You might want to give angrangr a try.
- Load the binary. Suppose
p
is the angr Project instance. - Generate a CFG:
cfg = p.analyses.CFG(show_progressbar=True)
. - Access/traverse the call graph (which is a networkx.DiGraph) in whatever way you want:
cfg.functions.callgraph
.
For example showing the call graph only of specific address range or specific static library
You can limit the range of CFG generation by passing the regions
argument to CFG()
.