6

Can anyone suggest a free and preferably open source software tool that can reconstruct / build / generate a control-flow graph from a set of x86 execution traces of the same program?

I found an interesting paper on this topic. However, I could not find their implementation.

Any suggestions would be appreciated. Thanks!

  • Not a duplicate, but related: Generating call graph for assembly instructions – Jason Geffner Jul 16 '15 at 15:25
  • Hi, could you update the link? The reference is dead. – lllllllllllll May 2 '16 at 14:19
  • @computereasy Both links work for me – Benny May 3 '16 at 13:50
  • Can I ask what kind of tool you used for tracing x86 instruction. I am looking for a tool that can capture the instruction as well as the memory changes of a running program. Thank you so much. – Nora Huang May 16 '17 at 16:53
  • @NoraHuang did you try Intel PIN? – Benny May 16 '17 at 18:38
2

I am sorry for this self-advertisement, but I am developing a tool here. My final goal is to recover the original control flow graph of virtualized binaries. But at a step of this, for visualization purpose, I have implemented a functionality to reconstruct the CFG of binaries from traces. The main implementation of this reconstrution is in the file src/lib/cap/graph.cpp, it has no problem in performance in constructing the basic block graph from traces of about 100K instructions (I have tested on obfuscated binaries whose traces are about 300K instructions). You can see several pdf files in the folders demo and results, I have generated them from execution traces.

If you are interested in, I am more than happy to answer any further question.

  • Thanks for your answer. Your project seems very interesting and I would like to build and play with it. However, I have some issues with libprotobuf. Which version does your project need? The version that comes with Ubuntu 14.04 doesn't seem to be compatible. – Benny Jul 17 '15 at 22:11
  • Thanks a lot for your interest, Benny. I appreciate it very much. In fact you do not need protobuf to build the code. The protobuf is used for the communication between the instrumentation tool (Pin) and the concolic execution engine, but the engine is not fully published because it is not flexible enough and its performance is quite bad now. So I have changed the CMake file so that it can be built without protobuf, which errors do you get in building this code? – Ta Thanh Dinh Jul 18 '15 at 10:08
  • I will write a simple document to explain how to use it because there are some obscure technical details. But if you have any question, do not hestitate to ask me. – Ta Thanh Dinh Jul 18 '15 at 10:09
  • I am very sorry Benny. Unfortunately, I have to close the projet since the discussion this morning with my collegues. I think this is not an issue about the confidentiality, but it is just not a suitable moment to publish the tool. – Ta Thanh Dinh Jul 18 '15 at 15:48
  • No problem, please keep me posted when you decide to release the project again. Thanks! – Benny Jul 19 '15 at 10:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.