@@ -187,6 +187,19 @@ let save_arm_functions_list () =
   end
 
 
+let save_arm_callgraph () =
+  let filename = get_callgraph_filename () in
+  let doc = xmlDocument () in
+  let root = get_bch_root "callgraph" in
+  let cNode = xmlElement "callgraph" in
+  let callgraph = BCHARMAssemblyFunctions.arm_assembly_functions#get_callgraph in
+  begin
+    callgraph#write_xml cNode;
+    doc#setNode root;
+    root#appendChildren [cNode];
+    file_output#saveFile filename doc#toPretty
+  end
+
 
 let save_global_state () =
   let filename = get_global_state_filename () in
 
@@ -41,6 +41,7 @@ val save_functions_list: unit -> unit
 
 (** save function cfg info for arm functions *)
 val save_arm_functions_list: unit -> unit
+val save_arm_callgraph: unit -> unit
 
 val save_global_state: unit -> unit
 val save_global_memory_map: unit -> unit
 
@@ -116,6 +116,7 @@ let add_print_datasection (s: string) =
     print_datasections := s :: !print_datasections
 
 let save_asm_cfg_info = ref false  (* save functions list with cfg info in xml *)
+let save_asm_callgraph = ref false (* save callgraph edges based on disassembly *)
 let set_datablocks = ref false   (* only supported for arm *)
 let construct_all_functions = ref false
 
@@ -226,6 +227,8 @@ let speclist =
      "save assembly listing in the analysis directory");
     ("-save_asm_cfg_info", Arg.Unit (fun () -> save_asm_cfg_info := true),
      "save list of functions with cfg info to xml file (may be slow)");
+    ("-save_asm_callgraph", Arg.Unit (fun () -> save_asm_callgraph := true),
+     "save list of callgraph edges based on disassembly only in xml");
     ("-print_datasection", Arg.String (fun s -> add_print_datasection s),
      "print the data sections as part of the assembly listing");
     ("-construct_all_functions",
@@ -618,7 +621,12 @@ let main () =
             (if !save_asm_cfg_info then
                begin
                  save_arm_functions_list ();
-                 pr_timing [STR "function cfg info saved"]
+                 pr_timing [STR "function cfg info saved"];
+               end);
+            (if !save_asm_callgraph then
+               begin
+                 save_arm_callgraph ();
+                 pr_timing [STR "callgraph saved"]
                end);
             save_system_info ();
             pr_timing [STR "system_info saved"];
 
@@ -151,6 +151,7 @@ object ('a)
   method get_constraint        : xpr_t
   method get_stack_arguments   : (int * xpr_t) list
   method get_register_arguments: (variable_t * xpr_t) list
+  method write_xml             : xml_element_int -> unit
 
   (* printing *)
   method toPretty : pretty_t
@@ -223,7 +224,7 @@ class callgraph_edge_t
         (callsite:ctxt_iaddress_t)
         (_argExprs:(int * string * xpr_t) list)
       :callgraph_edge_int =
-object (_:'a)
+object (self:'a)
 
   method compare (other:'a) =
     let l0 = src#compare other#get_source in
@@ -246,6 +247,18 @@ object (_:'a)
 
   method get_register_arguments = []
 
+  method write_xml (node: xml_element_int) =
+    let set = node#setAttribute in
+    let seta t a = set t a#to_hex_string in
+    let tgtinfo = new callgraph_node_info_t self#get_target in
+    let tgtnode = xmlElement "tgt" in
+    begin
+      seta "src" self#get_source;
+      set "cs" self#get_callsite;
+      tgtinfo#write_xml tgtnode;
+      node#appendChildren [tgtnode]
+    end
+
   method toPretty =
     LBLOCK [ src#toPretty ; STR " -> " ;
              callgraph_node_to_pretty tgt ; STR " @ " ;
@@ -349,7 +362,14 @@ object (self)
     let eNode = xmlElement "edges" in
     let edges = ref [] in
     let _ = out_n#iter (fun _ s -> edges := s#toList @ !edges) in
-      node#appendChildren [ eNode ]
+    let _ =
+      List.iter (fun e ->
+          let edgenode = xmlElement "edge" in
+          begin
+            e#write_xml edgenode;
+            eNode#appendChildren [edgenode]
+          end) !edges in
+    node#appendChildren [eNode]
 
 end
 
 
@@ -328,6 +328,14 @@ let get_functions_filename () =
   let _ = create_directory fdir in
   Filename.concat fdir (exename ^ "_functions.xml")
 
+
+let get_callgraph_filename () =
+  let exename = get_filename () in
+  let fdir = get_analysis_dir () in
+  let _ = create_directory fdir in
+  Filename.concat fdir (exename ^ "_callgraph.xml")
+
+
 let get_function_filename (fname:string) (ext:string) =
   let exename = get_filename () in
   let fdir = get_analysis_dir () in
 
@@ -55,6 +55,7 @@ val get_pwr_dictionary_filename: unit -> string
 val get_pwr_assembly_instructions_filename: unit -> string
 
 val get_functions_filename: unit -> string
+val get_callgraph_filename: unit -> string
 val get_global_state_filename: unit -> string
 val get_global_memory_map_filename: unit -> string
 val get_system_info_filename: unit -> string
 
@@ -95,8 +95,8 @@ end
 
 
 let version = new version_info_t 
-  ~version:"0.6.0_20260909"
-  ~date:"2026-0909"
+  ~version:"0.6.0_20260930"
+  ~date:"2026-09-30"
   ~licensee: None
   ~maxfilesize: None
   ()
@@ -229,8 +229,28 @@ object (self)
     List.iter (fun (b:arm_assembly_block_int) ->
         b#itera (fun iaddr instr -> f faddr iaddr instr)) self#get_blocks
 
-  method populate_callgraph (_callgraph: callgraph_int) =
-    self#iteri (fun _ _iaddr _instr -> ())
+  method populate_callgraph (callgraph: callgraph_int) =
+    let finfo = BCHFunctionInfo.get_function_info faddr in
+    self#iteri (fun _ iaddr instr ->
+        match instr#get_opcode with
+        | BranchLink _
+          | BranchLinkExchange _
+          | Branch _ ->
+           if finfo#has_call_target iaddr then
+             let rec add_call_target tgt =
+               match tgt with
+               | StubTarget (SOFunction name)
+                 | StaticStubTarget (_, SOFunction name) ->
+                  callgraph#add_so_edge faddr name iaddr []
+               | AppTarget a -> callgraph#add_app_edge faddr a iaddr []
+               | UnknownTarget ->
+                  callgraph#add_unresolved_edge faddr (-1) iaddr []
+               | IndirectTarget (_, tgts) -> List.iter add_call_target tgts
+               | _ -> () in
+             add_call_target (finfo#get_call_target iaddr)#get_target
+           else
+             ()
+        | _ -> () )
 
   method includes_instruction_address (va:doubleword_int) =
     List.exists (fun b -> b#includes_instruction_address va) blocks
 
@@ -1632,6 +1632,9 @@ object (self)
             ) rmdefs);
        end
 
+    | ReverseSubtract (_, _, rd, _, _, _) ->
+       regvar_type_introduction "RSB" rd
+
     | SignedMultiplyLong (_, _, rdlo, rdhi, rn, rm) ->
        let rdloreg = rdlo#to_register in
        let lhslotypevar = mk_reglhs_typevar rdloreg faddr iaddr in