Questions tagged [control-flow-graph]
A control flow graph (CFG) is a representation, using graph notation, of all paths that might be traversed through a program during its execution. The control flow graph is due to Frances E. Allen, who notes that Reese T. Prosser used boolean connectivity matrices for flow analysis before.
22 questions
2
votes
0
answers
75
views
Javascript: Compare Control Flow (to evade anti-debug and anti-tamper traps)
When reverse engineering obfuscated javascript, it may be protected by anti-tamper mechanisms.
I have a script which will work when run untouched, but cause a fatal javascript error when run in node ...
- 143
1
vote
0
answers
189
views
I need to make a dominance tree using Ghidra headless
I need to make a dominator tree where I need to tell a function(a) dominates function(b). There is an API in GraphAlgorithms which needs GDirected graph and "vertex from" parameters, but I ...
- 11
5
votes
2
answers
1k
views
Fixing/recompiling a heavily control flow obfuscated function
I've recently come across a binary that has been obfuscated with a very obscure protection.
Obfuscation
From what I understand, the obfuscator is effective in several ways.
Multiple JMPs via relative ...
user29468
1
vote
0
answers
475
views
In which program do I reverse engineer UEFI firmwares
I came into a problem, where I am unable to use a hardware due to a firmware incompatibility. As I have multiple sources and proofs that the hardware is indeed supported on the hardware level, and it ...
- 11
1
vote
0
answers
49
views
Which instruction at which address calls the address 0x1a95 or the address 0x204a in the following program or rather smart contract?
The Ethereum Virtual Machine uses a Virtual Instruction Set flavored for transaction processing that doesn’t use any registers and where all opcodes are a single byte long and have a single ABI for ...
- 143
3
votes
2
answers
2k
views
Save Ghidra's control flow graph into a parsable format
I'm working on reverse engineering a firmware which I was able to get its functions control flow graphs to display successfully on Ghidra. I am trying to see if there is a way to save those control ...
- 51
7
votes
1
answer
11k
views
Ghidra Control Flow Graph
Lately I'm using Ghidra and I don't find the API to get the control flow graph of a given function. Can someone help me?
Thank you in advance.
EDIT: it is different from the other question (link) ...
- 73
1
vote
2
answers
2k
views
Basic Blocks and Data Flow Analysis
I am looking to do some Data Flow Analysis via code. I have already the code that parses a binary and disassembles it (x86/x64) and creates Basic Blocks.
Now what I would like to do is, for any Basic ...
- 319
3
votes
0
answers
78
views
Recognizing instructions containing low-level control flows
There are some x86 instructions which containing a low-level** control flow in its semantics, for example div because its semantics is roughly as:
if (source == 0)
throw exception...
else
...
- 1,410
4
votes
2
answers
1k
views
IDA function never called and only cross-referenced as data
When I press the X key (list x-refs) on a function (sub_xyz) to see which functions call it, I only saw dd offset sub_xyz twice, with no call sub_xyz instructions.
There is no another place that ...
- 533
3
votes
1
answer
955
views
Counting number of nodes and edges in IDA Pro graph
Is it possible to obtain a node and edge count for the IDA Pro graph overview? I'm able to obtain this if I generate a wingraph32 flowchart, but it seems that wingraph32 doesn't work for very large ...
- 359
3
votes
1
answer
2k
views
How to deal with heavy control flow flattening?
I am trying to reverse engineer an executable that uses a lot of control flow flattening obfuscation (i.e, lots of subroutines that end with something like jmp esi, jmp eax) IDA Pro isn't able to ...
- 263
2
votes
2
answers
2k
views
Is it possible to completely reset a cached graph layout for a function in IDA Pro?
I'm reversing a binary dump of an older embedded target using IDA Pro 7.0.
Now I have somehow managed to introduce a "pseudo graph node" that I for the love of god cannot make go away.
The ...
- 41
6
votes
1
answer
2k
views
How can I get the shared libraries' function calls using angr
I am trying to get all the library function calls that a binary performs in a preorder-DFT traversal of the CFG. I'm able to get the CFG like:
import sys, angr
import networkx as nx
proj = angr....
- 63
0
votes
2
answers
907
views
IDA Pro Graph question
I was wondering if anyone could help me and explain how I should process a graph that looks like this in IDA Pro, where the right most node is the entrypoint, and it contains several of these small ...
- 355
8
votes
1
answer
4k
views
radare2 ascii graph to image?
After analysing a function and pressing VV to go into graph mode, is it somehow possible to export/render the whole graph to an image?
I have some huge main functions and it would be nice to have it ...
- 183
10
votes
4
answers
4k
views
Control flow graph reconstruction projects
I'm looking for projects providing reconstructed Control Flow Graphs from binaries while supporting more than one platform (e.g. x86, x64, arm). For example, considering this short assembler program:
...
- 2,906
3
votes
1
answer
351
views
Can a basic-block have more than 2 outgoing edges?
For the ease of analysis (i.e., static analysis), I am planning to convert a control-flow graph, of a function, into a spanning tree by removing the backward edges. I wonder whether this spanning tree ...
- 195
8
votes
1
answer
2k
views
Retrieving Objective-C Control Flow?
I am learning to disassemble and analyze objective-c binaries. One of my frustrations is that in Hopper, and IDA, it seems that the proper cross-references and control flow are not preserved. I ...
- 1,258
6
votes
2
answers
7k
views
How to generate CFG from assembly instructions?
I want to know is there any tools to use assembly file and convert it to an intermediate language such as RREIL and then generate control flow graph from the intermediate language ?
This is the ...
- 101
0
votes
1
answer
5k
views
Red addresses in IDA Pro
I know that red addresses means, that code do not recognize as a function in IDA, because that code never get called.
But I have found a piece of code that is marked red, but when debugging, I saw ...
- 187
6
votes
1
answer
2k
views
Reconstruct control-flow graph from x86 instruction trace
Can anyone suggest a free and preferably open source software tool that can reconstruct / build / generate a control-flow graph from a set of x86 execution traces of the same program?
I found an ...
- 828