Return to Answer

$ r2 /bin/ls
 -- We fix bugs while you sleep.
[0x004049a0]> aaa
[x] Analyze all flags starting with sym. and entry0 (aa)
[x] Analyze len bytes of instructions for references (aar)
[x] Analyze function calls (aac)
[x] Use -AA or aaaa to perform additional experimental analysis.
[x] Constructing a function name for fcn.* and sym.func.* functions (aan)

[0x00000000]> ag?
|Usage: ag[?f]Graphviz/graph code
| ag [addr]             output graphviz code (bb at addr and children)
| ag-                   Reset the current ASCII art graph (see agn, age, agg?)
| aga [addr]            idem, but only addresses
| agc[j] [addr]         output graphviz call graph of function
| agC[j]                Same as agc -1. full program callgraph
| agd [fcn name]        output graphviz code of diffed function
| age[?] title1 title2  Add an edge to the current graph
| agf [addr]            Show ASCII art graph of given function
... <truncated> ...
| agv                   Show function graph in web/png (see graph.web and cmd.graph) or agf for asciiart

You're searching for the agC command which will output a full call-graph of the program.

[0x004049a0]> agC > output.dot

$ r2 /bin/ls
[0x004049a0]> aa
[x] Analyze all flags starting with sym. and entry0 (aa)
[0x004049a0]> agC > output.dot
[0x004049a0]> !!dot -Tpng -o callgraph.png output.dot

$ r2 /bin/ls
[0x004049a0]> aaa
[x] Analyze all flags starting with sym. and entry0 (aa)
[x] Analyze function calls (aac)
[x] Analyze len bytes of instructions for references (aar)
[x] Constructing a function name for fcn.* and sym.func.* functions (aan)
[x] Type matching analysis for all functions (afta)
[x] Use -AA or aaaa to perform additional experimental analysis.

[0x00000000]> ag?
Usage: ag<graphtype><format> [addr]
Graph commands:
| aga[format]             Data references graph
| agA[format]             Global data references graph
| agc[format]             Function callgraph
| agC[format]             Global callgraph
| agd[format] [fcn addr]  Diff graph
| agf[format]             Basic blocks function graph
| agi[format]             Imports graph
| agr[format]             References graph
| agR[format]             Global references graph
| agx[format]             Cross references graph
| agg[format]             Custom graph
| ag-                     Clear the custom graph
| agn[?] title body       Add a node to the custom graph
| age[?] title1 title2    Add an edge to the custom graph 

Output formats:
| <blank>                 Ascii art
| *                       r2 commands
| d                       Graphviz dot
... <truncated> ...
| w [path]                Write to path or display graph image (see graph.gv.format and graph.web)

You're searching for the agCd command. The C specifies to output a full ("global") call-graph of the program. The d specifies to output in Graphviz dot format.

[0x004049a0]> agCd > output.dot

$ r2 /bin/ls
[0x004049a0]> aa
[x] Analyze all flags starting with sym. and entry0 (aa)
[0x004049a0]> agCd > output.dot
[0x004049a0]> !!dot -Tpng -o callgraph.png output.dot

You can use radare2 to generate a full call-graph in dot format.

Installation

• gen-callgraph - gen-callgraph is a script to generate call graph from elf binary

• IDA Pro - generate GDL call graph, save it and then convert it to dot file using graph-easy. The free version of IDA is also capable of generate GDL of call graph but it only available as exe, use wine on Linux to run it.

You can use radare2 or one of the alternatives below to generate a full call-graph in dot format.

radare2 Installation

• gen-callgraph - gen-callgraph is a script to generate call graph from elf binary

• IDA Pro - generate GDL (Graph Description File) call graph using CTRL+F12, save it and then convert it to dot file with one of the following options:

  • graph-easy - Convert between graph formats

  • This perl script from Multimedia Wiki

The free version of IDA is also capable of generate GDL of call graph but it is only available as exe, use wine on Linux to run it

Alternatives

• gen-callgraph - gen-callgraph is a script to generate call graph from elf binary

• IDA Pro - generate GDL call graph, save it and then convert it to dot file using graph-easy. The free version of IDA is also capable of generate GDL of call graph but it only available as exe, use wine on Linux to run it.