How can I generate a call graph from an unstripped x86 Linux ELF?

Question

There's a piece of software, for which I only have the binary, not the source code. It's:

• unobfuscated (so, not polymorphic or anything. It is optimized a bit, though)
• unstripped
• x86 32 bit
• trustworthy (not suspected malware)
• compiled from C++ (based on contents of symbol table)
• probably uses JNI (a couple reasons; partly because it has a fair number of its strings in UTF-16)

I don't need the full call graph, just the call graph / control flow when given certain arguments. The only reverse engineering I've done has been relatively basic stuff with binutils + gdb + strace. Essentially, I just need a piece of software to match up 'call' and 'ret' pairs, and translate 'call' instruction destinations to their human-readable symbol names. Hopefully generate a readable 2D graph image to give me a feel for app execution.

So, something to map control flow. It is just a single binary (with some dynamic library dependencies), but it's large enough that manual traces would be prohibitively labor-intensive.

EDIT: I don't want to have to pay for anything or run windows to do this. If at all possible, I'd like to be able to run something natively on Linux.

Answer 1

Radare2 is also able to collect the callgraph of a program based on its binary only.

Some time ago, I asked this question which is somehow related to yours and one of the author of Radare2 answered:

• Recursive traversal disassembling with Radare2?

Yet, if you want a graphical representation of the callgraph here is the way to do:

$> radare2 /usr/bin/md5sum
... start of radare2 ...
[0x00402427]> aa
[0x00402427]> afl
[0x00402427]> ag > b.dot
[0x00402427]> !xdot b.dot

The aa command collect information about the analyzed binary. Then, the afl command collect information about all the function call sites (addr, size, bbs, name). Finally, the ag command output the graphviz representation of the collected data. Note that we dumped the data in the file b.dot, I used the xdot software from the Radare2 prompt but it can be done outside of the Radare2 shell (of course).

I found this way of doing in a talk given at Auckland in 2015 by Andrew McDonnell (slides 26-27).

Answer 2

All (caller, callee)-tuples except for direct recursion and duplicates:

objdump -d $BINARY_FILENAME \
| grep '<' \
| sed -e 's/^[^<]*//' \
| sed 's/<\([^+]*\)[^>]*>/\1/' \
| awk 'BEGIN { FS = ":" } \
       NF>1 { w=$1; } \
       NF==1 && w != $1 { print "(\"" w "\", \"" $0 "\")," }' \
| sort -u

Answer 3

You can use IDA Pro to generate call graphs:

_{(source: hex-rays.com)}

Answer 4

You can use Ghidra to generate call graphs for various binaries, including x86 Linux ELF binaries.