Bug: api_analysis:callgraph falsely labels all non-fallthrough code xrefs as calls
The call to idautils.CodeRefsFrom(item_ea, 0) in the traverse helper function inside callgraph apparently assumes that the returned iterator only includes function call xrefs, but this is not the case.
The flow bool parameter in CodeRefsFrom will filter out normal code flow when set to 0, which means non-branching instructions falling through to the following instruction. It does not filter out conditional or unconditional jumps.
Consider the following x86 function:
sub_foo:
mov eax, 10
loc_bar:
sub eax, 1
jnz loc_bar
ret
; end of sub_fooThe callgraph tool would report that sub_foo calls itself, even though it does not — there's only a loop in its body.
Since the tool is called callgraph, not e.g. control_flow_graph, and the edges are labeled (redundantly) as "calls", I consider this behaviour incorrect and misleading.
Source: mrexodia/ida-pro-mcp