2

I need to generate call graph for two DLL's and compare it using IDApython and it must be executed automatically in command line.

How to generate and save call graph and immediately open next DLL and generate and save callgraph and then compare?

2

As @tmr232 says, you can use Diaphora which does it automatically for you. Otherwise, if you prefer a command line tool (which, BTW, doesn't require IDA), you can use Pyew and the gcluster.py script.

If you prefer to write something yourself, please remember that comparing 2 binaries is not a trivial task. That said, I will explain how the comparison of the call graphs of 2 binaries works in both gcluster.py and Diaphora:

  1. First, a binary is loaded in a tool and code analysed. The tool can be Pyew (gcluster) or IDA (Diaphora).
  2. The code analysis step gathers information relative to functions, the call graph and flow graphs (basic blocks of each function and their relationships as well as function's relationships).
  3. Using that information, I calculate the cyclomatic complexity of each function that has more than 1 basic block.
  4. Using Gödel numbering I assign a prime number corresponding to each cyclomatic complexity (that's it, for each function).
  5. Then, with all these prime numbers corresponding to all functions, I multiply them to have a large number "hash". This step is what the inventors, Halvar Flake and @rolfrolles, call "Small Primes Product" in their "Graph-based comparison of Executable Objects" paper.
  6. The result of the multiplication is the program's call graph signature.
  7. If the call graph signature is equal for 2 binaries, the call graph is very likely the same for both binaries. I say "very likely" because small functions are ignored and, also, using the cyclomatic complexity of a function as a fuzzy identifier is, fuzzy: 2 totally different functions can have the same cyclomatic complexity. In any case, the call graph signature is more than good enough in most cases (I'm yet to see a case were it isn't).
  8. If the call graph signature is different, factor the primes (which you already have calculated), remove these in both sets (i.e., in both binaries) and calculate the % of difference with the remaining primes (which correspond to functions) in both binaries.

Another way of comparing call graphs is doing it by traversing both graphs and calculating the differences between 2 graphs (considering that you have some way to determine that a function F in binary A is equal to function F' in binary B, something that is not trivial). I don't recommend you doing so unless solving how to do so is your problem/what you want to do.

My 2 cents.

| improve this answer | |
0

This is very broad question, which consists from some simpler ones.

How to operate IDA from command line ?

According to this link you can invoke IDA from the command line with -S switch to run specific script after auto-analysis is complete. You can create shell script to run multiple ida instances from the command line.

How to generate function graph and save it?

#not tested, beware of errors, use on your own risk
# if you find GDL format problematic you can use ODT format
# by replacing idaapi.CHART_GEN_GDL to idaapi.CHART_GEN_ODT
import idaapi
import idc 
import idautils

for ea in idautils.Functions():
    idc.GenFuncGdl("%s.gdl" % idc.GetFunctionName(ea), idc.GetFunctionName(ea), ea , idc.BADADDR, idaapi.CHART_GEN_GDL)

How to generate the whole call graph ?

It is simple:

idc.GenCallGdl("z:\\callgdl.gdl", "TheTitle", CHART_GEN_GDL)

Note the possibility to use CHART_WINGRAPH and CHART_NOLIBFUNCS as flags.

If you want to use functions from idaapimodule instead, look at idaapi.gen_simple_call_chart and idaapi.gen_complex_call_chartdocumentation here.

How to compare call graphs ?

It depends what exactly you are trying to get from the comparison.

Hope it helps.

| improve this answer | |
  • Gives error on running script : " can't open file ??3@YAXPAX.gdl for writing" and not generating graph – user3264821 Jun 2 '16 at 8:52
  • thank you its not giving errors now but no output or graph file generated ? – user3264821 Jun 3 '16 at 5:27
  • Search for the generated files, they are generated in ida current directory. If you'll replace "%s.gdl" to ""c:\\your_folder\\%s.gdl" it will generate files in "c:\your_folder\. – w s Jun 3 '16 at 9:41
  • Its generating wingraph for each function but i want one callgraph or function call flow for entire dll file to compare with another dll file – user3264821 Jun 6 '16 at 6:31
  • For this you can use idc.GenCallGdl(outfile, title, flags). I updated the answer. – w s Jun 6 '16 at 10:38

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.