callgraph-tracer

Call Graph Tracer & Cross-Module Chain Analysis

Purpose

Trace execution paths and call chains across extracted Windows PE binaries. Builds directed call graphs from simple_outbound_xrefs / simple_inbound_xrefs in analysis DBs, supports path finding, reachability analysis, and cross-module chain analysis -- following function calls across DLL boundaries to retrieve decompiled code at each step.

When NOT to Use

• Tracing how a specific parameter or data value flows through functions -- use data-flow-tracer
• PE-level import/export dependency mapping (loader-level, not code xrefs) -- use import-export-resolver
• General function explanation or understanding decompiled code -- use re-analyst or /explain
• Ranking entry points by attack value -- use map-attack-surface
• Tracing attacker-controlled input to dangerous sinks -- use taint-analysis

Data Sources

• Individual analysis DBs (extracted_dbs/{module}_{hash}.db): Per-function xrefs, decompiled code, signatures
• Tracking DB (extracted_dbs/analyzed_files.db): Maps module names to their analysis DB paths
• Xref fields used: simple_outbound_xrefs (callees) and simple_inbound_xrefs (callers)

Key xref properties for cross-module resolution:

• function_id: non-null = callee is in the same module (query by ID)
• function_id: null = callee is external (use module_name to find its DB)
• module_name: DLL name (e.g., kernel32.dll) matching file_name in analyzed_files.db

Not all xrefs are function calls. The module_name field uses sentinel values:

• "data" (function_type=4): global variable / data references -- not calls, skipped automatically
• "vtable" (function_type=8): vtable dispatch references -- indirect, not directly followable
• "internal" (function_type=1): same-module function -- followable via function_id
• "static_library" (function_type=2): statically linked -- followable via function_id

All scripts automatically filter out data and vtable refs from call graphs and chain traversal. See reference.md for the full sentinel value table.