Hierarchical layout of function 1 from Trillian IRC.DLL
Generated graphs are interactive, editable, sport instruction level coloring for easy reading and can be displayed with a number of layout algorithms such as hierarchical, orthogonal, symmetric, circular, etc... Entry points are highlighted in green, true/false branches are colored green/red accordingly and implicit edges are colored blue.
Hierarchical layout of function 2 from Trillian IRC.DLL
The above input graphs are generated before any stalking takes place. We attach the Process Stalker to the target Trillian process, connect to an IRC server and enter a recorder mode. From another IRC client we generate a CTCP message to the target Trillian process. Once the command was received we stop the recorder mode and run our post-processing scripts to generate the following two example graphs.
Hierarchical layout of Process Stalker output from /ctcp request
The above graph shows the combined hierarchical graph of the first two graphs with "hit" basic blocks highlighted in red. The researcher is easily able to locate the functions and specific control flow blocks that are involved in handling the specific CTCP message. At this stage branch conditions can be examined for increasing code coverage, a binary level audit can be conducted on only "reachable" code so as not to waste any efforts, etc...
Cluster orthogonal layout of Process Stalker output from /ctcp request
The above graph is identical to the ctcp_hierarchical graph except displayed with the cluster orthogonal layout. Functions are clumped together in colored clusters, the same node/edge level coloring applies as before.