Graph Visualization

Overview

Ghidra’s Graph Visualization capabilities enable you to create and display visual representations of program structure, function relationships, data types, control flow, and more. Graph services provide extensible rendering and export options.

Graphing features are available through the Graph menu in the CodeBrowser toolbar and via programmatic APIs for script-based graph generation.

Graph Types

Ghidra supports multiple graph visualization types:

Function Call Graph

Visualize function call relationships and program structure

Control Flow Graph

Display basic block flow within functions

Data Type Graph

Show data type hierarchies and relationships

Reference Graph

Explore code and data reference patterns

Graph Services

The Graph Display Broker provides a plugin architecture for graph rendering:

Service Providers

Multiple graph service providers can be installed:

Default Graph Display: Built-in Jung-based renderer
Third-party Renderers: Extensible plugin system
Export Services: Save graphs to various formats

// Source: GraphDisplayBrokerPlugin.java
// The broker manages multiple graph display providers
// and routes graph requests to appropriate renderers

Display Capabilities

Graph displays support:

Interactive Navigation

Layout Algorithms

Hierarchical layout
Force-directed layout
Tree layout
Circular layout
Custom layouts

Customization

Color coding by type
Shape customization
Edge styling and labels
Filter and search

Export Options

PNG/JPEG image export
SVG vector graphics
GraphML XML format
DOT format for Graphviz

Function Call Graphs

Generating Call Graphs

Select Function

Place cursor on a function in the Listing or Decompiler.

Open Graph Menu

Navigate to Graph → Function Call Graph in the menu bar.

Configure Options

Set options:

Maximum depth (caller/callee levels)
Show incoming/outgoing calls
Filter by function type

View Graph

Graph window opens showing function relationships.

Call Graph Features

Caller Graph
Callee Graph
Combined Graph

Shows functions that call the selected function.Use: Understand how a function is used throughout the program

Graph Elements

Element	Description
Nodes	Represent functions
Edges	Represent call relationships
Colors	Indicate function types (user, library, thunk)
Shapes	May indicate entry points or special functions

Double-click on any node to navigate to that function in the Listing.

Control Flow Graphs

Control flow graphs show execution paths within a single function:

Basic Blocks

Nodes represent basic blocks:

Entry Block: Function entry point (highlighted)
Code Blocks: Sequences of instructions with single entry/exit
Exit Blocks: Return or terminal instructions

Edges

Edges represent control flow:

Unconditional: Solid lines for direct flow
Conditional: Different colors for true/false branches
Fall-through: Default execution path

// Control flow graphs are essential for understanding:
// - Branch logic and conditions
// - Loop structures  
// - Exception handling paths
// - Switch/case statements

Layout Options

Compact

Minimize space usage

Hierarchical

Top-down flow layout

Nested

Show loop nesting

Data Type Graphs

Visualize data type hierarchies and relationships:

Generating Type Graphs

Open Data Type Manager

Access via Window → Data Type Manager.

Select Type

Right-click on a data type (struct, class, typedef).

Choose Graph Action

Select Display Type as Graph.

View Relationships

Graph shows type composition and inheritance.

Type Graph Elements

Structures
Inheritance
References
Typedefs

Shows structure composition with member relationships.

// Source: DisplayTypeAsGraphAction.java, TypeGraphTask.java  
// Data type graphs help understand complex data structures
// and their relationships within the program

Graph Display Features

Zooming

Mouse wheel: Zoom in/out
Zoom to fit: View entire graph
Zoom to selection: Focus on selected nodes

Panning

Click and drag background to pan
Arrow keys for fine movement
Minimap for large graphs

Selection

Click to select single node
Ctrl+Click for multi-select
Drag to select region
Select connected components

Text search for nodes
Highlight matching nodes
Navigate between matches

Filtering

Filter graphs to focus on relevant information:

Hide/Show nodes by type or criteria
Filter edges by relationship type
Depth limiting for large graphs
Scope restriction to address ranges

Customization

Node Color

color

Customize node colors by function type, address range, or custom criteria

Node Shape

enum

Choose shapes: Rectangle, Ellipse, Diamond, or custom

Edge Style

enum

Configure edge rendering: Straight, Curved, Orthogonal

Labels

boolean

Show/hide node and edge labels

Export Formats

# From graph window: File → Export → Image
# Formats: PNG, JPEG, BMP

SVG exports are ideal for documentation as they scale without quality loss and can be edited in vector graphics tools.

Programmatic Graph Generation

Using Scripts

Create custom graphs using Ghidra’s scripting API:

# Example: Generate custom function graph
from ghidra.app.services import GraphDisplayBroker
from ghidra.service.graph import AttributedGraph, AttributedVertex, AttributedEdge

# Get graph service
service = state.getTool().getService(GraphDisplayBroker)

# Create graph
graph = AttributedGraph("My Custom Graph", AttributedGraph())

# Add vertices
v1 = graph.addVertex("1", "Function_A")
v2 = graph.addVertex("2", "Function_B")

# Add edge
graph.addEdge(v1, v2)

# Display
display = service.getDefaultGraphDisplay(False, monitor)
display.setGraph(graph, "Custom Graph", False, monitor)

Example Scripts

Ghidra includes example graph scripts:

# Located in:
~/workspace/source/Ghidra/Features/Base/ghidra_scripts/

# Examples:
- ExampleGraphServiceScript.java
- GraphClassesScript.java

See the Graph directory in help topics for comprehensive scripting documentation.

Graph Services API

The Graph Services framework provides:

Core Interfaces

GraphDisplayBroker
AttributedGraph
GraphDisplay

Main service for obtaining graph displays.

GraphDisplayBroker broker = tool.getService(GraphDisplayBroker.class);
GraphDisplay display = broker.getDefaultGraphDisplay(...);

Graph data structure with attributed vertices and edges.

AttributedGraph graph = new AttributedGraph(name, description);
AttributedVertex vertex = graph.addVertex(id, name);
graph.addEdge(source, destination);

Rendering and interaction interface.

display.setGraph(graph, title, append, monitor);
display.setVertexLabel(vertexId, label);
display.setEdgeLabel(edgeId, label);

Graph Attributes

Vertices and edges support custom attributes:

// Set vertex attributes
vertex.setAttribute("Color", "red");
vertex.setAttribute("Shape", "ellipse");
vertex.setAttribute("VertexType", "EntryPoint");

// Set edge attributes  
edge.setAttribute("Color", "blue");
edge.setAttribute("Style", "dashed");
edge.setAttribute("Weight", "5");

Advanced Graphing

Address-Based Graphs

Graphs synchronized with program addresses:

Automatic highlighting: Selected code highlights in graph
Bidirectional navigation: Graph to listing and vice versa
Address tracking: Graph updates with program changes

// Source: AddressBasedGraphDisplayListener.java
// Listener handles synchronization between graph display
// and program location/selection events

Custom Graph Providers

Extend Ghidra with custom graph implementations:

Implement GraphDisplay interface
Register as service provider
Handle graph rendering and interaction
Support standard graph operations

Custom graph providers require understanding of Ghidra’s service architecture and graph display protocols.

Use Cases

Architecture Analysis

Understand program architecture and module dependencies

Malware Analysis

Trace execution flow and identify malicious behavior

Vulnerability Research

Identify vulnerable code paths and attack surfaces

Reverse Engineering

Visualize complex algorithms and data structures

Documentation

Generate visual documentation of program structure

Code Review

Review function interactions and dependencies

Performance Considerations

For Large Graphs:

Limit maximum depth in call graphs
Use filtering to reduce node count
Export to dedicated graph tools for massive graphs
Consider sampling for overview visualization

Graph Size Recommendations

Nodes	Performance	Recommendation
< 100	Excellent	Full interaction
100-500	Good	Minor delays
500-1000	Moderate	Use filtering
> 1000	Slow	Export to specialized tools

Troubleshooting

Graph Won't Display

Checks:

Verify graph service is available
Check for errors in console log
Try different graph provider
Ensure function/data is analyzable

Empty Graph Generated

Causes:

No relationships found (isolated function)
Depth limit too restrictive
Filtering too aggressive

Solution: Adjust parameters and rerun

Graph Performance Issues

Solutions:

Reduce maximum depth
Enable filtering
Export to external tool
Use hierarchical layout

Source Code References

# Graph framework
~/workspace/source/Ghidra/Framework/Graph/

# Graph features  
~/workspace/source/Ghidra/Features/Base/src/main/java/ghidra/app/plugin/core/graph/

# Help documentation
~/workspace/source/Ghidra/Features/Base/src/main/help/help/topics/Graph/

# Example scripts
~/workspace/source/Ghidra/Features/Base/ghidra_scripts/

Get Started

Core Concepts

User Guide

Advanced Features

Scripting & Automation

Extension Development

Processors & Formats

​Overview

​Graph Types

Function Call Graph

Control Flow Graph

Data Type Graph

Reference Graph

​Graph Services

​Service Providers

​Display Capabilities

​Function Call Graphs

​Generating Call Graphs

​Call Graph Features

​Graph Elements

​Control Flow Graphs

​Basic Blocks

​Edges

​Layout Options

Compact

Hierarchical

Nested

​Data Type Graphs

​Generating Type Graphs

​Type Graph Elements

​Graph Display Features

​Navigation and Selection

​Filtering

​Customization

​Export and Sharing

​Export Formats

​Programmatic Graph Generation

​Using Scripts

​Example Scripts

​Graph Services API

​Core Interfaces

​Graph Attributes

​Advanced Graphing

​Address-Based Graphs

​Custom Graph Providers

​Use Cases

Architecture Analysis

Malware Analysis

Vulnerability Research

Reverse Engineering

Documentation

Code Review

​Performance Considerations

​Graph Size Recommendations

​Troubleshooting

​Source Code References

​Next Steps

Program Diff

Version Tracking

Build docs developers (and LLMs) love

Overview

Graph Types

Graph Services

Service Providers

Display Capabilities

Function Call Graphs

Generating Call Graphs

Call Graph Features

Graph Elements

Control Flow Graphs

Basic Blocks

Edges

Layout Options

Data Type Graphs

Generating Type Graphs

Type Graph Elements

Graph Display Features

Navigation and Selection

Filtering

Customization

Export and Sharing

Export Formats

Programmatic Graph Generation

Using Scripts

Example Scripts

Graph Services API

Core Interfaces

Graph Attributes

Advanced Graphing

Address-Based Graphs

Custom Graph Providers

Use Cases

Performance Considerations

Graph Size Recommendations

Troubleshooting

Source Code References

Next Steps