# US 10,768,913 B2 · Method for performing deep static analysis with or without source code

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 10,768,913 B2
- Document ID: US10768913B2
- Status: Granted
- Kind: B2
- Application number: 16/264,373
- Filed: 2019-01-31
- Published: 2020-02-27
- Granted: 2020-09-08
- Earliest claimed: 2018-08-23
- Assignees: Oracle International Corporation
- Applicants: Oracle International Corporation
- Inventors: Liam Richard Howlett; Robert David Gardner
- Web page: https://patentgrep.com/patent/US10768913B2

## CPC

- G06F 8/43: {Checking; Contextual analysis}
- G06F 8/75: Structural analysis for program understanding
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)

## Abstract

A method may include initiating a static analysis of code including a first function, detecting, in the first function and by the static analysis, an indirect call to a second function whose identity is unknown until the code is executed, detecting, in the code, a conditional block including a first instruction sequence and a second instruction sequence, determining, by the static analysis, that the first instruction sequence sets a value that identifies the second function, and adding the value to a called function list for the code.

## Claims

### Claim 1

A method, comprising:
initiating a static analysis of object code comprising a first function, wherein the object code is generated from source code, and wherein the object code is external to the source code;
detecting, in the first function of the object code and by the static analysis of the object code, an indirect call to a second function of the object code whose identity is unknown until the object code is executed;
detecting, in the object code, a conditional block comprising a first instruction sequence and a second instruction sequence;
determining, by the static analysis, that the first instruction sequence sets a first value that identifies the second function; and
adding the first value to a called function list for the object code.

### Claim 2 (depends on 1)

The method of claim 1, further comprising:
determining that the second instruction sequence sets a second value that identifies the second function; and
adding the second value to the called function list.

### Claim 3 (depends on 1)

The method of claim 1, further comprising:
generating an alert when a function in the called function list satisfies a target predicate.

### Claim 4 (depends on 1)

The method of claim 1, further comprising:
instrumenting the object code to intercept, when the object code is executed, a call to a function in the called function list that satisfies a target predicate.

### Claim 5 (depends on 1)

The method of claim 1, wherein determining that the first instruction sequence sets the first value comprises
identifying a data flow from the first value to the indirect call.

### Claim 6 (depends on 1)

The method of claim 1, further comprising:
detecting, in the first function, a direct call to a third function of the object code whose identity is explicit in the direct call; and
adding an identifier of the third function to the called function list.

### Claim 7 (depends on 1)

The method of claim 1, further comprising:
detecting, in the first function, a call to a third function of the object code prior to the indirect call to the second function; and
detecting the conditional block in the third function.

### Claim 8 (depends on 1)

The method of claim 1, further comprising:
detecting, in the first function, a call to a third function prior to the indirect call to the second function;
failing to detect the conditional block in the third function; and
detecting the conditional block in the first function, wherein the conditional block occurs in the first function prior to the indirect call to the second function and prior to the call to the third function.

### Claim 9

A system, comprising:
a repository configured to store:
object code comprising a first function, wherein the object code is generated from source code, and wherein the object code is external to the source code, and
a called functions list for the object code;
a memory coupled to a computer processor; and
a tracing tool, executing on the computer processor and using the memory, configured to:
initiate a static analysis of the object code,
detect, in the first function of the object code and by the static analysis of the object code, an indirect call to a second function of the object code whose identity is unknown until the object code is executed,
detect, in the object code, a conditional block comprising a first instruction sequence and a second instruction sequence,
determine, by the static analysis, that the first instruction sequence sets a first value that identifies the second function, and
add the first value to the called function list.

### Claim 10 (depends on 9)

The system of claim 9, wherein the tracing tool is further configured to:
determine that the second instruction sequence sets a second value that identifies the second function; and
add the second value to the called function list.

### Claim 11 (depends on 9)

The system of claim 9, wherein the tracing tool is further configured to:
generate an alert when a function in the called function list satisfies a target predicate.

### Claim 12 (depends on 9)

The system of claim 9, wherein the tracing tool is further configured to:
instrument the object code to intercept, when the object code is executed, a call to a function in the called function list that satisfies a target predicate.

### Claim 13 (depends on 9)

The system of claim 9, wherein the tracing tool is further configured to determine that the first instruction sequence sets the first value by:
identifying a data flow from the first value to the indirect call.

### Claim 14 (depends on 9)

The system of claim 9, wherein the tracing tool is further configured to:
detect, in the first function, a direct call to a third function of the object code whose identity is explicit in the direct call; and
add an identifier of the third function to the called function list.

### Claim 15 (depends on 9)

The system of claim 9, wherein the tracing tool is further configured to:
detect, in the first function, a call to a third function of the object code prior to the indirect call to the second function; and
detect the conditional block in the third function.

### Claim 16

A non-transitory computer readable medium comprising instructions that, when executed by a computer processor, perform:
initiating a static analysis of object code comprising a first function, wherein the object code is generated from source code, and wherein the object code is external to the source code;
detecting, in the first function of the object code and by the static analysis of the object code, an indirect call to a second function of the object code whose identity is unknown until the object code is executed;
detecting, in the object code, a conditional block comprising a first instruction sequence and a second instruction sequence;
determining, by the static analysis, that the first instruction sequence sets a first value that identifies the second function; and
adding the first value to a called function list for the object code.

### Claim 17 (depends on 16)

The non-transitory computer readable medium of claim 16, further comprising instructions that perform:
determining that the second instruction sequence sets a second value that identifies the second function; and
adding the second value to the called function list.

### Claim 18 (depends on 16)

The non-transitory computer readable medium of claim 16, further comprising instructions that perform:
generating an alert when a function in the called function list satisfies a target predicate.

### Claim 19 (depends on 16)

The non-transitory computer readable medium of claim 16, wherein determining that the first instruction sequence sets the first value comprises:
identifying a data flow from the first value to the indirect call.

### Claim 20 (depends on 16)

The non-transitory computer readable medium of claim 16, further comprising instructions that perform:
detecting, in the first function, a call to a third function of the object code prior to the indirect call to the second function; and
detecting the conditional block in the third function.