From d7a02a9df7932c074be086afda1bf7488ee6c07d Mon Sep 17 00:00:00 2001 From: x86byte <111459558+x86byte@users.noreply.github.com> Date: Mon, 29 Jun 2026 13:01:13 +0100 Subject: [PATCH] readme: document --clean flag --- README.md | 13 +++++++++++-- 1 file changed, 11 insertions(+), 2 deletions(-) diff --git a/README.md b/README.md index 4728aba..ae75132 100644 --- a/README.md +++ b/README.md @@ -18,6 +18,13 @@ For every binary cfgrip processes, it produces: - **Import table** — resolved library imports with addresses - **Indirect targets** — GOT-resolved calls, jump table entries, register-traced branches, and unresolved ones (marked as such) +With `--clean`, it additionally: + +- **Jump-threads** `jmp` → `jmp` chains into direct edges +- **Prunes** dead basic blocks (no incoming edges) +- **Annotates** each instruction with `stack_offset` (RSP delta from function entry) +- **Builds** an `xrefs` section mapping every call/jump target back to its callers + It handles indirect branches by: 1. Checking the **GOT** (Global Offset Table) for known imports 2. Scanning backward for **LEA instructions** to locate jump tables, then reading table entries @@ -26,11 +33,12 @@ It handles indirect branches by: ## usage ``` -cfgrip [--subs-only] +cfgrip [--subs-only] [--clean] ``` Feed it a binary, get `.cfg` as output. -Use `--subs-only` to extract only functions reachable from the entry point through the call graph — skips unreachable exports and prolog candidates. +Use `--subs-only` to extract only functions reachable from the entry point through the call graph — skips unreachable exports and prolog candidates. +Use `--clean` to apply jump-threading, dead-block pruning, stack-offset tracking, and cross-reference analysis. --- Example: @@ -417,5 +425,6 @@ cmake --build build --config Release | | `call` targets | YES | | | Prolog scanning (`push rbp`, CET `endbr64`) | YES | | **Subs-only mode** | `--subs-only` flag | YES | +| **CFG cleaning** | `--clean` (jump-thread, dead-block prune, stack deltas, xrefs) | YES |