Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Inline expansion questions #68

Open
MNayer opened this issue Mar 28, 2021 · 0 comments
Open

Inline expansion questions #68

MNayer opened this issue Mar 28, 2021 · 0 comments

Comments

@MNayer
Copy link

MNayer commented Mar 28, 2021

Thank you for this great tool!
I've got some questions rather than an actual issue. I'd be very thankful, though, if you could help me work this out.

  1. It seems, the selective callee expansion is performed in the method convert in FuncTokenized.java. This method, however, is, as far as I can see, only called from Asm2VecCloneDetectorPV.java (l. 132), Asm2VecCloneDetectorIntegration.java (l. 174), and Asm2VecCloneDetector.java (l. 131). In all of those three cases, the inline_threshold is set to -1, so the expression in the filter method at l. 76 in FuncTonized.java:
int in = indegrees.get(call.id);
int ou = call.calls.size();
double alpha = ou * 1.0 / (in + ou);
return alpha <= inline_threshold;

will never come true. Am I missing something or is this on purpose in order to not perform any function inlining? Which would directly lead to my second question:

  1. Even if function inlining was performed, it looks like this would be done by adding the basic blocks from the callee to the caller's basic blocks (FuncTonized.java l. 77). Because of the way the basic blocks are constructed (either in ExtractBinaryViaIDA.py or IDAUtils.py), this would cause basic blocks in the function to have the same id (as far as I can see). Besides, I don't quite understand how this wouldn't lead to a function with basic blocks which make up two CFGs. Example:
    Callee:
    {
    "id": "some_function_name",
    "blocks": [{"id": 0, ..}, .. {"id": 3, ..}],
    ...
    }
    Caller:
    {
    "id": "some_other_function_name",
    "call": ["some_function_name"],
    "blocks": [{"id": 0, ..}, .. {"id": 4, ..}],
    ...
    }
    New function with inline expansion performed:
    {
    "id": "some_other_function_name_with_inline_expansion",
    "blocks": [{"id": 0, ..}, {"id": 0, ..}, .. , {"id": 3, ..}, {"id": 3, ..}, {"id": 4, ..}],
    ...
    }
    The new function now has multiple basic blocks with the same id and there are no edges between basic blocks from the caller to the inlined basic blocks from the callee. What am I missing? Every help is greatly appriciated!
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant