pdf @@f
is disassembly function
and iterating over all functions (@@f
), so obviously you need to have some functions. And if you functions are not analyzed then you won't get disassembly of those. See the following example output (truncated)
❯ r2 /bin/ls
[0x000067d0]> pdf @@f //<- nothing printed as functions not analyzed
[0x000067d0]> aaa
[x] Analyze all flags starting with sym. and entry0 (aa)
...
[0x000067d0]> pdf @@f
Linear size differs too much from the bbsum, please use pdr instead.
...
Do you want to print 15755 lines? (y/N)
You can clearly see that if binary is not analyzed nothing is printed by pdf @@f
.
On the other hand you can run pd $s
without any analysis and it will start printing the disassembly, but it will disregard any file structure there might be.
❯ r2 /bin/ls
[0x000067d0]> pd $s
Do you want to print 142792 lines? (y/N)
So which one to use? I would go with pdf @@f
after an analysis if you know the file is some kind of binary executable format. If you have 'unknown' data and want to see if the bytes makes sense as opcodes probably better choise is pd $s
.