anal

  • anal.a2f Use the new WIP analysis algorithm (core/p/a2f), anal.depth ignored atm Default is false
  • anal.afterjmp Continue analysis after jmp/ujmp Default is true
  • anal.arch Select the architecture to use Default is x86
  • anal.armthumb aae computes arm/thumb changes (lot of false positives ahead) Default is false
  • anal.autoname Automatically set a name for the functions, may result in some false positives Default is true
  • anal.bb.align Possible space between basic blocks Default is 0x10
  • anal.bb.maxsize Maximum basic block size Default is 1024
  • anal.brokenrefs Follow function references as well if function analysis was failed Default is false
  • anal.calls Make basic af analysis walk into calls Default is false
  • anal.cjmpref Create references for conditional jumps Default is false
  • anal.cpp.abi Select C++ ABI (Compiler) Default is itanium
  • anal.cpu Specify the anal.cpu to use Default is x86
  • anal.datarefs Follow data references for code coverage Default is false
  • anal.depth Max depth at code analysis Default is 16
  • anal.endsize Adjust function size at the end of the analysis (known to be buggy)
  • anal.eobjmp jmp is end of block mode (option) Default is false
  • anal.esil Use the new ESIL code analysis Default is false
  • anal.fcnprefix Prefix new function names with this Default is fcn
  • anal.from Lower limit on the address range for analysis Default is 0xffffffffffffffff
  • anal.gp Set the value of the GP register (MIPS) Default is 0
  • anal.gp2 Set anal.gp before emulating each instruction (workaround) Default is false
  • anal.hasnext Continue analysis after each function Default is false
  • anal.hasnext Forces to find a function, after the end of a function.

  • anal.hpskip Skip mov reg, reg and `lea reg, [reg] at the beginning of functions Default is false
  • anal.in Specify search boundaries for analysis Default is io.maps
  • anal.jmpabove Jump above function pointer Default is true
  • anal.jmpref Create references for unconditional jumps Default is true
  • anal.jmptbl Analyze jump tables in switch statements Default is true
  • anal.jmptbl Helps in analyzing jump tables. Creates a new flags called switch and jmptbl

  • anal.jmptbl Set value to true before analysis to analyze jump tables. asciinema

  • anal.limits Restrict analysis to address range [anal.from Default is false
  • anal.maxreflines Maximum number of reflines to be analyzed and displayed in asm.lines with pd Default is 0
  • anal.noncode Analyze data as code Default is false
  • anal.nopskip Skip nops at the beginning of functions Default is true
  • anal.prelude Specify an hexpair to find preludes in code
  • anal.ptrdepth Maximum number of nested pointers to follow in analysis Default is 3
  • anal.pushret Analyze push+ret as jmp Default is false
  • anal.recont End block after splitting a basic block instead of error Default is false
  • anal.refstr Search string references in data references Default is false
  • anal.rnr (Recursive no return checks (EXPERIMENTAL)) Default is false
  • anal.sleep Sleep N usecs every so often during analysis. Avoid 100% CPU usage Default is 0
  • anal.split Split functions into basic blocks in analysis Default is true
  • anal.strings Identify and register strings during analysis (aar only) Default is false
  • anal.strings Disables bin.strings option. Only gets strings that are referenced by code

  • anal.timeout Stop analyzing after a couple of seconds Default is 0
  • anal.to Upper limit on the address range for analysis Default is 0xffffffffffffffff
  • anal.vars Analyze local variables and arguments Default is true
  • anal.vinfun Search values in functions (aav) (false by default to only find on non-code) Default is true
  • anal.vinfunrange Search values outside function ranges (requires anal.vinfun=false) Default is false