I want to get the system call graph of the executable. Is this option available？I know -dcallgraph can get the call graph.

[lkpama]

No description provided.

[ivg]

Can you please define what do you mean by the "system call graph"?

[lkpama]

Can you please define what do you mean by the "system call graph"?

In fact, I want to get system calls , not all calls, like NtCreateFile,NeOpenFile , GetModuleHandle etc.

[ivg]

Typically, those calls a not made by a binary but by the corresponding system libraries that are linked by the binary, so you won't see them. If you will analyze the system libraries directly, you might see them, with encodings that depend on that binary and OS, e.g., they could be encoded as function calls or as CPU exceptions (CpuExn).

[ivg]

Feel free to drop by our gitter channel for further discussion. https://gitter.im/BinaryAnalysisPlatform/bap