mirror of
https://github.com/hohn/codeql-workshop-dataflow-c.git
synced 2025-12-16 10:33:04 +01:00
153 lines
4.8 KiB
Org Mode
153 lines
4.8 KiB
Org Mode
#+HTML_HEAD_EXTRA: <style> .scrollable-svg { max-height: 800px; overflow-y: auto; display: block; } </style>
|
|
|
|
* CodeQL AST in dot and pdf
|
|
The control flow graph is narrowed to the function of interest,
|
|
#+BEGIN_SRC c++
|
|
int copy_mem(unsigned int unused, dyn_input_t *input,
|
|
unsigned int input_types) {...}
|
|
|
|
#+END_SRC
|
|
from [[./tests-common/test_part1.c]], so we do the same for the AST.
|
|
|
|
#+BEGIN_SRC sh
|
|
# Produce ast in dot format
|
|
codeql database analyze \
|
|
--format=dot --output=ast.dot \
|
|
-j8 -v --ram=16000 \
|
|
--rerun \
|
|
-- \
|
|
cpp-dataflow-part1-database \
|
|
graphs/ast.ql
|
|
|
|
# Convert dot to pdf
|
|
dot -Tpdf < ast.dot/cpp/print-ast.dot > ast.dot/cpp/print-ast.pdf
|
|
dot -Tsvg < ast.dot/cpp/print-ast.dot > ast.dot/cpp/print-ast.svg
|
|
|
|
# View the graph
|
|
open ast.dot/cpp/print-ast.pdf
|
|
|
|
# This comes from
|
|
tests-common/test_part1.c
|
|
#+END_SRC
|
|
|
|
* CodeQL CFG in dot and pdf
|
|
The whole control flow graph is very large, so the query narrows it to the
|
|
function of interest,
|
|
#+BEGIN_SRC c++
|
|
int copy_mem(unsigned int unused, dyn_input_t *input,
|
|
unsigned int input_types) {...}
|
|
|
|
#+END_SRC
|
|
from [[./tests-common/test_part1.c]]
|
|
|
|
#+BEGIN_SRC sh
|
|
# Produce CFG in dot format
|
|
codeql database analyze \
|
|
--format=dot --output=cfg.dot \
|
|
-j8 -v --ram=16000 \
|
|
--rerun \
|
|
-- \
|
|
cpp-dataflow-part1-database \
|
|
graphs/cfg.ql
|
|
|
|
|
|
# Convert dot to pdf
|
|
dot -Tpdf < cfg.dot/cpp/print-cfg.dot > cfg.dot/cpp/print-cfg.pdf
|
|
dot -Tsvg < cfg.dot/cpp/print-cfg.dot > cfg.dot/cpp/print-cfg.svg
|
|
|
|
# View the graph
|
|
open cfg.dot/cpp/print-cfg.pdf
|
|
#+END_SRC
|
|
|
|
* AST
|
|
The ast is inlined here. For better viewing, open the
|
|
pdf ([[./ast.dot/cpp/print-ast.pdf]]) separately.
|
|
#+ATTR_HTML: :width 100%
|
|
[[./ast.dot/cpp/print-ast.svg]]
|
|
|
|
* CFG
|
|
The cfg is inlined here. For better viewing, open the
|
|
pdf ([[./cfg.dot/cpp/print-cfg.pdf]]) separately.
|
|
|
|
#+ATTR_HTML: :class scrollable-svg
|
|
[[./cfg.dot/cpp/print-cfg.svg]]
|
|
|
|
* GPTs
|
|
A gpt was used to add 17 of the CFG edges to the AST tree; more resulted in a
|
|
very confusing graph. The hybrid is in =cfg.dot/cpp/ast-cfg-hybrid.dot=
|
|
|
|
* Render via dot
|
|
The hybrid is rendered via dot. The other renderers produced very spread
|
|
layouts.
|
|
#+BEGIN_SRC sh
|
|
# Convert dot to pdf
|
|
twopi -Tpdf < cfg.dot/cpp/ast-cfg-hybrid.dot > cfg.dot/cpp/ast-cfg-hybrid.pdf
|
|
circo -Tpdf < cfg.dot/cpp/ast-cfg-hybrid.dot > cfg.dot/cpp/ast-cfg-hybrid.pdf
|
|
dot -Tpdf < cfg.dot/cpp/ast-cfg-hybrid.dot > cfg.dot/cpp/ast-cfg-hybrid.pdf
|
|
dot -Tsvg < cfg.dot/cpp/ast-cfg-hybrid.dot > cfg.dot/cpp/ast-cfg-hybrid.svg
|
|
|
|
# View the graph
|
|
open -a skim cfg.dot/cpp/ast-cfg-hybrid.pdf
|
|
#+END_SRC
|
|
|
|
* AST-CFG HYBRID
|
|
The ast-cfg hybrid is inlined here. For better viewing, open the
|
|
pdf ([[./cfg.dot/cpp/ast-cfg-hybrid.pdf]]) separately.
|
|
#+ATTR_HTML: :width 100%
|
|
[[./cfg.dot/cpp/ast-cfg-hybrid.svg]]
|
|
|
|
* CFG with numbered nodes
|
|
The CFG with node numbering is inlined here. For better viewing, open the
|
|
pdf ([[./cfg.dot/cpp/cfg-annotated.pdf]]) separately.
|
|
#+ATTR_HTML: :width 100%
|
|
[[./cfg.dot/cpp/cfg-annotated.svg]]
|
|
|
|
As before, this graph is rendered via dot:
|
|
#+BEGIN_SRC sh
|
|
dot -Tpdf < cfg.dot/cpp/cfg-annotated.dot > cfg.dot/cpp/cfg-annotated.pdf
|
|
dot -Tsvg < cfg.dot/cpp/cfg-annotated.dot > cfg.dot/cpp/cfg-annotated.svg
|
|
|
|
# View the graph
|
|
open -a skim cfg.dot/cpp/cfg-annotated.pdf
|
|
|
|
#+END_SRC
|
|
|
|
|
|
* Source Annotated with CFG Nodes
|
|
The CFG entries
|
|
#+BEGIN_SRC text
|
|
0[label="ExprStmt (0)"; ];
|
|
1[label="call to memcpy (1)"; ];
|
|
2[label="input (2)"; ];
|
|
3[label="0 (3)"; ];
|
|
4[label="access to array (4)"; ];
|
|
5[label="ptr (5)"; ];
|
|
6[label="buf (6)"; ];
|
|
7[label="input (7)"; ];
|
|
8[label="1 (8)"; ];
|
|
9[label="access to array (9)"; ];
|
|
10[label="ptr (10)"; ];
|
|
11[label="buf (11)"; ];
|
|
#+END_SRC
|
|
are located in the source code as follows
|
|
#+BEGIN_SRC c++
|
|
int copy_mem(unsigned int unused, dyn_input_t *input,
|
|
|
|
|
|
unsigned int input_types) {
|
|
0
|
|
|
|
memcpy(input[0].ptr.buf, input[1].ptr.buf,
|
|
1 2 3 7 8
|
|
4 5 6 9 10 11
|
|
|
|
input[1].ptr.size);
|
|
|
|
|
|
copy_mem_nested(input);
|
|
|
|
...;
|
|
}
|
|
#+END_SRC
|
|
|