TECHNIQUES FOR PERFORMING STATIC ANALYSIS ON DEPLOYED APPLICATION CODE
The present disclosure provides an approach of executing application code on a simulator and receiving a result from a hook in response to executing the application code. The hook corresponds to a call to a code object which is inaccessible to the simulator. The result is from an emulation of a connection response corresponding to the code object. The approach generates instructions based on the result and, in turn, performs static analysis on the application code based on the instructions.
1 . A method of detecting code initialization actions, comprising:
executing application code on a simulator;
receiving a result from a hook in response to the executing the application code, the hook corresponding to a call to a code object that is inaccessible to the simulator, and the result is from an emulation of a connection response corresponding to the code object;
generating, by processing circuitry, instructions based on the result; and
performing static analysis on the application code based on the instructions.
2 . The method of claim 1 , wherein, prior to receiving the result, the method further comprises:
detecting an anchor point in the application code; and
inserting the hook into the application code based on a location of the anchor point in the application code.
3 . The method of claim 2 , wherein the detecting the anchor point further comprises:
determining that a plurality of software classes inherit a primary software class; and
designating the primary software class as the anchor point.
4 . The method of claim 2 , wherein the detecting the anchor point further comprises:
determining that a software class name comprises at least one of a predetermined signature or a name having a predetermined alphanumeric string; and
designating a software class corresponding to the software class name as the anchor point.
5 . The method of claim 2 , wherein the anchor point is at least one of a function calling a database, a REST API (REpresentational State Transfer Application Programming Interface) call, a software library, an initialization code, an external configuration call, or a service request.
6 . The method of claim 1 , wherein the application code is deployed in a cloud computing environment and uses an external initialization framework.
7 . The method of claim 1 , wherein the hook is an instruction that, when executed by the application code, stores a state of the application code in a predetermined location.
8 . A non-transitory computer readable medium storing instructions that, when executed by processing circuitry, cause the processing circuitry to:
execute application code on a simulator;
receive a result from a hook in response to the execution of the application code, the hook corresponding to a call to a code object that is inaccessible to the simulator, and the result is from an emulation of a connection response corresponding to the code object;
generate, by the processing circuitry, a set of instructions based on the result; and
perform static analysis on the application code based on the set of instructions.
9 . The non-transitory computer readable medium of claim 8 , wherein the processing circuitry is further to:
detect an anchor point in the application code; and
insert the hook into the application code based on a location of the anchor point in the application code.
10 . The non-transitory computer readable medium of claim 9 , wherein the processing circuitry is further to:
determine that a plurality of software classes inherit a primary software class; and
designate the primary software class as the anchor point.
11 . The non-transitory computer readable medium of claim 9 , wherein the processing circuitry is further to:
determine that a software class name comprises at least one of a predetermined signature or a name having a predetermined alphanumeric string; and
designate a software class corresponding to the software class name as the anchor point.
12 . The non-transitory computer readable medium of claim 9 , wherein the anchor point is at least one of a function to call a database, a REST API (REpresentational State Transfer Application Programming Interface) call, a software library, an initialization code, an external configuration call, or a service request.
13 . The non-transitory computer readable medium of claim 8 , wherein the application code is deployed in a cloud computing environment and uses an external initialization framework.
14 . The non-transitory computer readable medium of claim 8 , wherein the hook is an instruction that, when executed by process, stores a state of the application code in a predetermined location.
15 . A system for detecting code initialization actions, comprising:
a memory; and
processing circuitry, that is operatively coupled to the memory, to:
execute application code on a simulator;
receive a result from a hook in response to the execution of the application code, the hook corresponding to a call to a code object that is inaccessible to the simulator, and the result is from an emulation of a connection response corresponding to the code object;
generate a set of instructions based on the result; and
perform static analysis on the application code based on the set of instructions.
16 . The system of claim 15 , wherein the processing circuitry is further to:
detect an anchor point in the application code; and
insert the hook into the application code based on a location of the anchor point in the application code.
17 . The system of claim 16 , wherein the processing circuitry is further to:
determine that a plurality of software classes inherit a primary software class; and
designate the primary software class as the anchor point.
18 . The system of claim 16 , wherein the processing circuitry is further to:
determine that a software class name comprises at least one of a predetermined signature or a name having a predetermined alphanumeric string; and
designate a software class corresponding to the software class name as the anchor point.
19 . The system of claim 15 , wherein the hook is an instruction that, when executed by the processing circuitry, stores a state of the application code in a predetermined location.
20 . The system of claim 15 , wherein the application code is deployed in a cloud computing environment and uses an external initialization framework.