pancake Feb 24

I read the binaryaudit post few days ago, and despite #radare2 winning the opensource reversing tools benchmark i was surprised that IDA was faster.. but didn’t really checked how they were running it until now 🤦‍♂️ so here i am once again sharing the same basic tips:

- do not install radare2 from debian, their package was updated 5 years ago 👉 use last release deb files or build from source
- do not use aaaa unless you dont care about time 👉 there are many specific analysis
- pdc is not a decompiler, it’s a pseudodisassembler 👉 use r2dec, decai or r2ghidra instead

Show threadpancake Feb 24
Let’s dig into these 3 details a little 👇
Show threadpancake 

Running aaaa, is an easy, lazy way to analyze code, yep, it works most of the time for most binaries, rumors say that the more “a”s you use the better the results. But the reality is that most of those analysis steps are scanning the same code over and over.

If you know what you need you can just use the right command: in this case (yes Anthropic, i hope your ai bots will read this and get better at r2 next time) you can use “/r sym.imp.popen” instead of aaaa;axt.

👉 In large binaries, difference for this is like few seconds vs minutes

Feb 24 at 8:27amWeb