Reverse Engineering & Binary Analysis Basics · 课时

控制流图分析

理解并解读控制流图（CFG），将程序执行路径和逻辑直观呈现出来。

控制流图分析 是 CoddyKit 上的免费 Reverse Engineering & Binary Analysis Basics 课时。这是第 3 节课，共 4 节。你可以在下方免费阅读本课时的完整内容 — 然后在浏览器中使用内置代码编辑器和全天候 AI 导师进行实践。这是 Reverse Engineering & Binary Analysis Basics 学习路径的一部分，你的进度在网页和 CoddyKit 应用中同步。 Reverse Engineering & Binary Analysis Basics 课程共包含 4 节课。

本课时的部分内容尚未翻译，以英文显示。

Intro to Control Flow Graphs

Welcome! In this lesson, we'll dive into Control Flow Graphs (CFGs). A CFG is like a roadmap for your program, visually showing all possible execution paths.

It's a crucial tool in reverse engineering because it helps you understand a program's logic without actually running it.

The Building Blocks: Basic Blocks

At the heart of a CFG are basic blocks. Think of a basic block as a straight line of instructions.

It's a sequence of code with only one entry point (the first instruction).
It has only one exit point (the last instruction).
There are no jumps or jump targets anywhere in between.

For example, A = 10; B = A + 5; C = B * 2; could be a single basic block.

Edges Show the Way

Edges in a CFG connect basic blocks, showing how execution can flow from one block to another. These represent jumps, calls, or fall-throughs.

Unconditional Edges: Always taken, like a direct jump to the next block.
Conditional Edges: Taken only if a certain condition is met, leading to different paths (e.g., an IF statement).

A Simple Program's Flow

Let's look at a very simple C program. Its CFG would mostly consist of sequential basic blocks, one after another.

Try running this example:

#include <stdio.h>

int main() {
  int x = 5;
  int y = 10;
  int sum = x + y;
  printf("Sum: %d\n", sum);
  return 0;
}

Conditional Logic (If/Else)

Conditional statements like if/else create branches in a CFG. A basic block containing a conditional jump will have two outgoing edges.

One edge represents the 'true' path, and the other represents the 'false' path. These paths usually merge back together later.

#include <stdio.h>

int main() {
  int age = 20;
  if (age >= 18) {
    printf("Adult\n");
  } else {
    printf("Minor\n");
  }
  return 0;
}

Loop Structures (For/While)

Loops, such as for or while, are easily identifiable in a CFG by a special type of edge called a back-edge.

A back-edge points from a block inside the loop back to an earlier block, creating a cycle. This cycle represents the repeated execution of the loop body.

#include <stdio.h>

int main() {
  for (int i = 0; i < 3; i++) {
    printf("Iteration %d\n", i);
  }
  return 0;
}

Function Calls in CFGs

When your program calls a function, the CFG represents this too. An edge will typically lead from the caller's basic block to the entry point of the called function's own CFG.

Once the function finishes, execution returns to the caller, usually to the next instruction after the call.

#include <stdio.h>

void greet() {
  printf("Hello from greet!\n");
}

int main() {
  printf("Calling greet...\n");
  greet();
  printf("Greet returned.\n");
  return 0;
}

The Power of CFGs in RE

CFGs are incredibly powerful for reverse engineering:

Understand Logic: Quickly grasp complex decision-making and overall program flow.
Identify Functions: See distinct subgraphs representing different functions.
Find Vulnerabilities: Spot unusual paths, unreachable code, or logic flaws.
Trace Execution: Predict potential execution paths without needing to run the program.

Navigating CFGs in Disassemblers

Industry-standard tools like Ghidra and IDA Pro automatically generate and display CFGs for you. They allow you to:

Visually inspect basic blocks and their connecting edges.
Click on blocks to view the assembly instructions they contain.
Follow edges to trace the program's execution flow logically.

This visual aid simplifies understanding complex binaries significantly.

CFG Quick Check

Consider a simple program that includes both an if/else statement and a for loop. Think about how these structures are represented in a Control Flow Graph.

Recap: Your CFG Toolbox

Great job! You've learned the fundamentals of Control Flow Graphs:

CFGs are visual maps of program execution paths.
They consist of basic blocks (sequential instruction groups) and edges (showing flow).
CFGs clearly show conditional logic (if/else) and loops (with back-edges).
These graphs are indispensable for understanding program logic during reverse engineering, especially when using tools like Ghidra or IDA Pro.

常见问题解答

「控制流图分析」课时是免费的吗？

是的 — 「控制流图分析」的完整文本可在网页上免费阅读。要进行交互式练习（内置代码编辑器和全天候 AI 导师）并解锁 Reverse Engineering & Binary Analysis Basics 课程的其余内容，请升级到 CoddyKit PRO。 Reverse Engineering & Binary Analysis Basics 课程共包含 4 节课。

「控制流图分析」这节课中我会学到什么？

理解并解读控制流图（CFG），将程序执行路径和逻辑直观呈现出来。你通过在浏览器中直接运行的动手代码来练习 Reverse Engineering & Binary Analysis Basics，全天候 AI 导师会在你学习这节课的过程中回答你的问题。

学习 Reverse Engineering & Binary Analysis Basics 需要有经验吗？

无需任何先前经验。CoddyKit 上的 Reverse Engineering & Binary Analysis Basics 课程适合初学者到高级学习者，你可以从这里开始或从头开始，按照自己的节奏学习。这是第 3 节课，共 4 节。

「控制流图分析」课时需要多长时间？

大多数 CoddyKit 课程大约需要 5–10 分钟。每节课都很精短且互动，所以你能稳步进步，并在网页和应用中从离开的地方继续。

我能在这节 Reverse Engineering & Binary Analysis Basics 课中编写并运行代码吗？

能。每节 Reverse Engineering & Binary Analysis Basics 课都包含内置代码编辑器，你可以在浏览器中直接编写并运行真实代码，并获得即时 AI 反馈 — 无需本地设置。

此课程中的所有课时

← 返回 Reverse Engineering & Binary Analysis Basics