Nice documentation of the binary analysis tool "angr", to analyse system calls in statically linked binary and hence possibly draw a system call graph

Question

I am a new master's student in CS. I am into the computer systems domain. I was just thinking of analyzing a statically linked binary to get a sort of database of system calls made in the binary and then accordingly, use that database to draw a system call graph out of it. It is part of our master's project. So, I do not want any spoilers or even the slightest code snippet, which I could copy into my work. I want to do the work entirely on my own from scratch. Otherwise, I do not feel satisfied and feel that I have not learned anything.

So, can anyone give me suitable pointers to documentation, tutorial, or even YouTube videos, which would help me to get familiarized with "angr", the relevant sections required for the kind of work which I want to do?

The tutorials or video lectures that I have seen so far deal with only CTF tutorials or symbolic execution. I could not find any research paper or textbook that explains the kind of work which I aim to do using "angr".

Can anyone just guide me with the required resources? I just need the guidance to know the power of "angr" and what it can possibly support, for the kind of work that I plan to achieve through it.

Answer 1

Here are things you could possibly be asking for:

1. A mapping of which system calls are made by each function in your binary
2. A complete crossreference (xref) graph of the dependencies in your binary
3. A combination of 1) and 2) - a graph of crossreferences that show every function whose calls eventually lead to a system call

though you could also be asking for something else I've misunderstood. I'm assuming you're asking for 3).

One way to construct what you are asking for is to use the angr database of functions, as detailed in the angr CFG documentation. You could construct the cross-references by taking the angr "function manager" object and, for each function and each basic block use the get_call_target(callsite_addr) function to figure out the the function's sub-calls. This would give you a feed-forward call graph.

Restricting the feed-forward call graph to just things that feed into system calls depends upon how system calls are implemented on your architecture. On x86, for instance, system calls are performed using the int 80 instruction so you'd have to scan each function for that. This Stack Exchange thread has a more complete answer to what constitutes a system call on each architecture.