secure-software-engineering/phasar
Phasar
Phasar is a static analysis framework designed for the inspection of software logic through the processing of compiler intermediate representations. It provides a modular pipeline for building program representations, including call graphs, control flow graphs, and type hierarchies, which serve as the foundation for deep structural analysis of software behavior.
The framework specializes in interprocedural data flow analysis and pointer alias resolution, enabling the tracking of information movement across function boundaries and the identification of indirect memory access patterns. By leveraging these capabilities, it supports the development of custom analysis tools capable of detecting complex logic errors and security vulnerabilities within codebases.
Users can configure the analysis scope to optimize performance by excluding specific library or intrinsic function calls. The framework also includes a taint tracking system that allows for the definition of custom data sources and sinks, facilitating automated security auditing by monitoring the flow of sensitive or untrusted information through a system.
Features
- Static Analysis Frameworks - Provides a framework for building custom static analysis tools to detect logic errors and security vulnerabilities.
- Pointer Alias Resolution Engines - Resolves memory reference relationships to identify indirect memory access patterns.
- Interprocedural Pointer Analysis - Tracks information movement across function boundaries to identify security vulnerabilities and logic errors.
- Interprocedural Data-Flow Solvers - Implements an interprocedural data flow solver to track information movement across function boundaries.
- Pointer Analysis Frameworks - Determines memory reference relationships and points-to information to resolve indirect memory access patterns.
- Taint Analysis Engines - Provides an engine for tracking sensitive data movement across program boundaries to identify potential security vulnerabilities.
- Inter-procedural Data Flow - Tracks how information propagates across function boundaries and memory references.
- Taint Tracking Frameworks - Provides a taint tracking system to monitor the flow of sensitive or untrusted information.
- Source-Sink Taint Tracking - Allows definition of custom data sources and sinks to track untrusted information flow for automated security auditing.
- Control-Flow Graph Constructions - Constructs detailed call graphs and type hierarchies from compiler intermediate representations to enable precise interprocedural analysis.
- Program Representation Builders - Constructs call graphs, control flow graphs, and type hierarchies to support deep code analysis.
- Custom Data-Flow Analysis Frameworks - Enables the development of custom analysis tools for computing specific data flow characteristics.
- Call Graph Generators - Generates detailed representations of program call structures and type hierarchies.
- Intermediate Representation Analyzers - Processes compiler intermediate representations to perform deep structural inspection of software logic.
- Data Flow Analysis - Executes data flow analyses using standard algorithmic frameworks to track information propagation.
- Deep Pointer Resolution - Determines memory reference relationships and points-to information to resolve indirect access patterns.
- Security Auditing Tools - Defines custom taint analysis sources and sinks to identify security flaws during compilation.
- Automated Security Pipelines - Integrates data taint analysis into build pipelines to automatically identify untrusted data movement.
- Analysis Pipelines - Orchestrates static analysis passes by chaining together graph construction, alias resolution, and data flow propagation.
