Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [control-flow-graph]

A control flow graph (CFG) is a representation, using graph notation, of all paths that might be traversed through a program during its execution. The control flow graph is due to Frances E. Allen, who notes that Reese T. Prosser used boolean connectivity matrices for flow analysis before.

2
votes
0answers
238 views

Ghidra Control Flow Graph

Lately I'm using Ghidra and I don't find the API to get the control flow graph of a given function. Can someone help me? Thank you in advance. EDIT: it is different from the other question (link) ...
0
votes
2answers
256 views

Basic Blocks and Data Flow Analysis

I am looking to do some Data Flow Analysis via code. I have already the code that parses a binary and disassembles it (x86/x64) and creates Basic Blocks. Now what I would like to do is, for any Basic ...
3
votes
0answers
57 views

Recognizing instructions containing low-level control flows

There are some x86 instructions which containing a low-level** control flow in its semantics, for example div because its semantics is roughly as: if (source == 0) throw exception... else ...
3
votes
2answers
102 views

IDA function never called and only cross-referenced as data

When I press the X key (list x-refs) on a function (sub_xyz) to see which functions call it, I only saw dd offset sub_xyz twice, with no call sub_xyz instructions. There is no another place that ...
3
votes
1answer
271 views

Counting number of nodes and edges in IDA Pro graph

Is it possible to obtain a node and edge count for the IDA Pro graph overview? I'm able to obtain this if I generate a wingraph32 flowchart, but it seems that wingraph32 doesn't work for very large ...
4
votes
1answer
501 views

How to deal with heavy control flow flattening?

I am trying to reverse engineer an executable that uses a lot of control flow flattening obfuscation (i.e, lots of subroutines that end with something like jmp esi, jmp eax) IDA Pro isn't able to ...
1
vote
1answer
295 views

Is it possible to completely reset a cached graph layout for a function in IDA Pro?

I'm reversing a binary dump of an older embedded target using IDA Pro 7.0. Now I have somehow managed to introduce a "pseudo graph node" that I for the love of god cannot make go away. The ...
5
votes
1answer
341 views

How can I get the shared libraries' function calls using angr

I am trying to get all the library function calls that a binary performs in a preorder-DFT traversal of the CFG. I'm able to get the CFG like: import sys, angr import networkx as nx proj = angr....
0
votes
2answers
501 views

IDA Pro Graph question

I was wondering if anyone could help me and explain how I should process a graph that looks like this in IDA Pro, where the right most node is the entrypoint, and it contains several of these small ...
8
votes
3answers
2k views

Control flow graph reconstruction projects

I'm looking for projects providing reconstructed Control Flow Graphs from binaries while supporting more than one platform (e.g. x86, x64, arm). For example, considering this short assembler program: ...
3
votes
1answer
285 views

Can a basic-block have more than 2 outgoing edges?

For the ease of analysis (i.e., static analysis), I am planning to convert a control-flow graph, of a function, into a spanning tree by removing the backward edges. I wonder whether this spanning tree ...
8
votes
1answer
1k views

Retrieving Objective-C Control Flow?

I am learning to disassemble and analyze objective-c binaries. One of my frustrations is that in Hopper, and IDA, it seems that the proper cross-references and control flow are not preserved. I ...
6
votes
2answers
4k views

How to generate CFG from assembly instructions?

I want to know is there any tools to use assembly file and convert it to an intermediate language such as RREIL and then generate control flow graph from the intermediate language ? This is the ...
0
votes
1answer
3k views

Red addresses in IDA Pro

I know that red addresses means, that code do not recognize as a function in IDA, because that code never get called. But I have found a piece of code that is marked red, but when debugging, I saw ...
6
votes
1answer
1k views

Reconstruct control-flow graph from x86 instruction trace

Can anyone suggest a free and preferably open source software tool that can reconstruct / build / generate a control-flow graph from a set of x86 execution traces of the same program? I found an ...