) compiling the IL to native code on the platform you are running on. This might be the reason you see all those methods when you list them while debugging.

I suggest you use a decompiler/debugger suited for .NET assemblies such as dnSpy.