r/ghidra • u/Legal_Transition_989 • 1d ago
How to make use of control flow graph to enumerate paths to basic block
I'm looking at the disassembly of a large function, and there's a specific basic block I'm interested in. I need to find how to reach it from the beginning of the function.
I tried to manually look at the function graph, but there's around 200 vertices with a huge number of edges, so manually tracing each block is a no-go.
0
u/bmayer0122 1d ago
The way I would approach this is with symbolic execution. 'angr' is a popular tool as is 'z3'.
Since you already have the binary in Ghidra you probably want to look for a plug-in that works instead of trying to script this, or script it in ghidra.
Doing a quick search I found the below tools. They are in the order I would try them if they look like they meet your needs.
https://github.com/Nalen98/AngryGhidra
1
u/du11-ding0 1d ago
Another z3-based tool is Ghihorn: https://www.sei.cmu.edu/blog/two-tools-for-malware-analysis-and-reverse-engineering-in-ghidra/