Home > OS >  How to extract the Windows PE file function call graph (FCG)? And why I get FCG is very strange?
How to extract the Windows PE file function call graph (FCG)? And why I get FCG is very strange?

Time:05-12

Now you need to call each PE file FCG, already have a solution is to call IDA batch mode and IDAPython script analysis and get the call graph, CMD command and the script is as follows:
 
# gen_fcg. Py
# - * - coding: utf-8 - * -
# python 2
The import pickled
The import idaapi
The import of logging
The import sys
Logging. BasicConfig (level=logging. The INFO format='% (asctime) s - % (filename) s/line: % d (lineno) - % (levelname) s - % (the message) s')

Def gen (out_name) :
Text_addr=ScreenEA ()
FCG=dict ()
For callee_addr Functions provides in () :
Callee_name=GetFunctionName (callee_addr)

For caller_addr in CodeRefsTo (callee_addr, 0) :
Caller_name=GetFunctionName (caller_addr)
Logging. The info (callee_name + '-' + caller_name)
FCG [caller_name]=FCG. Get (caller_name, set ())
FCG [caller_name]. Add (callee_name)
Pickle. Dump (FCG, open (out_name, 'w'))
Print FCG

If __name__=="__main__ ':
Logging. The info (' sys. Argv '+ STR (sys. Argv))
Idaapi. AutoWait ()
Logging. The info (' start analyse... ')
Gen (' D: \ \ Lab \ \ data_win \ \ FCG \ \ FCG PKL ')

Idc. Exit (0)


Command line to invoke the command, for PE file parsing:
 % % IDAQ_PATH - l./analysis. The log - c - A - s./gen_cfg py./CRACKME. EXE 


Environment: IDA6.8, Windows 10, python2.7

But this method of FCG figure, remove the sub opening method (IDA identification code written by a programmer), for a lot of files, the rest API function of system is obtained only three: [' DialogFunc ', 'start', 'StartAddress], the result of the proportion of the total file is close to 50%, is this normal?
If it is not normal, what other ways to get a PE file FCG figure?
  • Related