behaviors

Documentation

Index

• func Tag(funcs []functions.Function, graph *callgraph.CallGraph, ...) []functions.Function
• type BehaviorTag
• type TagRule

Functions

func Tag

func Tag(
	funcs []functions.Function,
	graph *callgraph.CallGraph,
	strs []gstrings.ExtractedString,
) []functions.Function

Tag annotates each function with behavior tags based on call edges and string references.

Types

type BehaviorTag

type BehaviorTag string

BehaviorTag is a high-level behavioral classification.

const (
	TagNetwork   BehaviorTag = "NETWORK"
	TagCrypto    BehaviorTag = "CRYPTO"
	TagFileWrite BehaviorTag = "FILE_WRITE"
	TagFileRead  BehaviorTag = "FILE_READ"
	TagExecution BehaviorTag = "EXECUTION"
	TagRegistry  BehaviorTag = "REGISTRY"
	TagMemory    BehaviorTag = "MEMORY"
	TagDNS       BehaviorTag = "DNS"
	TagHTTP      BehaviorTag = "HTTP"
)

type TagRule

type TagRule struct {
	Tag         BehaviorTag
	CallTargets []string       // tag applies if function calls any of these (prefix match)
	StringPat   *regexp.Regexp // OR if function references a string matching this pattern
}

TagRule defines when a tag applies to a function.