I-Facebook yethule i-open static analyzer entsha, i-Mariana Trench, ehloselwe ukuhlonza ubungozi ezinhlelweni zeplathifomu ye-Android nezinhlelo ze-Java. Kungenzeka ukuhlaziya amaphrojekthi ngaphandle kwamakhodi omthombo, lapho i-bytecode kuphela yomshini we-Dalvik virtual etholakalayo. Enye inzuzo ijubane layo eliphezulu kakhulu lokukhishwa (ukuhlaziywa kwemigqa yekhodi eyizigidi ezimbalwa kuthatha imizuzwana eyi-10), okukuvumela ukuthi usebenzise i-Mariana Trench ukuhlola zonke izinguquko ezihlongozwayo njengoba zifika. Ikhodi yephrojekthi ibhalwe ku-C++ futhi isatshalaliswa ngaphansi kwelayisensi ye-MIT.
I-analyzer yathuthukiswa njengengxenye yephrojekthi yokuzenzakalela inqubo yokubuyekeza imibhalo yemithombo yezinhlelo zokusebenza zeselula ze-Facebook, Instagram kanye ne-Whatsapp. Engxenyeni yokuqala ka-2021, uhhafu wabo bonke ubungozi bezinhlelo zokusebenza zeselula ze-Facebook bahlonzwe kusetshenziswa amathuluzi okuhlaziya azenzakalelayo. Ikhodi ye-Mariana Trench ixhumene eduze namanye amaphrojekthi we-Facebook; isibonelo, i-Redex bytecode optimizer yasetshenziswa ukuze kuhlaziywe i-bytecode, futhi umtapo wezincwadi wakwa-SPARTA wasetshenziselwa ukuhumusha ngokubukeka nokufunda imiphumela yokuhlaziya okumile.
Ubungozi obungase bube khona nezinkinga zobumfihlo zibonwa ngokuhlaziya ukugeleza kwedatha ngesikhathi sokusetshenziswa kohlelo lokusebenza ukuze kuhlonzwe izimo lapho idatha yangaphandle eluhlaza icutshungulwa ezakhiweni eziyingozi, njengemibuzo ye-SQL, ukusebenza kwamafayela, namakholi acupha izinhlelo zangaphandle.
Umsebenzi womhlaziyi wehlela ekuhlonzeni imithombo yedatha namakholi ayingozi lapho idatha yomthombo akufanele isetshenziswe - umhlaziyi ulandelela ukudlula kwedatha ngochungechunge lwezingcingo zokusebenza futhi axhumanise idatha yomthombo nezindawo ezingaba yingozi kukhodi. . Isibonelo, idatha etholwe ngekholi eya ku-Intent.getData ibhekwa njengedinga ukulandelelwa komthombo, futhi amakholi aya ku-Log.w ne-Runtime.exec abhekwa njengezinto eziyingozi.
Source: opennet.ru