C and C++ Binaries

Description: CFG Edge

Each point has edge sets listing neighbors in the CFG. There are two different CFG abstractions: interprocedural and intraprocedural.

Language Module Support: Internal representation for points is available for C/C++ and binary analyses only. For C# and Java analyses, plug-ins that rely on point (and thus CFG edge) properties and relationships will generally not produce useful information.



Overview

Each point (PDG_VERTEX) has edge sets listing neighbors in the CFG. There are two different CFG abstractions: interprocedural and intraprocedural.

  Interprocedural CFG Intraprocedural CFG
Models: Control flow in the entire project.

(A single large graph.)

Control flow within a single function.

(One graph per function.)

Edge kinds: Both interprocedural edges (edges between functions) and intraprocedural edges (edges within functions). Intraprocedural edges (edges within the function) only; each function call is treated as if it were an atomic operation.
Neighbors: interprocedural edges all edges fine-grained view coarse-grained view
edges to p not available not available not available not available
edges from p cfg-inter-targets not available cfg-targets not available

API Functionality

For each point p, API functions provide access to:

More on CFG Edges

interprocedural CFG
  • The interprocedural successor of (the last actual parameter of) a function call is the entry of the called function.
  • The successors of an exit are all points to which the function may return.
  • The intraprocedural edge from (the last actual parameter of) a function call to the statement to which the function returns is omitted.
intraprocedural CFG
fine-grained view
  • Vertices are program points.
  • The only successors of (the last actual parameter of) a call to a function are the points to which the called function would return.
  • Successors and predecessors are known as targets and sources, respectively.
intraprocedural CFG
coarse-grained view
  • Vertices are basic blocks, where a basic block is a sequence of consecutive program points in which intraprocedural flow of control can only enter at the first program point and leave at the last program point.
  • Each point has an associated basic block.
  • An edge between two basic blocks is represented as an edge between two representative vertices, one from each block.

Links

By API implementation:

Language CFG Edge Functionality and Types Provided By CFG Edge Type
C++ class point typedef cfg_edge
Python class point pair (point, edge_label)
C Headers cs_pdg_vertex.h, cs_edge_label.h typedef cs_cfg_edge

See also: