Interface ICallGraph


@Ser public interface ICallGraph
Callgraphs represent control flow relationships between routines. they are composed of CallGraphVertexs connected by CallGraphEdges.

Notes:

Note: semantic of callgraph edges is slightly different than ReferenceType.ROUTINE_CALL code references: callgraph edges comprehend any code redirections to a routine (ie, including those done with simple branches -- no routine call instructions).

  • Method Details

    • recordInternalCall

      void recordInternalCall(long callerInternalAddress, CodePointer calleeInternalAddress, boolean isSafe)
      Records a call between two internal addresses.
      Parameters:
      callerInternalAddress -
      calleeInternalAddress -
      isSafe - if true, the call relationship has been computed by a safe analysis, otherwise it was computed by an unsafe analysis
    • recordExternalCall

      void recordExternalCall(long callerInternalAddress, INativeMethodItem calleeExternalRtn, boolean isSafe)
      Records a call between an internal address and an external routine.
      Parameters:
      callerInternalAddress -
      calleeExternalRtn -
      isSafe - if true, the call relationship has been computed by a safe analysis, otherwise it was computed by an unsafe analysis
    • recordUnresolvedCall

      void recordUnresolvedCall(long callerInternalAddress, long calleeDereferencedAddress, boolean isSafe)
      Records an unresolved call, i.e. a call for which the final target is unknown, but for which a dereferenced memory address is known.
      Parameters:
      callerInternalAddress -
      calleeDereferencedAddress -
      isSafe - if true, the call relationship has been computed by a safe analysis, otherwise it was computed by an unsafe analysis
    • removeCallRelationship

      void removeCallRelationship(long address)
      Remove all registered call relationships (from and to) a given internal address.
      Parameters:
      address -
    • getCallees

      List<CallGraphVertex> getCallees(long callerInternalAddress, boolean onlySafeCalls)
      Get the targets called from a given instruction.
      Parameters:
      callerInternalAddress -
      onlySafeCalls - if true only calls resulting from a safe analysis will be considered
      Returns:
      called targets, never null
    • getCallees

      List<CallGraphVertex> getCallees(INativeMethodItem rtn, boolean onlySafeCalls)
      Convenience method to get all the targets called by an internal routine. A target may appear several times in the result, once for each call from the routine.
      Parameters:
      rtn -
      onlySafeCalls - if true only calls resulting from a safe analysis will be considered
      Returns:
      targets called by the given routine, never null
      Throws:
      IllegalArgumentException - on external routines
    • getCalleeRoutines

      List<INativeMethodItem> getCalleeRoutines(long caller, boolean onlySafeCalls)
      Get the routines called by an internal address.
      Parameters:
      caller -
      onlySafeCalls - if true only calls resulting from a safe analysis will be considered
      Returns:
      routines called by the instruction at the given address, never null
    • getCallers

      List<Long> getCallers(CallGraphVertex callee, boolean onlySafeCalls)
      Get the addresses calling a given target.
      Parameters:
      callee -
      onlySafeCalls - if true only calls resulting from a safe analysis will be considered
      Returns:
      callers addresses, never null
    • getCallers

      List<Long> getCallers(INativeMethodItem rtn, boolean onlySafeCalls)
      Convenience method to get all the addresses calling a routine.
      Parameters:
      rtn -
      onlySafeCalls - if true only calls resulting from a safe analysis will be considered
      Returns:
      addresses calling the given routine, never null
    • getCallerRoutines

      List<INativeMethodItem> getCallerRoutines(CodePointer callee, boolean onlySafeCalls)
      Get the routines calling an internal address.
      Parameters:
      callee -
      onlySafeCalls - if true only calls resulting from a safe analysis will be considered
      Returns:
      routines calling the given address, never null