Home

Awesome

CTO (Call Tree Overviewer)

CTO (Call Tree Overviewer) is an IDA plugin for creating a simple and efficiant function call tree graph. It can also summarize function information such as internal function calls, API calls, static linked library function calls, unresolved indirect function calls, string references, structure member accesses, specific comments.

CTO has another helper plugin named "CTO Function Lister", although it can work as a standalone tool. You can think this is an enhanced version of functions window. It lists functions with summarized important information, which is the same as the CTO's one. You can use a regex filter to find nodes with a specific pattern as well.

CTO-logo Introducing CTO

An introduction video is here.
https://youtu.be/zVCpb82UfFs

Check the article below about how to use CTO and CTO Function Lister in malware analysis tasks. https://www.iij.ad.jp/en/dev/iir/pdf/iir_vol59_focus1_EN.pdf

You can also check the presentation at VB2021 localhost.
https://vblocalhost.com/conference/presentations/cto-call-tree-overviewer-yet-another-function-call-tree-viewer/

Submitted paper
https://vblocalhost.com/uploads/VB2021-Suzuki.pdf

Presentation slides
https://vblocalhost.com/uploads/2021/09/VB2021-14.pdf

Requirements

You will need at least IDA Pro 7.4 or later because of the APIs that I use. And use Python 3.x. It should work on Python 2.7 but I did not test enough and I do not support it because it has already obsoleted and deprecated.

Optional 3rd Party Software

How to Install

See "INSTALL" file.

How to Use

To start CTO, press Alt+Shift+C.

Double-click "..." symbol if you want to expand the path. If you want to create a graph based on a different target function, jump to the target function, click the CTO window, and press "F" key. See the help by pressing "H" key on the CTO window.

To start CTO Function Lister, press Alt+Shift+F. See the help by pressing "H" key on the CTO Function Lister window as well.

Check the articles showed in the top of this file as well.

Note

CTO is still under development and it is unstable yet. I might change the data structure drastically. CTO accesses sensitive internal data structure of IDA such as low level APIs and PyQt5. And it might cause a crash of IDA. Do not use this in important situations. I don't take responsibility for any damage or any loss caused by the use of this.

I'm not a programmer. I'm a malware analyst. Please do not expect product-level code.

PRs are welcome. Just complaining and a bug report without enough information are NOT welcome ;-)

Known Issues