Obtaining CFGs for individual functions with evm-cfg-builder

Question

I am trying to obtain a Control Flow Graph (CFG) of each individual function in a Solidity contract for Machine Learning analysis purposes.

I tried using evm-cfg-builder available at https://github.com/crytic/evm_cfg_builder to obtain CFGs for individual functions from a solidity contract. I had generated the running bytecode for the contract with

solc --bin-runtime <contract.sol> -o runbytecode

Which generated a few bin-runtime files as my solidity contract contains a few codes within it. Afterwards, I used the following code to try and read from all these files and collect all the functions.

import os
from evm_cfg_builder.cfg import CFG

bytecode_folder = "/bytecode"
bytecode_files = [f for f in os.listdir(bytecode_folder) if f.endswith("bin-runtime")]

all_functions = []

for bytecode_file in bytecode_files:
    bytecode_path = os.path.join(bytecode_folder, bytecode_file)
    # Check if the file size is greater than 0
    if os.path.getsize(bytecode_path) > 0:
        with open(bytecode_path, encoding="utf-8") as f:
            runtime_bytecode = f.read()

        cfg = CFG(runtime_bytecode)

        for function in cfg.functions:
            all_functions.append(function)

print(len(all_functions))
for function in sorted(all_functions, key=lambda x: x.start_addr):
    print(f"Function {function.name}")

However, my output does not match the functions that are present in my contract. My list had a length of 28, when I only have a total of 22 functions in my contract. Additionally, there was a lot of "dispatcher", "owner" and "fallback" functions, which were not present in the contract's source code. Would greatly appreciate any help or any suggestions for alternative tools!

Thank you!

Answer 1

CFG doesn't present the internal functions and external calls. Maybe you can try use the cfg.output_to_dot to generate dot file for each function.