“有迹可循”的灰盒测试分析

def drawGraghofFunc(curPath, db, graghCategoryList):
  # 遍历数据库形式的代码扫描结果中的所有函数
  for func in db.ents("function, method, procedure"):
    # 创建以各函数名称命名的文件夹用以存储图像
    funcName = func.name()
    # 有效函数名称及去重判断
    if "." in funcName and not funcName.startswith("("):
      if os.path.exists(os.path.join(curPath, funcName)):
        time.sleep(1)
        continue
      graghPath_dir = createGraghDir(funcName, curPath)
      gevent_list = []
      # 由于数据量较多对不同类别图像绘制采用协程处理
      graghCategoryList = ["callby_", "call_", "controlFlow_", "declaration_", "clusterButterfly_"]
      for graghCategory in graghCategoryList:
        gevent_list.append(gevent.spawn(drawBaseOnGraghCategory, func, funcName, graghCategory, graghPath_dir))
      gevent.joinall(gevent_list)

def drawBaseOnGraghCategory(func, funcName, graghcategory, graghPath_dir):
  graghName = graghcategory + funcName + ".png"
  graghName_dir = os.path.join(graghPath_dir, graghName)
  # 调用underder提供的draw方法进行图像绘制并保存
  # 调用关系、被调用关系、控制流、函数实体、结构等
  if graghcategory == "callby_":
    func.draw("Called By", graghName_dir)
  elif graghcategory == "call_":
    func.draw("Calls", graghName_dir)
  elif graghcategory == "controlFlow_":
    func.draw("Control Flow", graghName_dir)
  elif graghcategory == "declaration_":
    func.draw("Declaration", graghName_dir)
  elif graghcategory == "clusterButterfly_":
    func.draw("Cluster Call Butterfly", graghName_dir)  

def saveGraphPathToMongo(graghDataPath):
  # 遍历存储图片的文件夹
  for func_cls_name in os.listdir(graghDataPath):
    if os.path.isdir(os.path.join(graghDataPath, func_cls_name)):
      saveDatabyFuncName(func_cls_name)

def saveDatabyFuncName(func_cls_name):
  # 得到类名、函数名
  func_cls = func_cls_name.split(".")[0]
  func_name = func_cls_name.split(".")[-1]
  # 创建collection及相应存储单元Document
  scan_col = scan_db[func_cls]
  func_id = {"_id": func_name}
  func_info = {"_id":func_name, "call":"", "callby":"", "clusterButterfly":"", "controlFlow":"", "declaration":""}
  # 根据图像名称编辑待存储数据
  for func_cls_name_gragh in os.listdir(os.path.join(graghDataPath, func_cls_name)):
    if "call_" in func_cls_name_gragh:
      func_info["call"] = func_cls_name_gragh
    elif "callby_" in func_cls_name_gragh:
      func_info["callby"] = func_cls_name_gragh
    elif "clusterButterfly_" in func_cls_name_gragh:
      func_info["clusterButterfly"] = func_cls_name_gragh
    elif "controlFlow_" in func_cls_name_gragh:
      func_info["controlFlow"] = func_cls_name_gragh
    elif "declaration_" in func_cls_name_gragh:
      func_info["declaration"] = func_cls_name_gragh
  # 向数据库中插入数据
  if not scan_col.find_one(func_id):
    scan_col.insert_one(func_info)

def saveCallAndCalledToMongo(db):
  for ent in db.ents("function, method, procedure"):
    funcName = ent.name()
    if not "." in funcName:
      continue
    if funcName.startswith("("):
      continue
    # 获取类名、函数名
    func_cls = funcName.split(".")[0]
    func_name = funcName.split(".")[1]
    scan_col = scan_db[func_cls]
    func_id = {"_id": func_name}
    call_funcName  = []
    called_funcName = []
    # 找对函数对应的MongoDB中Document
    func_info = scan_col.find_one(func_id)
    if func_info:
      # 调用understand中PythonAPI相关方法
      # 将调用/被调用函数名称予以存储入库
      for ref in sorted(ent.refs("call","",True),key= lambda ref: ref.ent().name()):
        callee = ref.ent().name()
        call_funcName.append(callee)
      scan_col.update_one(func_id, {'$set':{'call_funcName':call_funcName}})
      for ref in sorted(ent.refs("callby","",True),key= lambda ref: ref.ent().name()):
        called = ref.ent().name()
        called_funcName.append(called)
      scan_col.update_one(func_id, {'$set':{'called_funcName':called_funcName}})