What problems does the static analysis of call schedules analyze?

Question

What problems can one hope to find by analyzing the static call schedule in the program? FxCop uses static call graph analysis, what problems does it find with this technique?

http://msdn.microsoft.com/library/bb429476.aspx
http://en.wikipedia.org/wiki/Callgraph

Apologizing for the lack of knowledge, I found some information through Google, but I'm afraid that it is very incomplete. Thanks!

Answer 1

Here is what I found:

Call graphs are used to detect problems with program execution, breaking recommended recommendations, and possible attacks using code.

By creating a graph of the relationship between different methods, it is easy to see where problems can occur at certain times, when certain methods are called, or how certain methods are called. It is easy to see when a procedure / function may violate rules such as maintaining code modularity. It is easy to see where malicious code can be entered at specific points due to these challenging relationships and how they are structured. In this way, call diagrams provide context for static analysis, providing more accurate results.

Since FxCop uses static call curves, it can only guess about the above value.

Answer 2

The graph graph itself is simple; there are no “wrong” call schedules (unless you have a style check that prohibits recursion).

The real problem is that to understand how code at a point in a program can be problematic, you usually need to understand the shape of the world (what data structures live, what values ​​they can contain, what relationships they can have) in that The moment when this code point is active. The call schedule shows how execution can get to the point of interest to the code, and all the code along this route of the call schedule sets the context for the code execution. This allows the static analyzer to perform "context-sensitive" analysis, which gives much more accurate answers.

This leads to a second problem: how to get an accurate call schedule? If you have a direct call B from A, it’s easy to record “A calls B” and feel that this is an accurate fact of the fact of the call. But if A makes a call through an indirect pointer (can you say that sending a virtual method?) Suddenly it is not clear who exactly is calling; you end up with A-can-call-B1, A-can-call-B2, ... Which one actually actually calls depends on the context in which A ... oops is executed, you need a call graph to produce a call graph. The good news is that you are plotting a call schedule from below: "I know that this is certainly true, so this must be true." In places where the analgesic cannot understand this, he usually makes a conservative assumption: ("All these challenges may be possible, I cannot rule them out."). This conservatism is one of the key reasons for the accuracy of your static analyzer.