Deep Static Analysis of Compiled Code Indirect Calls

Solution Overview

Problem

Existing static analysis methods are incomplete as they rely on dynamic tracing, which is input and path-dependent, making it difficult to determine all potential function calls in compiled applications without access to source code, especially in cloud-based environments where source code may be unavailable.

Innovation Solution

A method for deep static analysis that detects indirect calls and conditional blocks in compiled code, tracing data flows to identify potentially called functions and accumulating them in a called function list, which can be filtered using a target predicate for security analysis.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Adaptability or versatility

If dynamic tracing is used to analyze compiled applications, then the analysis can be performed without source code, but the set of observed calls is incomplete and depends on specific inputs and code paths

Engineering Contradiction:

Improveability to analyze without source codeVSAvoidcompleteness of called functions list

Core Design Contradiction:

Adaptability or versatilityVSReliability

Solution Approach 1:

The patent performs preliminary static analysis on compiled code to identify indirect call sites and conditional blocks before execution. By analyzing the code structure in advance to detect function pointer assignments and conditional logic, the system prepares a comprehensive set of potential called functions that will be validated during dynamic execution, ensuring both source code independence and complete function discovery

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The patent introduces an intermediary analysis layer that combines static code inspection with dynamic execution tracing. This intermediary approach uses static analysis to identify potential indirect call targets and conditional branches, then uses dynamic tracing to validate which functions are actually called, merging the advantages of both approaches to overcome their individual limitations

Inventive Principle:

Principle #24Intermediary (Mediator)

2Reliability

If static analysis is used to determine all potential function calls, then the called functions list is complete, but it cannot handle indirect calls in compiled code without source code access

Engineering Contradiction:

Improvecompleteness of called functions listVSAvoidability to analyze compiled code without source code

Core Design Contradiction:

ReliabilityVSAdaptability or versatility

Solution Approach 1:

The patent performs preliminary static analysis on compiled code to identify indirect call sites and conditional blocks before execution. By analyzing the code structure in advance to detect function pointer assignments and conditional logic, the system prepares a comprehensive set of potential called functions that will be validated during dynamic execution, ensuring both source code independence and complete function discovery

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The patent substitutes traditional source code-based static analysis with a binary analysis approach that operates directly on compiled machine code. By replacing the need for source code parsing with binary instrumentation and pattern matching on machine instructions, the system achieves static analysis capabilities on compiled code without requiring source code access

Inventive Principle:

Principle #28Mechanics substitution (Replace mechanical system)

Data Source

PatentUS10768913B2Method for performing deep static analysis with or without source code

Publication Date: 2020.09.08 ORACLE INT CORP

AI summary

A method may include initiating a static analysis of code including a first function, detecting, in the first function and by the static analysis, an indirect call to a second function whose identity is unknown until the code is executed, detecting, in the code, a conditional block including a first instruction sequence and a second instruction sequence, determining, by the static analysis, that the first instruction sequence sets a value that identifies the second function, and adding the value to a called function list for the code.