What is the logic of discovering cwe?

[Shmily8421]

As stated in the title

[Enkelmann]

Depends on the CWE and its corresponding CWE check. ;-) We employ different analysis techniques for different CWEs, ranging from simple heuristics to more complex data flow analyses. And since the cwe_checker is a research project, we are still improving the different checks and analysis techniques. If you are interested in a specific CWE check I can talk about the internals of that check.

[Shmily8421]

Mm-hmm. In fact, the most important thing in this project is the analysis module, because its degree determines the degree to which it can be analyzed later, and this module is very complex.

[Enkelmann]

Yes.

[Shmily8421]

Okay, thank u so mush!

[Shmily8421]

If you have time, can you explain the logic of the build graph? I really don't understand how this graph is built.

[Enkelmann]

• For each basic block contained in the program we add two nodes (a block start node and a block end node) and an edge between them to the graph. Actually, every basic block node is labeled by the block ID and the sub ID in which it is contained. But this is an artifact from previous times where basic blocks could happen to be contained in more than one function, which is not longer the case.
• For direct jumps and indirect jumps where Ghidra gives us a list of possible jump targets we add an edge from the block end node of the source of the jump to the block start node of the target of the jump.
• For calls to external functions we add an edge from the block end node of the block containing the call to the block start node of the basic block that the call returns to. And the edge is labeled as an external call.
• For call to other functions inside the analyzed binary we add two nodes and a bunch of edges. This is actually described in the documentation comment of the graph module.
• Currently, we treat indirect calls as if they were calls to unknown external functions and add extern call edges for them. This is because we have not yet implemented an analysis identifying the targets of indirect calls.

Especially the addition of the call-specific nodes and edges can be a bit confusing to read, since we first have to collect all the call sites and return sites before we can add them. And one function may contain more than one return instruction, which further complicates things.