A common need that I have when reversing code is to find all possible code paths between two functions. Say for example that I’m looking for calls to dangerous functions, like sprintf, and I want to find all possible code paths that lead from my current function to sprintf. Manually going through the call graph from my starting function can often be, well, tedious:
websReadEvent call graph
Unfortunately I couldn’t find an easy way to make IDA display all code paths between two functions, and only the paths between those two functions. Normal call graphs show everything going to or from a single function, and while proximity view can be told to find a path between two nodes, it only displays the first path that it finds.
So I wrote idapathfinder, a plugin to find all code paths between two functions. This can significantly narrow down the number of paths that require investigation:
All paths between websReadEvent and sprintf
Note that the graphs generated by idapathfinder are solely dependent on IDA’s knowledge of function cross-references, so if for example you have a function that iterates over function pointers in a function table, those relationships will not be identified.
You can download idapathfinder here.
Nice router web server action going on there! đ
Indeed! Hacked up versions of goahead make me happy. đ
Is that USS Enterprise?
Ha! IDA call graph art…better than ASCII art!
Isn’t this implemented in the toolbag plugin? Does your algo differ from theirs at all?
Yes, I found that out after I posted this of course. đ I’ll probably still keep idapathfinder around though, since I found it to be a bit of a pain to get toolbag working properly in a non-windows environment.
Pingback: An IDA plugin to graph all paths between two functions | ç«æ俥æŻćźć šç 究éą
Im actually using this with IDA 6.1, it works fine except the graph rendering, for example when I use an xref from a function where I can assume theres 100% a path between, it looks like this:
http://gyazo.com/e23d0906d50e3c4beadc26329d58c290
Any Idea?
Sry used the version from google code linked in your post
The code from github just works fine, so you may consider updating the link in the post đ