Interface ICallGraph
Callgraphs represent control flow relationships between routines. they are composed of
CallGraphVertex
s connected by CallGraphEdge
s.
Notes:
- while the 'callee' location can be either an external routine (
recordExternalCall(long, com.pnfsoftware.jeb.core.units.code.asm.items.INativeMethodItem, boolean)
), an unresolved location (recordUnresolvedCall(long, long, boolean)
) or an internal location (recordInternalCall(long, com.pnfsoftware.jeb.core.units.code.CodePointer, boolean)
), the 'caller' has to be an internal location with a defined instruction. - callgraphs distinguish calls computed by safe analysis versus those computed by unsafe
analysis (e.g.
INativeCodeAdvancedAnalyzer
)
Note: semantic of callgraph edges is slightly different than ReferenceType.ROUTINE_CALL
code references: callgraph edges comprehend any code redirections to a routine (ie, including
those done with simple branches -- no routine call instructions).
-
Method Summary
Modifier and TypeMethodDescriptiongetCalleeRoutines
(long caller, boolean onlySafeCalls) Get the routines called by an internal address.getCallees
(long callerInternalAddress, boolean onlySafeCalls) Get the targets called from a given instruction.getCallees
(INativeMethodItem rtn, boolean onlySafeCalls) Convenience method to get all the targets called by an internal routine.getCallerRoutines
(CodePointer callee, boolean onlySafeCalls) Get the routines calling an internal address.getCallers
(CallGraphVertex callee, boolean onlySafeCalls) Get the addresses calling a given target.getCallers
(INativeMethodItem rtn, boolean onlySafeCalls) Convenience method to get all the addresses calling a routine.void
recordExternalCall
(long callerInternalAddress, INativeMethodItem calleeExternalRtn, boolean isSafe) Records a call between an internal address and an external routine.void
recordInternalCall
(long callerInternalAddress, CodePointer calleeInternalAddress, boolean isSafe) Records a call between two internal addresses.void
recordUnresolvedCall
(long callerInternalAddress, long calleeDereferencedAddress, boolean isSafe) Records an unresolved call, i.e.void
removeCallRelationship
(long address) Remove all registered call relationships (from and to) a given internal address.
-
Method Details
-
recordInternalCall
void recordInternalCall(long callerInternalAddress, CodePointer calleeInternalAddress, boolean isSafe) Records a call between two internal addresses.- Parameters:
callerInternalAddress
-calleeInternalAddress
-isSafe
- if true, the call relationship has been computed by a safe analysis, otherwise it was computed by an unsafe analysis
-
recordExternalCall
void recordExternalCall(long callerInternalAddress, INativeMethodItem calleeExternalRtn, boolean isSafe) Records a call between an internal address and an external routine.- Parameters:
callerInternalAddress
-calleeExternalRtn
-isSafe
- if true, the call relationship has been computed by a safe analysis, otherwise it was computed by an unsafe analysis
-
recordUnresolvedCall
void recordUnresolvedCall(long callerInternalAddress, long calleeDereferencedAddress, boolean isSafe) Records an unresolved call, i.e. a call for which the final target is unknown, but for which a dereferenced memory address is known.- Parameters:
callerInternalAddress
-calleeDereferencedAddress
-isSafe
- if true, the call relationship has been computed by a safe analysis, otherwise it was computed by an unsafe analysis
-
removeCallRelationship
void removeCallRelationship(long address) Remove all registered call relationships (from and to) a given internal address.- Parameters:
address
-
-
getCallees
Get the targets called from a given instruction.- Parameters:
callerInternalAddress
-onlySafeCalls
- if true only calls resulting from a safe analysis will be considered- Returns:
- called targets, never null
-
getCallees
Convenience method to get all the targets called by an internal routine. A target may appear several times in the result, once for each call from the routine.- Parameters:
rtn
-onlySafeCalls
- if true only calls resulting from a safe analysis will be considered- Returns:
- targets called by the given routine, never null
- Throws:
IllegalArgumentException
- on external routines
-
getCalleeRoutines
Get the routines called by an internal address.- Parameters:
caller
-onlySafeCalls
- if true only calls resulting from a safe analysis will be considered- Returns:
- routines called by the instruction at the given address, never null
-
getCallers
Get the addresses calling a given target.- Parameters:
callee
-onlySafeCalls
- if true only calls resulting from a safe analysis will be considered- Returns:
- callers addresses, never null
-
getCallers
Convenience method to get all the addresses calling a routine.- Parameters:
rtn
-onlySafeCalls
- if true only calls resulting from a safe analysis will be considered- Returns:
- addresses calling the given routine, never null
-
getCallerRoutines
Get the routines calling an internal address.- Parameters:
callee
-onlySafeCalls
- if true only calls resulting from a safe analysis will be considered- Returns:
- routines calling the given address, never null
-