aa[?] analyze all (fcns + bbs) (aa0 to avoid sub renaming)

  • aa alias for 'af@@ sym.*;af@entry0;afva'
    • aa analyze all public symbols. The aa command analyzes all flags starting with sym. (symbols/function names) and entry0 (i.e. _start, the program’s entry point)

  • aa* analyze all flags starting with sym. (af @@ sym.*)
  • aaa[?] autoname functions after aa (see afna)
  • aab aab across io.sections.text
  • aab Looks for executable sections and looks for calls. when it finds a call, it looks for the destination of the call. Splits up basic blocks, and tries to remove all the false positives

  • aac [len] analyze function calls (af @@ `pi len~call[1]` ) Identify functions by following calls
    • aac analyze all call destinations as functions

  • aaci ?
  • aac* [len] flag function calls without performing a complete analysis
  • aad [len] analyze data references to code
  • aae [len] ([addr]) analyze references with ESIL (optionally to address) Emulate code to identify new pointer references
  • aae Analyzes executable sections but using emulation. Useful for calls that are using registers instead of hardcoded destinations

  • aaf analyze all functions (e anal.hasnext=1;afr @@c:isq)
  • aaE run aef on all functions (same as aef @@f)
  • aai[j] show info of all analysis parameters
  • aan autoname functions that either start with fcn. or sym.func.
  • aang recover function names from stripped golang binaries
  • aap find and analyze function preludes aar[?] [len] analyze len bytes of instructions for references
  • aas [len] analyze symbols (af @@= `isq~[0]` )
    • aas Use binary header information to find public functions

  • aat [len] analyze all consecutive functions in section. Assume functions are consecutive
  • aaT [len] analyze code after trap-sleds
  • aau [len] list mem areas (larger than len bytes) not covered by functions
  • aav [sat] find values referencing a specific section or map
  • aav Looks for values in the text section that are pointing to the text section. Shows hardcoded pointers in program memory.