Reverse Engineering Asked on October 4, 2021
Using DnSpy is great, but it’s very awkward to ascertain the control-flow of an executable. Is anyone able to advise on free-of-charge helpful apps that display a control-flow graph?
IDA Home does not work on .NET assemblies, nor does Radare2 sadly.
Hopefully someone can tell what they do?
So I though it would be a nice pet-project so I've started building a PoC tool that can generate a CFG for a given method in the .NET assembly.
The PoC uses Mono.Cecil
to inspect the binary and produces a graph in a DOT language than later can be transformed into a picture with dot
tool and works on IL level.
A bit of technical info.
First it determines leaders - instructions that will be the first instruction in the basic blocks (BB) - by going through the opcodes and checking the control flow type:
Return
- the next one (if exists) will be a leader.Branch
- the destination of the branch instruction will be a leaderCond_Branch
- the destination of the branch and the next instruction will be leaders.Also doing that we can construct edges between those BBs, there will be different outgoing edges depending on the type of flow:
Return
there will be no outgoing edgeBranch
there will be an outgoing edge from the current instruction's BB to the branch's destination BBCond_Branch
there will be outgoing edges from the current BB to the destination of the Cond_Branch
BB and to the next instruction's BBThe only thing we need to do having those info, is to generate a graph definition in the DOT langage.
Calling the tool in the following way
./cfg.exe Mono.Cecil.dll Mono.Cecil.MetadataBuilder.AddCustomDebugInformations | dot -Tpng -o cfg.png
will generate for us a "nice" CFG for the method AddCustomDebugInformations
.
It might fail for some strange (or normal) edge cases and of course there's a lot to improve but overall CFG is there ;)
Link to the repo: https://github.com/pawlos/cfg
Answered by Paweł Łukasik on October 4, 2021
Get help from others!
Recent Questions
Recent Answers
© 2024 TransWikia.com. All rights reserved. Sites we Love: PCI Database, UKBizDB, Menu Kuliner, Sharing RPP