Faster way to iterate all operands and of instructions?

[xrkk]

Current I'm using below Python code to iterate through all operands of all instructions, but in my environment(Intel-i7, WSLv1), it can only reach up to 15 functions in 1 second. Is there any faster way to do this?

# get function list
raw_func_list = rz.cmdj('aflj')

# iterate functions
for raw_func in tqdm(raw_func_list):
    raw_func: dict = raw_func

    # seek to func start
    rz.cmd(f's {raw_func["name"]}')

    # get basic-block list
    bb_list: List[Dict] = rz.cmdj('afbj')

    # iterate basic-blocks
    for bb in bb_list:

        # seek to basic-block start
        rz.cmd(f's {bb["addr"]}')

        # without below code, it can reach up to 27 functions in 1 second

        # get operands info of instructions in basic-block
        bb_opcode_list: List[Dict] = rz.cmdj(f'aoj {bb["ninstr"]}')

        # with ubove code, it can reach up to only 15 functions in 1 second

[ret2libc]

How big is the binary? How many functions are there? How big are the functions? I think there are many questions to ask to optimize this.

Part of the problem might also be due to using rz-pipe, which is for sure not the fastest method to get information because it requires executing commands, generating json, parsing json, etc. Direct binding would be better, though honestly they are not quite ready yet, though we would love them to be used instead of rz-pipe.

[xrkk]

How can Direct binding be accomplished? Like writing an analysis plugin? Any detailed tutorial on this? I only found this one: !(78 Implementing a new disassembly plugin)[https://book.rizin.re/src/plugins/dev-asm.html]

[ret2libc]

You can't. We want to provide good API "wrappers" that you can use to directly access Rizin API from most common languages like python and others, but we are just not there yet and we only have rz-pipe for now. Sorry for that.

Can you check what is the slowest part in your script? Is it aflj? afbj? Something else?

[xrkk]

I'm considering writing Native rizin analysis plugins using C/C++, and export only few interfaces to my xxx framework. Any tutorials on this? Like structure of plugin source code, WHICH API can do WHAT? WHICH API to use if I wanna do SOMETHING?

[ret2libc]

Can you tell us exactly what you want to achieve? I'm not sure I understand it anymore, so I can't help you properly.

To wrap up what I said until now:

1. rz-pipe is essentially like executing commands on rizin and parsing their outputs in a python dictionary (or whatever language you want to use)
2. rz-pipe is for sure slower than directly calling the RZ_API that you can find in the installed headers, under librz/include/, however at this point the only way to use those API is by using C/C++, because we don't have bindings for other languages (e.g. no python bindings so far).
3. we would love to provide better APIs in python and few other languages, but right now we don't have the man power to focus on that, though we would definitely love to going that route instead of keep using rz-pipe as the default method to interact with rizin.