Recursive traversal disassembling with Radare2?

Question

I am trying the recursive traversal disassembler of the radare2 tool. But, I cannot use it properly.

First, according to the radare2 manual, we can use recursive traversal disassembler by using the pdr:

[0x00404890]> pd?
Usage: pd[f|i|l] [len] @ [addr]
  pda  : disassemble all possible opcodes (byte per byte)
  pdj  : disassemble to json
  pdb  : disassemble basic block
  pdr  : recursive disassemble across the function graph
  pdf  : disassemble function
  pdi  : like 'pi', with offset and bytes
  pdl  : show instruction sizes

But I always get this error message:

Cannot find function at 0x004028c0

Here is a full session of radare2 on the ls command with, first, a linear sweep disassembly and, then, an attempt of recursive traversal disassembly:

$> radare2 /bin/ls
syntax error: error in error handling
syntax error: error in error handling
[0x00404890]> pd@main
        ;-- main:
        0x004028c0    4157         push r15
        0x004028c2    4156         push r14
        0x004028c4    4155         push r13
        0x004028c6    4154         push r12
        0x004028c8    55           push rbp
        0x004028c9    4889f5       mov rbp, rsi
        0x004028cc    53           push rbx
        0x004028cd    89fb         mov ebx, edi
        0x004028cf    4881ec88030. sub rsp, 0x388
        ...
        0x00402dff    8b0567772100 mov eax, [rip+0x217767] ; 0x0040a56c 
        0x00402e05    488b0d64772. mov rcx, [rip+0x217764] ; 0x0040a570 
        0x00402e0c    83f801       cmp eax, 0x1
        0x00402e0f    0f84de0d0000 jz 0x403bf3
        0x00402e15    83f802       cmp eax, 0x2
        0x00402e18    be0f384100   mov esi, 0x41380f
        0x00402e1d    b80e384100   mov eax, str.vdir
        0x00402e22    480f45f0     cmovnz rsi, rax
        0x00402e26    488b3de3772. mov rdi, [rip+0x2177e3] ; 0x0040a610
        0x00402e2d    48c70424000. mov qword [rsp], 0x0
        0x00402e35    41b9bd384100 mov r9d, str.DavidMacKenzie
        0x00402e3b    41b8cd384100 mov r8d, str.RichardM.Stallman
[0x00404890]> pdr@main
Cannot find function at 0x004028c0

In fact, I strongly suppose that I am missing a step here. It seems that we should first build the call graph of the program, but I didn't manage to find how to do it (I obviously have missed some documentation somewhere, sorry for that!).

So, if somebody can give me a hint about it, I would be pleased !

Answer 1

In fact, you should first run a 'function' analysis of the program. To better understand this type a?:

[0x00404890]> a?
Usage: a[?adfFghoprsx]
 a8 [hexpairs]    ; analyze bytes
 aa               ; analyze all (fcns + bbs)
 ad               ; analyze data trampoline (wip)
 ad [from] [to]   ; analyze data pointers to (from-to)
 ae [expr]        ; analyze opcode eval expression (see ao)
 af[bcsl?+-*]     ; analyze Functions
 aF               ; same as above, but using graph.depth=1
 ag[?acgdlf]      ; output Graphviz code
 ah[?lba-]        ; analysis hints (force opcode size, ...)
 ao[e?] [len]     ; analyze Opcodes (or emulate it)
 ap               ; find and analyze function preludes
 ar[?ld-*]        ; manage refs/xrefs
 as [num]         ; analyze syscall using dbg.reg
 at[trd+-*?] [.]  ; analyze execution Traces
 ax[-cCd] [f] [t] ; manage code/call/data xrefs
Examples:
 f ts @ `S*~text:0[3]`; f t @ section..text
 f ds @ `S*~data:0[3]`; f d @ section..data
 .ad t t+ts @ d:ds

And, more precisely with an af?:

[0x00404890]> af?
Usage: af[?+-l*]
 af @ [addr]               ; Analyze functions (start at addr)
 af+ addr size name [type] [diff] ; Add function
 af- [addr]                ; Clean all function analysis data (or function at addr)
 afb 16                    ; set current function as thumb
 afbb fcnaddr addr size name [type] [diff] ; Add bb to function @ fcnaddr
 afl[*] [fcn name]         ; List functions (addr, size, bbs, name)
 afi [fcn name]            ; Show function(s) information (verbose afl)
 afr name [addr]           ; Rename name for function at address (change flag too)
 afs [addr] [fcnsign]      ; Get/set function signature at current address
 af[aAv][?] [arg]          ; Manipulate args, fastargs and variables in function
 afc @ [addr]              ; Calculate the Cyclomatic Complexity (starting at addr)
 af*                       ; Output radare commands

Then, start a 'functions' analysis beginning at main:

[0x00404890]> af@main

Then, you can run a recursive traversal disassembly:

[0x00404890]> pdr@main
/ (fcn) fcn.004028c0 7460
|           ;-- main:
|           0x004028c0    4157         push r15
|           0x004028c2    4156         push r14
|           0x004028c4    4155         push r13
|           0x004028c6    4154         push r12
|           0x004028c8    55           push rbp
|           0x004028c9    4889f5       mov rbp, rsi
|           0x004028cc    53           push rbx
|           0x004028cd    89fb         mov ebx, edi
|           0x004028cf    4881ec88030. sub rsp, 0x388
|           0x004028d6    488b3e       mov rdi, [rsi]
|           0x004028d9    64488b04252. mov rax, [fs:0x28]
|           0x004028e2    48898424780. mov [rsp+0x378], rax
|           0x004028ea    31c0         xor eax, eax
|           0x004028ec    e8afad0000   call 0x40d6a0 ; (fcn.0040d69f)
|              fcn.0040d69f(unk, unk, unk, unk, unk, unk)
|           0x004028f1    be19694100   mov esi, 0x416919
|           0x004028f6    bf06000000   mov edi, 0x6
|               0x004028fb    e810feffff   call sym.imp.setlocale

... clip ...

--
|           0x00402980    83e801       sub eax, 0x1
|           0x00402983    7405         jz fcn.004038a8
-[true]-> 0x0040298a
-[false]-> 0x00402985
--

You can also start radare2 with the -A option:

-A : run 'aaa' command before prompt or patch to analyze all referenced code

See also http://radare.today/posts/analysis-by-default/