11

There's a piece of software, for which I only have the binary, not the source code. It's:

  • unobfuscated (so, not polymorphic or anything. It is optimized a bit, though)
  • unstripped
  • x86 32 bit
  • trustworthy (not suspected malware)
  • compiled from C++ (based on contents of symbol table)
  • probably uses JNI (a couple reasons; partly because it has a fair number of its strings in UTF-16)

I don't need the full call graph, just the call graph / control flow when given certain arguments. The only reverse engineering I've done has been relatively basic stuff with binutils + gdb + strace. Essentially, I just need a piece of software to match up 'call' and 'ret' pairs, and translate 'call' instruction destinations to their human-readable symbol names. Hopefully generate a readable 2D graph image to give me a feel for app execution.

So, something to map control flow. It is just a single binary (with some dynamic library dependencies), but it's large enough that manual traces would be prohibitively labor-intensive.

EDIT: I don't want to have to pay for anything or run windows to do this. If at all possible, I'd like to be able to run something natively on Linux.

4 Answers 4

9

Radare2 is also able to collect the callgraph of a program based on its binary only.

Some time ago, I asked this question which is somehow related to yours and one of the author of Radare2 answered:

Yet, if you want a graphical representation of the callgraph here is the way to do:

$> radare2 /usr/bin/md5sum
... start of radare2 ...
[0x00402427]> aa
[0x00402427]> afl
[0x00402427]> ag > b.dot
[0x00402427]> !xdot b.dot

The aa command collect information about the analyzed binary. Then, the afl command collect information about all the function call sites (addr, size, bbs, name). Finally, the ag command output the graphviz representation of the collected data. Note that we dumped the data in the file b.dot, I used the xdot software from the Radare2 prompt but it can be done outside of the Radare2 shell (of course).

I found this way of doing in a talk given at Auckland in 2015 by Andrew McDonnell (slides 26-27).

5

All (caller, callee)-tuples except for direct recursion and duplicates:

objdump -d $BINARY_FILENAME \
| grep '<' \
| sed -e 's/^[^<]*//' \
| sed 's/<\([^+]*\)[^>]*>/\1/' \
| awk 'BEGIN { FS = ":" } \
       NF>1 { w=$1; } \
       NF==1 && w != $1 { print "(\"" w "\", \"" $0 "\")," }' \
| sort -u
4

You can use IDA Pro to generate call graphs:

Call graph
(source: hex-rays.com)

3
  • I'd always thought of IDA as Windows-specific. Learn something new every day... edit: I'll leave my upvote, because I didn't specify "free" but the free version of IDA is an exe. Jun 10, 2015 at 21:12
  • According to WineHQ, IDA's graph view works just fine in the free version of IDA 5.0 when run on Wine. Jun 10, 2015 at 21:58
  • Good point. Testing it now. :) Jun 10, 2015 at 22:39
1

You can use Ghidra to generate call graphs for various binaries, including x86 Linux ELF binaries.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.