Reverse Engineering Stack Exchange is a question and answer site for researchers and developers who explore the principles of a system through analysis of its structure, function, and operation. It only takes a minute to sign up.
Sign up to join this community
I've tried searching around on how to disassemble a whole binary. I found that pd $s and pdf @@f are the 2 commands suggested most widely. I could understand the working of the latter, but I don't see how the former works.
Description (from p?) of pd - "disassemble N opcodes"
Description (from ?$?) of $s - "file size"
Therefore, what is the difference between pd $s and pdf @@f? Which command to use to disassemble the whole file?
pdf @@f is disassembly function and iterating over all functions (@@f), so obviously you need to have some functions. And if you functions are not analyzed then you won't get disassembly of those. See the following example output (truncated)
❯ r2 /bin/ls
[0x000067d0]> pdf @@f //<- nothing printed as functions not analyzed
[0x000067d0]> aaa
[x] Analyze all flags starting with sym. and entry0 (aa)
...
[0x000067d0]> pdf @@f
Linear size differs too much from the bbsum, please use pdr instead.
...
Do you want to print 15755 lines? (y/N)
You can clearly see that if binary is not analyzed nothing is printed by pdf @@f.
On the other hand you can run pd $s without any analysis and it will start printing the disassembly, but it will disregard any file structure there might be.
❯ r2 /bin/ls
[0x000067d0]> pd $s
Do you want to print 142792 lines? (y/N)
So which one to use? I would go with pdf @@f after an analysis if you know the file is some kind of binary executable format. If you have 'unknown' data and want to see if the bytes makes sense as opcodes probably better choise is pd $s.