Results of radare2 are not correct

Question

I am using radare2 to analyze libpng_amd64.so.1.6.34, commands are as follows:

r2 = r2pipe.open(binary_file)
r2.cmd('aaa')
funcs = r2.cmdj('aflj')

len(funcs) is 461, but the number of functions got by IDA is 526, besides the numbers of strings, imports, exports... are also different. I checked the result of radare2 and found some issuses, for example, the function png_write_row is followed by png_write_rows. Radare2 can not identity the second function png_write_rows and consider all code of those two functions to png_write_row. IDA works correctly.

Why they are different? and Why radare2 can not identity functions correctly? how can I use it to get correct results?

Answer 1

It might be due to different algorithms used for analysis or different options set for those. r2 (as well as IDA and Ghidra) has multiple options that can influence how the code is analyzed and how the functions (and other elements) are being recognized.

In this case, png_write_rows, as far as I can see, this function is not called anywhere in the lib and also doesn't have standard function prologue so it might be for the reason that r2 doesn't recognize it and mark correctly as a function.

How to fix? You can always modify the final analysis and define a function where the flag for png_write_rows is. You can do that in Visual mode by typing 'df' (define function).

Anyway, I would open an r2 issue to get some more info if this is a case of correct analysis flags (check e~anal) or why for some other reason r2 doesn't recognize correctly some elements in this lib.