6

Can anyone suggest a free and preferably open source software tool that can reconstruct / build / generate a control-flow graph from a set of x86 execution traces of the same program?

I found an interesting paper on this topic. However, I could not find their implementation.

Any suggestions would be appreciated. Thanks!

Improve this question
5
  • Not a duplicate, but related: Generating call graph for assembly instructions
    – Jason Geffner
    Jul 16, 2015 at 15:25
  • Hi, could you update the link? The reference is dead.
    – lllllllllllll
    May 2, 2016 at 14:19
  • @computereasy Both links work for me
    – Benny
    May 3, 2016 at 13:50
  • Can I ask what kind of tool you used for tracing x86 instruction. I am looking for a tool that can capture the instruction as well as the memory changes of a running program. Thank you so much.
    – Nora Huang
    May 16, 2017 at 16:53
  • @NoraHuang did you try Intel PIN?
    – Benny
    May 16, 2017 at 18:38

1 Answer 1

Reset to default
2

I am sorry for this self-advertisement, but I am developing a tool here. My final goal is to recover the original control flow graph of virtualized binaries. But at a step of this, for visualization purpose, I have implemented a functionality to reconstruct the CFG of binaries from traces. The main implementation of this reconstrution is in the file src/lib/cap/graph.cpp, it has no problem in performance in constructing the basic block graph from traces of about 100K instructions (I have tested on obfuscated binaries whose traces are about 300K instructions). You can see several pdf files in the folders demo and results, I have generated them from execution traces.

If you are interested in, I am more than happy to answer any further question.

Improve this answer
5
  • Thanks for your answer. Your project seems very interesting and I would like to build and play with it. However, I have some issues with libprotobuf. Which version does your project need? The version that comes with Ubuntu 14.04 doesn't seem to be compatible.
    – Benny
    Jul 17, 2015 at 22:11
  • Thanks a lot for your interest, Benny. I appreciate it very much. In fact you do not need protobuf to build the code. The protobuf is used for the communication between the instrumentation tool (Pin) and the concolic execution engine, but the engine is not fully published because it is not flexible enough and its performance is quite bad now. So I have changed the CMake file so that it can be built without protobuf, which errors do you get in building this code?
    – Ta Thanh Dinh
    Jul 18, 2015 at 10:08
  • I will write a simple document to explain how to use it because there are some obscure technical details. But if you have any question, do not hestitate to ask me.
    – Ta Thanh Dinh
    Jul 18, 2015 at 10:09
  • I am very sorry Benny. Unfortunately, I have to close the projet since the discussion this morning with my collegues. I think this is not an issue about the confidentiality, but it is just not a suitable moment to publish the tool.
    – Ta Thanh Dinh
    Jul 18, 2015 at 15:48
  • No problem, please keep me posted when you decide to release the project again. Thanks!
    – Benny
    Jul 19, 2015 at 10:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.