2

I've tried searching around on how to disassemble a whole binary. I found that pd $s and pdf @@f are the 2 commands suggested most widely. I could understand the working of the latter, but I don't see how the former works.

Description (from p?) of pd - "disassemble N opcodes"
Description (from ?$?) of $s - "file size"

Therefore, what is the difference between pd $s and pdf @@f? Which command to use to disassemble the whole file?

1 Answer 1

2

pdf @@f is disassembly function and iterating over all functions (@@f), so obviously you need to have some functions. And if you functions are not analyzed then you won't get disassembly of those. See the following example output (truncated)

❯ r2 /bin/ls
[0x000067d0]> pdf @@f //<- nothing printed as functions not analyzed
[0x000067d0]> aaa
[x] Analyze all flags starting with sym. and entry0 (aa)
...
[0x000067d0]> pdf @@f
Linear size differs too much from the bbsum, please use pdr instead.
...
Do you want to print 15755 lines? (y/N)

You can clearly see that if binary is not analyzed nothing is printed by pdf @@f.

On the other hand you can run pd $s without any analysis and it will start printing the disassembly, but it will disregard any file structure there might be.

❯ r2 /bin/ls
[0x000067d0]> pd $s
Do you want to print 142792 lines? (y/N)

So which one to use? I would go with pdf @@f after an analysis if you know the file is some kind of binary executable format. If you have 'unknown' data and want to see if the bytes makes sense as opcodes probably better choise is pd $s.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.