public interface

ICallGraph

com.pnfsoftware.jeb.core.units.code.asm.analyzer.ICallGraph

Class Overview

Callgraphs represent control flow relationships between routines; they are composed of CallGraphVertex connected with CallGraphEdge.

Notes:

Note: semantic of callgraph edges is slightly different than ROUTINE_CALL code references: callgraph edges comprehend any code redirections to a routine (ie, including those done with simple branches -- no routine call instructions).

Summary

Public Methods
abstract List<INativeMethodItem> getCalleeRoutines(long caller, boolean onlySafeCalls)
Get the routines called by an internal address.
abstract List<CallGraphVertex> getCallees(long callerInternalAddress, boolean onlySafeCalls)
Get the targets called from a given instruction.
abstract List<CallGraphVertex> getCallees(INativeMethodItem rtn, boolean onlySafeCalls)
Convenience method to get all the targets called by an internal routine.
abstract List<INativeMethodItem> getCallerRoutines(EntryPointDescription callee, boolean onlySafeCalls)
Get the routines calling an internal address.
abstract List<Long> getCallers(INativeMethodItem rtn, boolean onlySafeCalls)
Convenience method to get all the addresses calling a routine.
abstract List<Long> getCallers(CallGraphVertex callee, boolean onlySafeCalls)
Get the addresses calling a given target.
abstract void recordExternalCall(long callerInternalAddress, INativeMethodItem calleeExternalRtn, boolean isSafe)
Records a call between an internal address and an external routine.
abstract void recordInternalCall(long callerInternalAddress, EntryPointDescription calleeInternalAddress, boolean isSafe)
Records a call between two internal addresses.
abstract void recordUnresolvedCall(long callerInternalAddress, long calleeDereferencedAddress, boolean isSafe)
Records an unresolved call, i.e.
abstract void removeCallRelationship(long address)
Remove all registered call relationships (from and to) a given internal address.

Public Methods

public abstract List<INativeMethodItem> getCalleeRoutines (long caller, boolean onlySafeCalls)

Get the routines called by an internal address.

Parameters
onlySafeCalls if true only calls resulting from a safe analysis will be considered
Returns
  • routines called by the instruction at the given address, never null

public abstract List<CallGraphVertex> getCallees (long callerInternalAddress, boolean onlySafeCalls)

Get the targets called from a given instruction.

Parameters
onlySafeCalls if true only calls resulting from a safe analysis will be considered
Returns
  • called targets, never null

public abstract List<CallGraphVertex> getCallees (INativeMethodItem rtn, boolean onlySafeCalls)

Convenience method to get all the targets called by an internal routine. A target may appear several times in the result, once for each call from the routine.

Parameters
onlySafeCalls if true only calls resulting from a safe analysis will be considered
Returns
  • targets called by the given routine, never null
Throws
IllegalArgumentException on external routines

public abstract List<INativeMethodItem> getCallerRoutines (EntryPointDescription callee, boolean onlySafeCalls)

Get the routines calling an internal address.

Parameters
onlySafeCalls if true only calls resulting from a safe analysis will be considered
Returns
  • routines calling the given address, never null

public abstract List<Long> getCallers (INativeMethodItem rtn, boolean onlySafeCalls)

Convenience method to get all the addresses calling a routine.

Parameters
onlySafeCalls if true only calls resulting from a safe analysis will be considered
Returns
  • addresses calling the given routine, never null

public abstract List<Long> getCallers (CallGraphVertex callee, boolean onlySafeCalls)

Get the addresses calling a given target.

Parameters
onlySafeCalls if true only calls resulting from a safe analysis will be considered
Returns
  • callers addresses, never null

public abstract void recordExternalCall (long callerInternalAddress, INativeMethodItem calleeExternalRtn, boolean isSafe)

Records a call between an internal address and an external routine.

Parameters
isSafe if true, the call relationship has been computed by a safe analysis, otherwise it was computed by an unsafe analysis

public abstract void recordInternalCall (long callerInternalAddress, EntryPointDescription calleeInternalAddress, boolean isSafe)

Records a call between two internal addresses.

Parameters
isSafe if true, the call relationship has been computed by a safe analysis, otherwise it was computed by an unsafe analysis

public abstract void recordUnresolvedCall (long callerInternalAddress, long calleeDereferencedAddress, boolean isSafe)

Records an unresolved call, i.e. a call for which the final target is unknown, but for which a dereferenced memory address is known.

Parameters
isSafe if true, the call relationship has been computed by a safe analysis, otherwise it was computed by an unsafe analysis

public abstract void removeCallRelationship (long address)

Remove all registered call relationships (from and to) a given internal address.