解锁SSA IR代码审计新姿势？牛牛来了！

funcName(actualParam1, actualParam2)

SELECT edges FROM codes WHERE funcname LIKE 'eval%';

a = 1;a = 2;eval(a);

a = 1;if (conditionB) {a = 2;}eval(a);

a = 1；a_1 = 2;eval(a_1);

a = 1;if (conditionB) {    a_1 = 2;}a_2 = phi(a, a_1);eval(a_2);

package com.test.example;import jakarta.servlet.*;import jakarta.servlet.http.*;import java.io.*;public class CommandInjectionServlet extends HttpServlet {protected void doGet(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {        String userInput = request.getParameter("command");        String command = "cmd.exe /c " + userInput; // 直接使用用户输入        Process process = Runtime.getRuntime().exec(userInput);        BufferedReader reader = new BufferedReader(new InputStreamReader(process.getInputStream()));        String line;        PrintWriter out = response.getWriter();while ((line = reader.readLine()) != null) {            out.println(line);        }    }}

Runtime.getRuntime().exec(,* as $sink);

sf   0| - enter -sf   1| check topsf   1|   |-- >> stack top is nil (push input)sf   2|   sf   3|  push$exact   Runtime isMember[name]sf   3|    |-- >> pop match exactly: Runtimesf   3|    |-- result next: Values: 1sf   3|    |               0 (t24): Undefined-Runtimesf   3|    |-- << push nextsf   4|  push$exact   getRuntime isMember[key]sf   4|    |-- >> pop match exactly: getRuntimesf   4|    |-- result next: Values: 1sf   4|    |               0 (t26): Undefined-Runtime.getRuntimesf   4|    |-- << push nextsf   5|  getCallsf   5|    |-- >> popsf   5|    |-- << push len: 1sf   6|  push$exact   exec isMember[key]sf   6|    |-- >> pop match exactly: execsf   6|    |-- result next: Values: 1sf   6|    |               0 (t29): Undefined-.execsf   6|    |-- << push nextsf   7|  - enter -sf   8|  getCallArgs  1sf   8|    |-- -- peeksf   8|    |-- - get argument: Values: 1sf   8|    |               0 (t21): Undefined-request.getParameter(Parameter-request,"command")sf   8|    |-- << push arg len: 1sf   8|    |-- << stack growsf   9|  check topsf  10|    sf  11|    /sf  12|  update$ref   sinksf  12|    |-- >> popsf  12|    |--  -> save $sinksf  13|  - exit -sf  14|  getCallsf  14|    |-- >> popsf  14|    |-- << push len: 1sf  15|   /sf  16| popsf  16|   |-- >> pop 1sf  16|   |-- save-to $_sf  17|

SELECT count(*) FROM "ir_indices"  WHERE "ir_indices"."deleted_at" IS NULL AND ((( program_name = 'com.example' ) OR ( program_name = 'test' )) AND (variable_name = 'Runtime' OR class_name = 'Runtime' OR field_name = 'Runtime'))SELECT * FROM "ir_indices"  WHERE "ir_indices"."deleted_at" IS NULL AND ((( program_name = 'com.example' ) OR ( program_name = 'test' )) AND (variable_name = 'Runtime' OR class_name = 'Runtime' OR field_name = 'Runtime')) LIMIT 100 OFFSET 0SELECT * FROM "ir_codes"  WHERE "ir_codes"."deleted_at" IS NULL AND ((id = '24')) ORDER BY "ir_codes"."id" ASC LIMIT 1SELECT * FROM "ir_sources"  WHERE (source_code_hash = '0ef46d9369a641a2a274c753208a7f982b7b376bd1d748b2ec7fa7e6f7e47f7e') LIMIT 1SELECT * FROM "ir_codes"  WHERE "ir_codes"."deleted_at" IS NULL AND ((id = '11')) ORDER BY "ir_codes"."id" ASC LIMIT 1SELECT * FROM "ir_sources"  WHERE (source_code_hash = '0ef46d9369a641a2a274c753208a7f982b7b376bd1d748b2ec7fa7e6f7e47f7e') LIMIT 1SELECT * FROM "ir_codes"  WHERE "ir_codes"."deleted_at" IS NULL AND ((id = '9')) ORDER BY "ir_codes"."id" ASC LIMIT 1SELECT * FROM "ir_codes"  WHERE "ir_codes"."deleted_at" IS NULL AND ((id = '13')) ORDER BY "ir_codes"."id" ASC LIMIT 1SELECT * FROM "ir_types"  WHERE "ir_types"."deleted_at" IS NULL AND (("ir_types"."id" = 19)) ORDER BY "ir_types"."id" ASC LIMIT 1SELECT * FROM "ir_codes"  WHERE "ir_codes"."deleted_at" IS NULL AND ((id = '15')) ORDER BY "ir_codes"."id" ASC LIMIT 1SELECT * FROM "ir_codes"  WHERE "ir_codes"."deleted_at" IS NULL AND ((id = '16')) ORDER BY "ir_codes"."id" ASC LIMIT 1SELECT * FROM "ir_codes"  WHERE "ir_codes"."deleted_at" IS NULL AND ((id = '17')) ORDER BY "ir_codes"."id" ASC LIMIT 1SELECT * FROM "ir_codes"  WHERE "ir_codes"."deleted_at" IS NULL AND ((id = '12')) ORDER BY "ir_codes"."id" ASC LIMIT 1......SELECT * FROM "ir_sources"  WHERE (source_code_hash = '0ef46d9369a641a2a274c753208a7f982b7b376bd1d748b2ec7fa7e6f7e47f7e') LIMIT 1SELECT * FROM "ir_codes"  WHERE "ir_codes"."deleted_at" IS NULL AND ((id = '11')) ORDER BY "ir_codes"."id" ASC LIMIT 1SELECT * FROM "ir_codes"  WHERE "ir_codes"."deleted_at" IS NULL AND ((id = '44')) ORDER BY "ir_codes"."id" ASC LIMIT 1......SELECT * FROM "ir_codes"  WHERE "ir_codes"."deleted_at" IS NULL AND ((id = '25')) ORDER BY "ir_codes"."id" ASC LIMIT 1SELECT * FROM "ir_codes"  WHERE "ir_codes"."deleted_at" IS NULL AND ((id = '26')) ORDER BY "ir_codes"."id" ASC LIMIT 1SELECT * FROM "ir_types"  WHERE "ir_types"."deleted_at" IS NULL AND (("ir_types"."id" = 15)) ORDER BY "ir_types"."id" ASC LIMIT 1SELECT * FROM "ir_sources"  WHERE (source_code_hash = '0ef46d9369a641a2a274c753208a7f982b7b376bd1d748b2ec7fa7e6f7e47f7e') LIMIT 1SELECT * FROM "ir_codes"  WHERE "ir_codes"."deleted_at" IS NULL AND ((id = '11')) ORDER BY "ir_codes"."id" ASC LIMIT 1SELECT * FROM "ir_codes"  WHERE "ir_codes"."deleted_at" IS NULL AND ((id = '12')) ORDER BY "ir_codes"."id" ASC LIMIT 1SELECT * FROM "ir_types"  WHERE "ir_types"."deleted_at" IS NULL AND (("ir_types"."id" = 2)) ORDER BY "ir_types"."id" ASC LIMIT 1SELECT * FROM "ir_sources"  WHERE (source_code_hash = '0ef46d9369a641a2a274c753208a7f982b7b376bd1d748b2ec7fa7e6f7e47f7e') LIMIT 1SELECT * FROM "ir_codes"  WHERE "ir_codes"."deleted_at" IS NULL AND ((id = '11')) ORDER BY "ir_codes"."id" ASC LIMIT 1SELECT * FROM "ir_codes"  WHERE "ir_codes"."deleted_at" IS NULL AND ((id = '12')) ORDER BY "ir_codes"."id" ASC LIMIT 1SELECT * FROM "ir_types"  WHERE "ir_types"."deleted_at" IS NULL AND (("ir_types"."id" = 21)) ORDER BY "ir_types"."id" ASC LIMIT 1SELECT * FROM "ir_sources"  WHERE (source_code_hash = '0ef46d9369a641a2a274c753208a7f982b7b376bd1d748b2ec7fa7e6f7e47f7e') LIMIT 1SELECT * FROM "ir_codes"  WHERE "ir_codes"."deleted_at" IS NULL AND ((id = '11')) ORDER BY "ir_codes"."id" ASC LIMIT 1SELECT * FROM "ir_codes"  WHERE "ir_codes"."deleted_at" IS NULL AND ((id = '12')) ORDER BY "ir_codes"."id" ASC LIMIT 1SELECT * FROM "ir_codes"  WHERE "ir_codes"."deleted_at" IS NULL AND ((id = '30')) ORDER BY "ir_codes"."id" ASC LIMIT 1SELECT * FROM "ir_codes"  WHERE "ir_codes"."deleted_at" IS NULL AND ((id = '28')) ORDER BY "ir_codes"."id" ASC LIMIT 1SELECT * FROM "ir_codes"  WHERE "ir_codes"."deleted_at" IS NULL AND ((id = '29')) ORDER BY "ir_codes"."id" ASC LIMIT 1SELECT * FROM "ir_types"  WHERE "ir_types"."deleted_at" IS NULL AND (("ir_types"."id" = 12)) ORDER BY "ir_types"."id" ASC LIMIT 1SELECT * FROM "ir_codes"  WHERE "ir_codes"."deleted_at" IS NULL AND ((id = '26')) ORDER BY "ir_codes"."id" ASC LIMIT 1SELECT * FROM "ir_codes"  WHERE "ir_codes"."deleted_at" IS NULL AND ((id = '24')) ORDER BY "ir_codes"."id" ASC LIMIT 1SELECT * FROM "ir_sources"  WHERE (source_code_hash = '0ef46d9369a641a2a274c753208a7f982b7b376bd1d748b2ec7fa7e6f7e47f7e') LIMIT 1SELECT * FROM "ir_codes"  WHERE "ir_codes"."deleted_at" IS NULL AND ((id = '11')) ORDER BY "ir_codes"."id" ASC LIMIT 1SELECT * FROM "ir_codes"  WHERE "ir_codes"."deleted_at" IS NULL AND ((id = '12')) ORDER BY "ir_codes"."id" ASC LIMIT 1SELECT * FROM "ir_types"  WHERE "ir_types"."deleted_at" IS NULL AND (("ir_types"."id" = 2)) ORDER BY "ir_types"."id" ASC LIMIT 1SELECT * FROM "ir_sources"  WHERE (source_code_hash = '0ef46d9369a641a2a274c753208a7f982b7b376bd1d748b2ec7fa7e6f7e47f7e') LIMIT 1SELECT * FROM "ir_codes"  WHERE "ir_codes"."deleted_at" IS NULL AND ((id = '11')) ORDER BY "ir_codes"."id" ASC LIMIT 1......