|
The Call Tree Plugin shows all caller functions and all functions called for the current function (also known as the main function), which is the function that contains the cursor location in the Listing. You can expand the nodes in each of the trees to show more information about these referenced functions. This plugin can be used to gain a quick context of a given function by seeing incoming and outgoing function calls.
You can launch this component by clicking the
icon in the Tool's toolbar, or by right-clicking in the Listing and selecting References
Show Call Trees
Unlike most widgets in Ghidra, the Call Trees display functions differently depending upon how you launch it.
- When launched from the toolbar icon, the provider that is shown will track the current location in the Listing (the
Navigate on Incoming Location Changes button is on).
- When launched from the context popup menu, the provider that is shown will not track the current location in the Listing. This allows you to open multiple windows for different functions, functioning much like snapshots, allowing you to keep a watchful eye on particular functions, regardless of where you navigate within the tool.
The Incoming Calls tree shows all caller functions. Each node in the tree has the incoming function call icon (
The Outgoing Calls tree shows all functions called. Nodes with the outgoing function call icon (
) represent functions called by the current function that also call other functions. Expanding a node in this tree shows all functions that are called by the expanded node. Nodes may be expanded recursively to any depth desired.
The default operation of the plugin display is to not change as the location changes in the Listing. This allows you to trigger navigation from inside of the trees without changing the function displayed by the trees. In order to see a new call trees window for the location in the Listing, you can do so by clicking the
Alternatively, you may execute the
Alternate Outgoing Icons
Icon Description 
Nodes with the stop icon indicate a call destination for which no other called functions can be determined. 
This icon indicates an external function call, which has no outgoing calls. 
This icon indicates that the given function has already been called somewhere in the path of calls. For example, a function that calls itself would appear as an outgoing call of that function. In this case, this icon would be applied to that node. Filtering
You may enter text into either of the tree's filters. This will search for any function name matching the given text, based up on the filter settings.
Actions
The following actions are buttons in the Call Tree Plugin header.
The
home button will navigate to the function label of the main function for which the call trees are being displayed.
The
refresh button will reload the trees. This is needed due to the fact that as changes are made to the program, the trees will not add and remove nodes in response. Thus, you can edit as much as you like without affecting the structure of the trees. The action's color will change to yellow if the provider detects that changes have taken place that may affect the structure of the tree.
The
action, when toggled on, will filter out duplicate function calls. This setting is useful to see the set of all functions called. When toggled off this action will show all function calls, including duplicate calls, in address order. This setting is more useful to see the overall flow of the main function.
The
depth setting action allows you to see and change the depth of recursive operations. For example, the filter operation will expand nodes as deep as it can, limited only by the depth setting. Another example is the expand action, which will expand nodes recursively until the current depth setting is reached. The depth of a given node is defined as the number of parents of a given node.
The
The
button, when toggled on, will cause selections in the tree to navigate to the source of the selected function call within the main function. To navigate to the destination of a given function call, you can use the Go To Call Destination action. No navigation will happen when toggled off.
Context Menu Actions
The following actions are available from the context menu by right-clicking.
The
Collapse All Nodes action will close all nodes in the tree, except for the direct children of the root node. This allows you to collapse all nodes after expanding them, which can be useful when trying to get an overall view for the different flows out of a function. For example, you can expand all nodes to get an overview, pick a single path out of the node, collapse all nodes and then expand only the child node of interest.
The
Expand Nodes to Depth Limit action will expand the selected node(s) as far as possible until there are no more child nodes to expand of the depth limit is reached.
The Select Call Source action will make a program selection for the node(s) selected in the tree where the context menu was activated. When activated from the incoming call tree, the caller function's entry point will be selected. When activated from the outgoing call tree the address of the containing the call instruction will be selected.
The Select Call Destination will make a program selection for the node(s) selected in the outgoing tree. The selection will be the called function's entry point.
The Go To Call Source action will navigate the Listing to the address of the selected node in the tree where the context menu was activated. When activated from the incoming call tree, the Listing will be navigated to the caller function's entry point. When activated from the outgoing call tree the Listing will be navigated to the address of the containing the call instruction.
The Go To Call Destination will navigate the Listing to the entry point of the called function.
The Show Call Tree For Function will load function for the selected node into the current Call Tree window.
Provided by: Call Tree Plugin