I am a new master's student in CS. I am into the computer systems domain. I was just thinking of analyzing a statically linked binary to get a sort of database of system calls made in the binary and then accordingly, use that database to draw a system call graph out of it. It is part of our master's project. So, I do not want any spoilers or even the slightest code snippet, which I could copy into my work. I want to do the work entirely on my own from scratch. Otherwise, I do not feel satisfied and feel that I have not learned anything.

So, can anyone give me suitable pointers to documentation, tutorial, or even YouTube videos, which would help me to get familiarized with "angr", the relevant sections required for the kind of work which I want to do?

The tutorials or video lectures that I have seen so far deal with only CTF tutorials or symbolic execution. I could not find any research paper or textbook that explains the kind of work which I aim to do using "angr".

Can anyone just guide me with the required resources? I just need the guidance to know the power of "angr" and what it can possibly support, for the kind of work that I plan to achieve through it.

  • 3
    Tools like strace can log system calls made by an executable. Some judicious grep/sed could provide output for each call that could be dropped into a database. From there you could potentially perform queries and generate graphs from the results. If you're decided on using angr, then I'd start reading the docs: docs.angr.io Sep 5, 2022 at 6:44

1 Answer 1


Here are things you could possibly be asking for:

  1. A mapping of which system calls are made by each function in your binary
  2. A complete crossreference (xref) graph of the dependencies in your binary
  3. A combination of 1) and 2) - a graph of crossreferences that show every function whose calls eventually lead to a system call

though you could also be asking for something else I've misunderstood. I'm assuming you're asking for 3).

One way to construct what you are asking for is to use the angr database of functions, as detailed in the angr CFG documentation. You could construct the cross-references by taking the angr "function manager" object and, for each function and each basic block use the get_call_target(callsite_addr) function to figure out the the function's sub-calls. This would give you a feed-forward call graph.

Restricting the feed-forward call graph to just things that feed into system calls depends upon how system calls are implemented on your architecture. On x86, for instance, system calls are performed using the int 80 instruction so you'd have to scan each function for that. This Stack Exchange thread has a more complete answer to what constitutes a system call on each architecture.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.