Data and Code Analysis

Radare2 has a very rich set of commands and configuration options to perform data and code analysis, to extract useful information from a binary, like pointers, string references, basic blocks, opcode data, jump targets, cross references and much more. These operations are handled by the a (analyze) command family:

  1. |Usage: a[abdefFghoprxstc] [...]
  2. | aa[?]              analyze all (fcns + bbs) (aa0 to avoid sub renaming)
  3. | a8 [hexpairs]      analyze bytes
  4. | ab[b] [addr]       analyze block at given address
  5. | abb [len]          analyze N basic blocks in [len] (section.size by default)
  6. | abt [addr]         find paths in the bb function graph from current offset to given address
  7. | ac [cycles]        analyze which op could be executed in [cycles]
  8. | ad[?]              analyze data trampoline (wip)
  9. | ad [from] [to]     analyze data pointers to (from-to)
  10. | ae[?] [expr]       analyze opcode eval expression (see ao)
  11. | af[?]              analyze Functions
  12. | aF                 same as above, but using anal.depth=1
  13. | ag[?] [options]    draw graphs in various formats
  14. | ah[?]              analysis hints (force opcode size, ...)
  15. | ai [addr]          address information (show perms, stack, heap, ...)
  16. | an [name] [@addr]  show/rename/create whatever flag/function is used at addr
  17. | ao[?] [len]        analyze Opcodes (or emulate it)
  18. | aO[?] [len]        Analyze N instructions in M bytes
  19. | ap                 find prelude for current offset
  20. | ar[?]              like 'dr' but for the esil vm. (registers)
  21. | as[?] [num]        analyze syscall using dbg.reg
  22. | av[?] [.]          show vtables
  23. | ax[?]              manage refs/xrefs (see also afx?)

In fact, a namespace is one of the biggest in radare2 tool and allows to control very different parts of the analysis:

  • Code flow analysis
  • Data references analysis
  • Using loaded symbols
  • Managing different type of graphs, like CFG and call graph
  • Manage variables
  • Manage types
  • Emulation using ESIL VM
  • Opcode introspection
  • Objects information, like virtual tables