How can I get the shared libraries' function calls using angr

Question

I am trying to get all the library function calls that a binary performs in a preorder-DFT traversal of the CFG. I'm able to get the CFG like:

import sys, angr
import networkx as nx
proj = angr.Project(sys.argv[1],auto_load_libs=False)
cfg = proj.analyses.CFG().graph

I was able to get the CFG and I can even traverse it like this (Suppose I'm getting the correct main function's node):

s = nx.dfs_preorder_nodes(cfg,mainFuncNode)
nodes = []
try:
    while True:
        nodes.append(ns.next())
except:
    pass

However I don't know how to get the function calls from the nodes (if they are actually doing it). I read some documentation and all I could come up with was:

for n in nodes:
    if n.is_simprocedure:
          print n.to_codenode().function

The output is all None and I'm sure that's wrong because the binary Is doing some I/O operations. So I expect to see something like:

• libc_puts
• libc_gets
• ...

I would appreciate if you could give me some better pointers.

Answer 1

However I don't know how to get the function calls from the nodes

Are you saying you want to know which function a node belongs to, or which function a node is calling?

For the former, each block has a corresponding CFGNode object that are in the graph. Each CFGNode has a .function_address member, which tells you the address of the function that the node belongs to.

For the latter, every edge in the graph is labeled with properties, and we use 'jumpkind' to mark the type of an edge. An Ijk_Call jumpkind means that edge is a call from a block (or a node) to a function.

By the way, angr's CFG class is more than just the .graph member (which is a networkx.DiGraph instance). You might find it easier sometimes to directly work on CFG, instead of manually traversing the graph.

In addition, once a CFG is generated, you can access all functions by accessing CFG.functions. Each Function instance has two intra-function graphs associated with it: a .graph and a .transition_graph. You may find it easier to work with than traversing the CFG of the whole binary.

In the end, if you like GUI, and you have a lot of patience, you might want to give angr Management a try.