angr.analyses.cfg_slice_to_sink.graph¶
- angr.analyses.cfg_slice_to_sink.graph.slice_callgraph(callgraph, cfg_slice_to_sink)¶
Slice a callgraph, keeping only the nodes present in the <CFGSliceToSink> representation, and th transitions for which a path exists.
Note that this function mutates the graph passed as an argument.
- Parameters:
callgraph (networkx.MultiDiGraph) – The callgraph to update.
cfg_slice_to_sink (CFGSliceToSink) – The representation of the slice, containing the data to update the callgraph from.
- angr.analyses.cfg_slice_to_sink.graph.slice_cfg_graph(graph, cfg_slice_to_sink)¶
Slice a CFG graph, keeping only the transitions and nodes present in the <CFGSliceToSink> representation.
Note that this function mutates the graph passed as an argument.
- Parameters:
graph (networkx.DiGraph) – The graph to slice.
cfg_slice_to_sink (CFGSliceToSink) – The representation of the slice, containing the data to update the CFG from.
- Return networkx.DiGraph:
The sliced graph.
- angr.analyses.cfg_slice_to_sink.graph.slice_function_graph(function_graph, cfg_slice_to_sink)¶
Slice a function graph, keeping only the nodes present in the <CFGSliceToSink> representation.
Because the <CFGSliceToSink> is build from the CFG, and the function graph is NOT a subgraph of the CFG, edges of the function graph will no be present in the <CFGSliceToSink> transitions. However, we use the fact that if there is an edge between two nodes in the function graph, then there must exist a path between these two nodes in the slice; Proof idea: - The <CFGSliceToSink> is backward and recursively constructed; - If a node is in the slice, then all its predecessors will be (transitively); - If there is an edge between two nodes in the function graph, there is a path between them in the CFG; - So: The origin node is a transitive predecessor of the destination one, hence if destination is in the slice, then origin will be too.
In consequence, in the end, removing the only nodes not present in the slice, and their related transitions gives us the expected result: a function graph representing (a higher view of) the flow in the slice.
Note that this function mutates the graph passed as an argument.
- Parameters:
graph (networkx.DiGraph) – The graph to slice.
cfg_slice_to_sink (CFGSliceToSink) – The representation of the slice, containing the data to update the CFG from.
- Return networkx.DiGraph:
The sliced graph.