build_cfg
Build a control-flow graph from a binary to analyze program structure and detect virtual machine dispatchers by identifying blocks with high incoming edge counts.
Instructions
Build a control-flow graph of path (optionally one function).
Args:
path: PE / ELF / MachO to analyze
function: optional function name (e.g. "main") — when
given, only the CFG of that function is returned; when
None, the full program CFG is returned.
Returns::
{"path": "...",
"function": "..." | null,
"nodes": [{"addr": N, "size": M, "successors": [...]}],
"edges": [{"src": N, "dst": M, "kind": "fall-through|jmp|call|ret"}]}The CFG is the first thing an analyst needs for VM detection (high incoming-edge count on a single block = dispatcher candidate) and for binary comprehension in general.
Input Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| path | Yes | ||
| function | No |