com.pnfsoftware.jeb.core.units.code.asm.analyzer.ICallGraph |
Callgraphs represent control flow relationships between routines; they are composed of
CallGraphVertex
connected with CallGraphEdge.
Notes:
recordExternalCall(long, INativeMethodItem, boolean)
),
an unresolved location (recordUnresolvedCall(long, long, boolean)
) or an internal location
(recordInternalCall(long, EntryPointDescription, boolean)
), the 'caller' has to be an internal location with a defined
instruction.
INativeCodeAdvancedAnalyzer
)
Note: semantic of callgraph edges is slightly different than ROUTINE_CALL
code references: callgraph edges comprehend any code redirections to a routine (ie, including
those done with simple branches -- no routine call instructions).
Public Methods | |||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|
abstract List<INativeMethodItem> |
getCalleeRoutines(long caller, boolean onlySafeCalls)
Get the routines called by an internal address.
| ||||||||||
abstract List<CallGraphVertex> |
getCallees(long callerInternalAddress, boolean onlySafeCalls)
Get the targets called from a given instruction.
| ||||||||||
abstract List<CallGraphVertex> |
getCallees(INativeMethodItem rtn, boolean onlySafeCalls)
Convenience method to get all the targets called by an internal routine.
| ||||||||||
abstract List<INativeMethodItem> |
getCallerRoutines(EntryPointDescription callee, boolean onlySafeCalls)
Get the routines calling an internal address.
| ||||||||||
abstract List<Long> |
getCallers(INativeMethodItem rtn, boolean onlySafeCalls)
Convenience method to get all the addresses calling a routine.
| ||||||||||
abstract List<Long> |
getCallers(CallGraphVertex callee, boolean onlySafeCalls)
Get the addresses calling a given target.
| ||||||||||
abstract void |
recordExternalCall(long callerInternalAddress, INativeMethodItem calleeExternalRtn, boolean isSafe)
Records a call between an internal address and an external routine.
| ||||||||||
abstract void |
recordInternalCall(long callerInternalAddress, EntryPointDescription calleeInternalAddress, boolean isSafe)
Records a call between two internal addresses.
| ||||||||||
abstract void |
recordUnresolvedCall(long callerInternalAddress, long calleeDereferencedAddress, boolean isSafe)
Records an unresolved call, i.e.
| ||||||||||
abstract void |
removeCallRelationship(long address)
Remove all registered call relationships (from and to) a given internal address.
|
Get the routines called by an internal address.
onlySafeCalls | if true only calls resulting from a safe analysis will be considered |
---|
Get the targets called from a given instruction.
onlySafeCalls | if true only calls resulting from a safe analysis will be considered |
---|
Convenience method to get all the targets called by an internal routine. A target may appear several times in the result, once for each call from the routine.
onlySafeCalls | if true only calls resulting from a safe analysis will be considered |
---|
IllegalArgumentException | on external routines |
---|
Get the routines calling an internal address.
onlySafeCalls | if true only calls resulting from a safe analysis will be considered |
---|
Convenience method to get all the addresses calling a routine.
onlySafeCalls | if true only calls resulting from a safe analysis will be considered |
---|
Get the addresses calling a given target.
onlySafeCalls | if true only calls resulting from a safe analysis will be considered |
---|
Records a call between an internal address and an external routine.
isSafe | if true, the call relationship has been computed by a safe analysis, otherwise it was computed by an unsafe analysis |
---|
Records a call between two internal addresses.
isSafe | if true, the call relationship has been computed by a safe analysis, otherwise it was computed by an unsafe analysis |
---|
Records an unresolved call, i.e. a call for which the final target is unknown, but for which a dereferenced memory address is known.
isSafe | if true, the call relationship has been computed by a safe analysis, otherwise it was computed by an unsafe analysis |
---|
Remove all registered call relationships (from and to) a given internal address.