Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [control-flow-graph]

A control flow graph (CFG) is a representation, using graph notation, of all paths that might be traversed through a program during its execution. The control flow graph is due to Frances E. Allen, who notes that Reese T. Prosser used boolean connectivity matrices for flow analysis before.

0
votes
2answers
185 views

Basic Blocks and Data Flow Analysis

I am looking to do some Data Flow Analysis via code. I have already the code that parses a binary and disassembles it (x86/x64) and creates Basic Blocks. Now what I would like to do is, for any Basic ...
3
votes
0answers
56 views

Recognizing instructions containing low-level control flows

There are some x86 instructions which containing a low-level** control flow in its semantics, for example div because its semantics is roughly as: if (source == 0) throw exception... else ...
3
votes
2answers
90 views

IDA function never called and only cross-referenced as data

When I press the X key (list x-refs) on a function (sub_xyz) to see which functions call it, I only saw dd offset sub_xyz twice, with no call sub_xyz instructions. There is no another place that ...
3
votes
1answer
215 views

Counting number of nodes and edges in IDA Pro graph

Is it possible to obtain a node and edge count for the IDA Pro graph overview? I'm able to obtain this if I generate a wingraph32 flowchart, but it seems that wingraph32 doesn't work for very large ...
3
votes
1answer
411 views

How to deal with heavy control flow flattening?

I am trying to reverse engineer an executable that uses a lot of control flow flattening obfuscation (i.e, lots of subroutines that end with something like jmp esi, jmp eax) IDA Pro isn't able to ...
1
vote
1answer
246 views

Is it possible to completely reset a cached graph layout for a function in IDA Pro?

I'm reversing a binary dump of an older embedded target using IDA Pro 7.0. Now I have somehow managed to introduce a "pseudo graph node" that I for the love of god cannot make go away. The ...
5
votes
1answer
305 views

How can I get the shared libraries' function calls using angr

I am trying to get all the library function calls that a binary performs in a preorder-DFT traversal of the CFG. I'm able to get the CFG like: import sys, angr import networkx as nx proj = angr....
-1
votes
0answers
172 views

Obfuscation - Control Flow Flattening Python code

To begin with, I should mention that I have gone through this thread:How do I protect Python code ? and have a perused the paper for Woot `13 which talks about reversing the Dropbox client written in ...
0
votes
2answers
437 views

IDA Pro Graph question

I was wondering if anyone could help me and explain how I should process a graph that looks like this in IDA Pro, where the right most node is the entrypoint, and it contains several of these small ...
0
votes
0answers
419 views

How to create control flow graph/obtain node and edge count for large functions in IDA Pro?

I'm trying to obtain the control flow graph, node and edge counts for a large function within an ARM static library in IDA Pro 6.9, but I'm unable to get the Wingraph flowchart, which gives me the ...
8
votes
3answers
2k views

Control flow graph reconstruction projects

I'm looking for projects providing reconstructed Control Flow Graphs from binaries while supporting more than one platform (e.g. x86, x64, arm). For example, considering this short assembler program: ...
3
votes
1answer
279 views

Can a basic-block have more than 2 outgoing edges?

For the ease of analysis (i.e., static analysis), I am planning to convert a control-flow graph, of a function, into a spanning tree by removing the backward edges. I wonder whether this spanning tree ...
8
votes
1answer
1k views

Retrieving Objective-C Control Flow?

I am learning to disassemble and analyze objective-c binaries. One of my frustrations is that in Hopper, and IDA, it seems that the proper cross-references and control flow are not preserved. I ...
6
votes
2answers
4k views

How to generate CFG from assembly instructions?

I want to know is there any tools to use assembly file and convert it to an intermediate language such as RREIL and then generate control flow graph from the intermediate language ? This is the ...
0
votes
1answer
2k views

Red addresses in IDA Pro

I know that red addresses means, that code do not recognize as a function in IDA, because that code never get called. But I have found a piece of code that is marked red, but when debugging, I saw ...
6
votes
1answer
1k views

Reconstruct control-flow graph from x86 instruction trace

Can anyone suggest a free and preferably open source software tool that can reconstruct / build / generate a control-flow graph from a set of x86 execution traces of the same program? I found an ...