8

After analysing a function and pressing VV to go into graph mode, is it somehow possible to export/render the whole graph to an image?

I have some huge main functions and it would be nice to have it all in an image.

Jonas Stein
  • 125
  • 5
Paul G.
  • 183
  • 1
  • 4

1 Answers1

9

The ag command and subcommands can help you to output the visual graph into Graphviz format.

[0x00000000]> ag?
Usage: ag<graphtype><format> [addr]  
Graph commands:
| aga[format]             Data references graph
....
| agf[format]             Basic blocks function graph
....

Output formats:
| <blank>                 Ascii art
| *                       r2 commands
| d                       Graphviz dot
| g                       Graph Modelling Language (gml)
| j                       json ('J' for formatted disassembly)
| k                       SDB key-value
| t                       Tiny ascii art
| v                       Interactive ascii art
| w [path]                Write to path or display graph image (see graph.gv.format and graph.web)

For example, you can output the visual graph as a dot file and then convert it to PNG. Here's an example to create an image from the main function of /bin/ls:

$ r2 /bin/ls
[0x004049a0]> aa
[x] Analyze all flags starting with sym. and entry0 (aa)
[0x004049a0]> agfd main > graph.dot
[0x004049a0]> !!dot -Tpng -o graph.png graph.dot

The dot utility is part of the Graphviz software which can be installed using sudo apt-get install graphviz.

You can also output the graph into ascii-graph using the agf command.

[0x004049a0]> s main
[0x00402a00]> agf > ascii_graph.txt

Moreover, if you are just searching for a comfort way to view the graph you can simply open the dot file inside Graphviz or use an online Graphviz viewer instead of converting it to an image file.

sudhackar
  • 2,659
  • 1
  • 10
  • 27
Megabeets
  • 8,989
  • 2
  • 24
  • 48
  • Thank you, I preferred to open the dot file with dot and browse it. I had performance problems opening the generated image with more than 700 nodes with various image viewers (feh, display,geeqie). – Paul G. Jun 20 '17 at 09:02