I am trying to generate a coarse-grained Call Graph based on some assembly code disassembled from binary on x86 32 bit platform.
It is very hard to generate a precise Call Graph based on asm code, thinking of various indirect control flow transfer, so right now I only consider direct control flow transfer.
So firstly I am trying to identify functions
(begin and end addresses) in the disassembled assembly code
from a stripped binary on x86, 32bit.
Right now, my plan is somehow like this:
As for the begin addresses, I might conservatively consider any assembly code looks like this
push %ebp
indicates the beginning address of a function.
and also, I might scan the whole problem, identifying all the call
instruction with the destination, the consider these function call's destinations as all the function begin address
The problems are:
some of the functions defined in a binary might never be called.
some of the
call
has been optimised asjump
by compiler (thinking of tail recursive call)
As for the end address, things become more tricky because multiple ret
could exist in one single function...
So I am thinking that I might conservatively consider the range between any nearest function begin addresses, as one function..
Am I right? Is there any better solution..?