I recently got asked on twitter about whether I had plans to release the plugin that produced the graphs seen in the “Zbot Illustrated” blog post.
This is a side project I have been working on for creating call graphs for IDA. These call graphs are pretty useless for understanding the code on the microscopic level, instead they try to make sense of the overall layout of the program.
And I thought,”why not release it”. It’s not pretty, and there are bugs in there that cause occasional crashes and screams of fury. Some people can’t get it to work at all. But hey, it might be helpful for some and I have not had time to do much with it lately anyway.
A normal executable will produce a jumble of interconnected nodes when viewed as call graph. This is because each node is drawn once, and the edges cross each other to produce a crow’s nest that gets less readable the larger the executable is.
I wanted instead to have the graph show execution branches. In order to do this, I went away from drawing only one node of each function, and instead draw a new node every time the function is referenced. The result is more nodes, but also more distinct branches.
Graphs look like this:
Fig.1 A Gh0st Rat, circular plot. Callida also supports horizontal and vertical tree plots.
There is some additional functionality that might come in handy:
- Attempts to follow CreateThreads (edges shown in red), call tables (gray edges) and non-call function references (black edges)
- API calls are optionally plotted (edges shown in green)
- Nodes are clickable and draggable. Dbl-click will toggle a collapse of the node, allowing the plot to be reorganized to be more readable. (Dragging will require unchecking the “lock graph layout” option in the IDA menu.)
- Recursive down to arbitrary level. Be careful at first – unlimited plotting can take alot of time and has no protection against excessive memory usage. I have plots with well over 200,000 boxes.
- Will optionally plot all code roots – i.e. nodes with no “to” xrefs.
- When zoomed, nodes contain information about which functions/API’s are called. The reasoning is to give a gist of the contents of the function from just looking at the node. See below.
The plugin is available in binary form for now. This is downloadable from https://docs.google.com/open?id=0B2pG–qFXr30VGRDTmhXS0haNkE
Plugin hash:
SHA1 : C346A98C50C39BC33720688378EEA4320C1134F4
SHA256: AB5B34C7DF13027BF2FB5C43DDFA5BF8E342418B8870A49CA9207A04F859296C
Installation is easy – just copy callida.plw to the IDA plugins folder.
Next time you start IDA, the plugin will now be found under the menu option EDIT->Functions->Callida graph.
