Method for performing deep static analysis with or without source code
A method may include initiating a static analysis of code including a first function, detecting, in the first function and by the static analysis, an indirect call to a second function whose identity is unknown until the code is executed, detecting, in the code, a conditional block including a first instruction sequence and a second instruction sequence, determining, by the static analysis, that the first instruction sequence sets a value that identifies the second function, and adding the value to a called function list for the code.
1. A method, comprising:
initiating a static analysis of object code comprising a first function, wherein the object code is generated from source code, and wherein the object code is external to the source code;
detecting, in the first function of the object code and by the static analysis of the object code, an indirect call to a second function of the object code whose identity is unknown until the object code is executed;
detecting, in the object code, a conditional block comprising a first instruction sequence and a second instruction sequence;
determining, by the static analysis, that the first instruction sequence sets a first value that identifies the second function; and
adding the first value to a called function list for the object code.
2. The method of claim 1 , further comprising:
determining that the second instruction sequence sets a second value that identifies the second function; and
adding the second value to the called function list.
3. The method of claim 1 , further comprising:
generating an alert when a function in the called function list satisfies a target predicate.
4. The method of claim 1 , further comprising:
instrumenting the object code to intercept, when the object code is executed, a call to a function in the called function list that satisfies a target predicate.
5. The method of claim 1 , wherein determining that the first instruction sequence sets the first value comprises
identifying a data flow from the first value to the indirect call.
6. The method of claim 1 , further comprising:
detecting, in the first function, a direct call to a third function of the object code whose identity is explicit in the direct call; and
adding an identifier of the third function to the called function list.
7. The method of claim 1 , further comprising:
detecting, in the first function, a call to a third function of the object code prior to the indirect call to the second function; and
detecting the conditional block in the third function.
8. The method of claim 1 , further comprising:
detecting, in the first function, a call to a third function prior to the indirect call to the second function;
failing to detect the conditional block in the third function; and
detecting the conditional block in the first function, wherein the conditional block occurs in the first function prior to the indirect call to the second function and prior to the call to the third function.
9. A system, comprising:
a repository configured to store:
object code comprising a first function, wherein the object code is generated from source code, and wherein the object code is external to the source code, and
a called functions list for the object code;
a memory coupled to a computer processor; and
a tracing tool, executing on the computer processor and using the memory, configured to:
initiate a static analysis of the object code,
detect, in the first function of the object code and by the static analysis of the object code, an indirect call to a second function of the object code whose identity is unknown until the object code is executed,
detect, in the object code, a conditional block comprising a first instruction sequence and a second instruction sequence,
determine, by the static analysis, that the first instruction sequence sets a first value that identifies the second function, and
add the first value to the called function list.
10. The system of claim 9 , wherein the tracing tool is further configured to:
determine that the second instruction sequence sets a second value that identifies the second function; and
add the second value to the called function list.
11. The system of claim 9 , wherein the tracing tool is further configured to:
generate an alert when a function in the called function list satisfies a target predicate.
12. The system of claim 9 , wherein the tracing tool is further configured to:
instrument the object code to intercept, when the object code is executed, a call to a function in the called function list that satisfies a target predicate.
13. The system of claim 9 , wherein the tracing tool is further configured to determine that the first instruction sequence sets the first value by:
identifying a data flow from the first value to the indirect call.
14. The system of claim 9 , wherein the tracing tool is further configured to:
detect, in the first function, a direct call to a third function of the object code whose identity is explicit in the direct call; and
add an identifier of the third function to the called function list.
15. The system of claim 9 , wherein the tracing tool is further configured to:
detect, in the first function, a call to a third function of the object code prior to the indirect call to the second function; and
detect the conditional block in the third function.
16. A non-transitory computer readable medium comprising instructions that, when executed by a computer processor, perform:
initiating a static analysis of object code comprising a first function, wherein the object code is generated from source code, and wherein the object code is external to the source code;
detecting, in the first function of the object code and by the static analysis of the object code, an indirect call to a second function of the object code whose identity is unknown until the object code is executed;
detecting, in the object code, a conditional block comprising a first instruction sequence and a second instruction sequence;
determining, by the static analysis, that the first instruction sequence sets a first value that identifies the second function; and
adding the first value to a called function list for the object code.
17. The non-transitory computer readable medium of claim 16 , further comprising instructions that perform:
determining that the second instruction sequence sets a second value that identifies the second function; and
adding the second value to the called function list.
18. The non-transitory computer readable medium of claim 16 , further comprising instructions that perform:
generating an alert when a function in the called function list satisfies a target predicate.
19. The non-transitory computer readable medium of claim 16 , wherein determining that the first instruction sequence sets the first value comprises:
identifying a data flow from the first value to the indirect call.
20. The non-transitory computer readable medium of claim 16 , further comprising instructions that perform:
detecting, in the first function, a call to a third function of the object code prior to the indirect call to the second function; and
detecting the conditional block in the third function.