21
votes
Accepted
How to generate the call graph of a binary file?
You can use radare2 or one of the alternatives below to generate a full call-graph in dot format.
radare2 Installation
First of all, install radare2 from git repository:
$ git clone https://...
- 9,019
8
votes
How to generate the call graph of a binary file?
You might want to give angr a try.
Load the binary. Suppose p is the angr Project instance.
Generate a CFG: cfg = p.analyses.CFG(show_progressbar=True).
Access/traverse the call graph (which is a ...
- 194
3
votes
Accepted
Point-to analysis of IDA Pro
The topic of pointer analysis is an important part of theoretical static analysis. Many articles and academic publications have been written about pointer analysis, this is a heavily researched field.
...
- 11.8k
3
votes
Accepted
How to find paths from current offset to given address using radare2?
When I realized that this feature was not implement, I made a workaround to get what I want. I output the full program call graph then made a very simple python script that uses networkx to find ...
- 61
3
votes
How to find paths from current offset to given address using radare2?
Seems like the feature is not implemented yet. As you can see in this function:
...
if (root && dest) {
if (dest == root) {
eprintf ("Source and destination are the same\n");
...
- 9,019
3
votes
How to generate the call graph of a binary file?
You can use angr-utils in order to generate the graph from angr : https://github.com/axt/angr-utils
For more information please see:
https://github.com/axt/angr-utils/blob/master/examples/plot_cg/...
- 63
2
votes
Accepted
Best python framework/library for constructing the call-graph from binary?
My suggestion is that you generate a graphviz (https://graphviz.org/) file with all the nodes and all the information that you want and then with the command dot you paint the graph. However, if you ...
- 254
2
votes
How to generate the call graph of a binary file?
Check out Callgrind or KCachegrind. Much simpler than any other alternative.
- 2,673
2
votes
Accepted
IDA failed to construct correct graph
IDA sometimes flag functions with "noreturn". In my situation it was due to exceptions in sub_1B64A30. If function is flagged as "noreturn", IDA's analysis stops after calling it.
So, in order to ...
- 81
1
vote
Track execution of bytes in a Linux executable
As @IgorSkochinsky suggests, you can use dynamic binary instrumentation (DBI).
One alternative to PIN is DynamoRIO.
$ ./drbuild.sh # build script (below)
$ gcc gcd.c -o gcd
# run one
$ $ ./...
- 13
1
vote
Track execution of bytes in a Linux executable
It seems what you need is an instruction tracer. PIN from Intel is one example of a framework which allows you to make tracing tools. It uses dynamic binary instrumentation to achieve reasonable ...
- 36.9k
Only top scored, non community-wiki answers of a minimum length are eligible