Multiple duplicated CFG in a graph about angr-utils

[axt]

Sorry, I will not have time for this probably, untill end of May.

[axt]

Hi! Sorry again for my late answer!

This behavior is caused by the context sensitivity level setting of CFGEmulated. If it is higher than 0, and the same function is called from multiple locations, it will have multiple nodes in the generated CFG, because in this case, nodes are identified by their callstack key, not just by their address, as in case of CFGFast, while the filtering is done only by address:

As you can see in this picture, the function f0 is called from two locations, the callstack key is different for the two graphs of the function:
https://imgur.com/PJ7F3QL

Since in the case of CFGEmulated the discovered CFG of a function can be different for different calls, I don't think, that this behavior is a bug.

You could use a context sensitivity level of 0, if you don't need a higher one, or solve the issue from the outside (angr-utils is just a high-level interface, for some common plots, on bingraphvis level you can do more filtering, annotations, etc)

from bingraphvis.angr import *
from bingraphvis import DotOutput

def safehex(x):
    return "%x" % x if x is not None else "none"

# get the unique callstack keys
cskeys = set([i.callstack_key for i in cfg.nodes()])

for cskey in cskeys:

        # last element of callstack key is the function address
        func = cfg.kb.functions[cskey[-1]]

        # create the default cfg plotting pipeline, include the callstack key in the output file name
        vis = AngrVisFactory().default_cfg_pipeline(cfg, asminst=True, vexinst=False, comments=True)
        vis.set_output(DotOutput("%s_%s_cfg" % (func.name, ":".join(map(safehex,cskey))), format="raw"))

        # if you want debug info
        vis.add_content(AngrCFGDebugInfo())

        # filter explicitly for the current callstack key
        vis.process(cfg.graph, filter=lambda node: node.obj.callstack_key == cskey)