smda 2.4.2__py3-none-any.whl

smda/Disassembler.py

@@ -0,0 +1,180 @@
+import datetime
+import hashlib
+import logging
+import traceback
+
+from smda.cil.CilDisassembler import CilDisassembler
+from smda.common.BinaryInfo import BinaryInfo
+from smda.common.labelprovider.GoLabelProvider import GoSymbolProvider
+from smda.common.SmdaReport import SmdaReport
+from smda.ida.IdaExporter import IdaExporter
+from smda.intel.IntelDisassembler import IntelDisassembler
+from smda.SmdaConfig import SmdaConfig
+from smda.utility.FileLoader import FileLoader
+from smda.utility.MemoryFileLoader import MemoryFileLoader
+from smda.utility.StringExtractor import extract_strings
+
+LOGGER = logging.getLogger(__name__)
+
+
+class Disassembler:
+    def __init__(self, config=None, backend=None):
+        if config is None:
+            config = SmdaConfig()
+        self.config = config
+        self.disassembler = None
+        if backend == "intel":
+            self.disassembler = IntelDisassembler(self.config)
+        elif backend == "cil":
+            self.disassembler = CilDisassembler(self.config)
+        elif backend == "IDA":
+            self.disassembler = IdaExporter(self.config)
+        self._start_time = None
+        self._timeout = 0
+        # cache the last DisassemblyResult
+        self.disassembly = None
+
+    def initDisassembler(self, architecture="intel"):
+        """Initialize disassembler backend to given architecture, if not initialized yet, default: intel"""
+        if self.disassembler is None:
+            if architecture == "intel":
+                self.disassembler = IntelDisassembler(self.config)
+            elif architecture == "cil":
+                self.disassembler = CilDisassembler(self.config)
+
+    def _getDurationInSeconds(self, start_ts, end_ts):
+        return (end_ts - start_ts).seconds + ((end_ts - start_ts).microseconds / 1000000.0)
+
+    def _callbackAnalysisTimeout(self):
+        if not self._timeout:
+            return False
+        time_diff = datetime.datetime.now(datetime.timezone.utc) - self._start_time
+        LOGGER.debug("Current analysis callback time %s", (time_diff))
+        return time_diff.seconds >= self._timeout
+
+    def _addStringsToReport(self, smda_report, buffer, mode=None):
+        smda_report.buffer = buffer
+        for smda_function in smda_report.getFunctions():
+            function_strings = []
+            for string_result in extract_strings(smda_function, mode=mode):
+                string, referencing_addr, string_addr, string_type = string_result
+                function_strings.append(
+                    {
+                        "string": string,
+                        "ins_addr": referencing_addr,
+                        "data_addr": string_addr,
+                        "type": string_type,
+                    }
+                )
+            smda_function.stringrefs = function_strings
+
+    def disassembleFile(self, file_path, pdb_path=""):
+        loader = FileLoader(file_path, map_file=True)
+        file_content = loader.getData()
+        binary_info = BinaryInfo(file_content)
+        binary_info.raw_data = loader.getRawData()
+        # we want the SHA256/SHA1/MD5 of the unmapped file not how we mapped it to memory
+        binary_info.sha256 = hashlib.sha256(binary_info.raw_data).hexdigest()
+        binary_info.sha1 = hashlib.sha1(binary_info.raw_data).hexdigest()
+        binary_info.md5 = hashlib.md5(binary_info.raw_data).hexdigest()
+        binary_info.file_path = file_path
+        binary_info.base_addr = loader.getBaseAddress()
+        binary_info.bitness = loader.getBitness()
+        binary_info.architecture = loader.getArchitecture()
+        binary_info.code_areas = loader.getCodeAreas()
+        self.initDisassembler(binary_info.architecture)
+        start = datetime.datetime.now(datetime.timezone.utc)
+        try:
+            self.disassembler.addPdbFile(binary_info, pdb_path)
+            smda_report = self._disassemble(binary_info, timeout=self.config.TIMEOUT)
+            if self.config.WITH_STRINGS:
+                is_go_binary = GoSymbolProvider(None).getPcLntabOffset(binary_info.binary)
+                string_mode = "go" if is_go_binary else None
+                self._addStringsToReport(smda_report, file_content, mode=string_mode)
+            if self.config.STORE_BUFFER:
+                smda_report.buffer = file_content
+        except Exception as exc:
+            LOGGER.error("An error occurred while disassembling file.")
+            # print("-> an error occured (", str(exc), ").")
+            smda_report = self._createErrorReport(start, exc)
+        return smda_report
+
+    def disassembleUnmappedBuffer(self, file_content):
+        loader = MemoryFileLoader(file_content, map_file=True)
+        file_content = loader.getData()
+        binary_info = BinaryInfo(file_content)
+        binary_info.raw_data = loader.getRawData()
+        # we want the SHA256/SHA1/MD5 of the unmapped file not how we mapped it to memory
+        binary_info.sha256 = hashlib.sha256(binary_info.raw_data).hexdigest()
+        binary_info.sha1 = hashlib.sha1(binary_info.raw_data).hexdigest()
+        binary_info.md5 = hashlib.md5(binary_info.raw_data).hexdigest()
+        binary_info.file_path = ""
+        binary_info.base_addr = loader.getBaseAddress()
+        binary_info.bitness = loader.getBitness()
+        binary_info.architecture = loader.getArchitecture()
+        binary_info.code_areas = loader.getCodeAreas()
+        self.initDisassembler(binary_info.architecture)
+        start = datetime.datetime.now(datetime.timezone.utc)
+        try:
+            smda_report = self._disassemble(binary_info, timeout=self.config.TIMEOUT)
+            if self.config.WITH_STRINGS:
+                is_go_binary = GoSymbolProvider(None).getPcLntabOffset(binary_info.binary)
+                string_mode = "go" if is_go_binary else None
+                self._addStringsToReport(smda_report, file_content, mode=string_mode)
+            if self.config.STORE_BUFFER:
+                smda_report.buffer = file_content
+        except Exception as exc:
+            LOGGER.error("An error occurred while disassembling unmapped buffer.")
+            # print("-> an error occured (", str(exc), ").")
+            smda_report = self._createErrorReport(start, exc)
+        return smda_report
+
+    def disassembleBuffer(
+        self,
+        file_content,
+        base_addr,
+        bitness=None,
+        code_areas=None,
+        oep=None,
+        architecture="intel",
+    ):
+        """
+        Disassemble a given buffer (file_content), with given base_addr.
+        Optionally specify bitness, the areas to which disassembly should be limited to (code_areas) and an entry point (oep)
+        """
+        binary_info = BinaryInfo(file_content)
+        binary_info.base_addr = base_addr
+        binary_info.bitness = bitness
+        binary_info.is_buffer = True
+        binary_info.code_areas = code_areas
+        binary_info.architecture = architecture
+        binary_info.oep = oep
+        self.initDisassembler(binary_info.architecture)
+        start = datetime.datetime.now(datetime.timezone.utc)
+        try:
+            smda_report = self._disassemble(binary_info, timeout=self.config.TIMEOUT)
+            if self.config.WITH_STRINGS:
+                is_go_binary = GoSymbolProvider(None).getPcLntabOffset(binary_info.binary)
+                string_mode = "go" if is_go_binary else None
+                self._addStringsToReport(smda_report, file_content, mode=string_mode)
+            if self.config.STORE_BUFFER:
+                smda_report.buffer = file_content
+        except Exception as exc:
+            LOGGER.error("An error occurred while disassembling buffer.")
+            # print("-> an error occured (", str(exc), ").")
+            smda_report = self._createErrorReport(start, exc)
+        return smda_report
+
+    def _disassemble(self, binary_info, timeout=0):
+        self._start_time = datetime.datetime.now(datetime.timezone.utc)
+        self._timeout = timeout
+        self.disassembly = self.disassembler.analyzeBuffer(binary_info, self._callbackAnalysisTimeout)
+        return SmdaReport(self.disassembly, config=self.config)
+
+    def _createErrorReport(self, start, exception):
+        report = SmdaReport(config=self.config)
+        report.smda_version = self.config.VERSION
+        report.status = "error"
+        report.execution_time = self._getDurationInSeconds(start, datetime.datetime.now(datetime.timezone.utc))
+        report.message = traceback.format_exc()
+        return report

smda/DisassemblyResult.py

@@ -0,0 +1,297 @@
+import datetime
+import struct
+
+from smda.common.BasicBlock import BasicBlock
+
+
+class DisassemblyResult:
+    def __init__(self):
+        self.analysis_start_ts = datetime.datetime.now(datetime.timezone.utc)
+        self.analysis_end_ts = self.analysis_start_ts
+        self.analysis_timeout = False
+        self.binary_info = None
+        self.identified_alignment = 0
+        self.oep = None
+        self.code_map = {}
+        self.data_map = set()
+        # key: offset, value: {"type": <str>, "instruction_bytes": <hexstr>}
+        self.errors = {}
+        # stored as key:
+        self.functions = {}
+        self.recursive_functions = set()
+        self.leaf_functions = set()
+        self.thunk_functions = set()
+        self.exported_functions = set()
+        self.failed_analysis_addr = []
+        self.function_borders = {}
+        # stored as key: int(i.address) = (i.size, i.mnemonic, i.op_str)
+        self.instructions = {}
+        self.ins2fn = {}
+        self.language = {}
+        self.data_refs_from = {}
+        self.data_refs_to = {}
+        self.code_refs_from = {}
+        self.code_refs_to = {}
+        # key: address of API in target DLL, value: {referencing_addr, api_name, dll_name}
+        self.apis = {}
+        self.addr_to_api = {}
+        # address:name
+        self.function_symbols = {}
+        # address:string
+        self.stringrefs = {}
+        self.candidates = {}
+        self._confidence_threshold = 0.0
+        self.code_areas = []
+        self.smda_version = ""
+
+    def setBinaryInfo(self, binary_info):
+        self.binary_info = binary_info
+        exported = binary_info.getExportedFunctions()
+        if exported is not None:
+            self.exported_functions = {key + binary_info.base_addr for key in exported}
+        self.oep = binary_info.getOep()
+
+    def getByte(self, addr):
+        if self.isAddrWithinMemoryImage(addr):
+            return self.binary_info.binary[addr - self.binary_info.base_addr]
+        return None
+
+    def getRawByte(self, offset):
+        return self.binary_info.binary[offset]
+
+    def getBytes(self, addr, num_bytes):
+        if self.isAddrWithinMemoryImage(addr):
+            rel_start_addr = addr - self.binary_info.base_addr
+            return self.binary_info.binary[rel_start_addr : rel_start_addr + num_bytes]
+        return None
+
+    def getRawBytes(self, offset, num_bytes):
+        return self.binary_info.binary[offset : offset + num_bytes]
+
+    def setConfidenceThreshold(self, threshold):
+        self._confidence_threshold = threshold
+
+    def getConfidenceThreshold(self):
+        return self._confidence_threshold
+
+    def getAnalysisDuration(self):
+        return (self.analysis_end_ts - self.analysis_start_ts).seconds + (
+            (self.analysis_end_ts - self.analysis_start_ts).microseconds / 1000000.0
+        )
+
+    def getAnalysisOutcome(self):
+        outcome = "ok"
+        if self.analysis_timeout:
+            outcome = "timeout"
+        return outcome
+
+    def getFunctions(self):
+        return sorted(self.functions.keys())
+
+    def getBlocks(self, function_addr):
+        disasm_blocks = []
+        if function_addr in self.functions:
+            disasm_blocks = self.functions[function_addr]
+        bblocks = []
+
+        for block in disasm_blocks:
+            bblock = BasicBlock()
+            bblock.start_addr = block[0][0]
+            bblock.end_addr = block[-1][0]
+            bblock.instructions = [ins[0] for ins in block]
+            if bblock.end_addr in self.code_refs_from:
+                bblock.successors = list(self.code_refs_from[bblock.end_addr])
+            bblocks.append(bblock)
+        return bblocks
+
+    def _transformInstruction(self, ins_tuple):
+        ins_addr, _, ins_mnem, ins_ops, ins_raw_bytes = ins_tuple
+        # python3  and python2 do handling differently...
+        ins_hexbytes = "".join([f"{c:02x}" for c in ins_tuple[4]])
+        return [ins_addr, ins_hexbytes, str(ins_mnem), str(ins_ops)]
+
+    def getBlocksAsDict(self, function_addr):
+        blocks = {}
+        for block in self.functions[function_addr]:
+            instructions = []
+            for ins in block:
+                instructions.append(self._transformInstruction(ins))
+            blocks[instructions[0][0]] = instructions
+        return blocks
+
+    def getInstructions(self, block):
+        return block.instructions
+
+    def getMnemonic(self, instruction_addr):
+        if instruction_addr in self.instructions:
+            return self.instructions[instruction_addr][0]
+        return ""
+
+    def isCode(self, addr):
+        return addr in self.code_map
+
+    def isAddrWithinMemoryImage(self, destination):
+        if destination is not None:
+            return (
+                self.binary_info.base_addr <= destination < (self.binary_info.base_addr + self.binary_info.binary_size)
+            )
+        return False
+
+    def dereferenceDword(self, addr):
+        if self.isAddrWithinMemoryImage(addr):
+            rel_start_addr = addr - self.binary_info.base_addr
+            rel_end_addr = rel_start_addr + 4
+            extracted_dword = self.binary_info.binary[rel_start_addr:rel_end_addr]
+            if len(extracted_dword) < 4:
+                return None
+            return struct.unpack("I", extracted_dword)[0]
+        return None
+
+    def dereferenceQword(self, addr):
+        if self.isAddrWithinMemoryImage(addr):
+            rel_start_addr = addr - self.binary_info.base_addr
+            rel_end_addr = rel_start_addr + 8
+            extracted_qword = self.binary_info.binary[rel_start_addr:rel_end_addr]
+            if len(extracted_qword) < 8:
+                return None
+            return struct.unpack("Q", extracted_qword)[0]
+        return None
+
+    def addCodeRefs(self, addr_from, addr_to):
+        refs_from = self.code_refs_from.get(addr_from, set())
+        refs_from.update([addr_to])
+        self.code_refs_from[addr_from] = refs_from
+        refs_to = self.code_refs_to.get(addr_to, set())
+        refs_to.update([addr_from])
+        self.code_refs_to[addr_to] = refs_to
+
+    def removeCodeRefs(self, addr_from, addr_to):
+        refs_from = self.code_refs_from.get(addr_from, set())
+        refs_from.discard(addr_to)
+        self.code_refs_from[addr_from] = refs_from
+        refs_to = self.code_refs_to.get(addr_to, set())
+        refs_to.discard(addr_from)
+        self.code_refs_to[addr_to] = refs_to
+
+    def addDataRefs(self, addr_from, addr_to):
+        refs_from = self.data_refs_from.get(addr_from, set())
+        refs_from.update([addr_to])
+        self.data_refs_from[addr_from] = refs_from
+        refs_to = self.data_refs_to.get(addr_to, set())
+        refs_to.update([addr_from])
+        self.data_refs_to[addr_to] = refs_to
+
+    def removeDataRefs(self, addr_from, addr_to):
+        refs_from = self.data_refs_from.get(addr_from, set())
+        refs_from.discard(addr_to)
+        self.data_refs_from[addr_from] = refs_from
+        refs_to = self.data_refs_to.get(addr_to, set())
+        refs_to.discard(addr_from)
+        self.data_refs_to[addr_to] = refs_to
+
+    def getBlockRefs(self, func_addr):
+        """blocks refs should stay within function context, thus kill all references outside function"""
+        block_refs = {}
+        ins_addrs = set()
+        for block in self.functions[func_addr]:
+            for ins in block:
+                ins_addr = ins[0]
+                ins_addrs.add(ins_addr)
+        for block in self.functions[func_addr]:
+            last_ins_addr = block[-1][0]
+            if last_ins_addr in self.code_refs_from:
+                verified_refs = sorted(ins_addrs.intersection(self.code_refs_from[last_ins_addr]))
+                if verified_refs:
+                    block_refs[block[0][0]] = verified_refs
+        return block_refs
+
+    def getInRefs(self, func_addr):
+        in_refs = []
+        if func_addr in self.code_refs_to:
+            in_refs = list(self.code_refs_to[func_addr])
+        return sorted(in_refs)
+
+    def getOutRefs(self, func_addr):
+        ins_addrs = set()
+        code_refs = []
+        out_refs = {}
+        for block in self.functions[func_addr]:
+            for ins in block:
+                ins_addr = ins[0]
+                ins_addrs.add(ins_addr)
+                if ins_addr in self.code_refs_from:
+                    for to_addr in self.code_refs_from[ins_addr]:
+                        code_refs.append([ins_addr, to_addr])
+        # function may be recursive
+        if func_addr in ins_addrs:
+            ins_addrs.remove(func_addr)
+        # reduce outrefs to addresses within the memory image
+        max_addr = self.binary_info.base_addr + self.binary_info.binary_size
+        image_refs = [ref for ref in code_refs if self.binary_info.base_addr <= ref[1] <= max_addr]
+        for ref in image_refs:
+            if ref[1] in ins_addrs:
+                continue
+            if ref[0] not in out_refs:
+                out_refs[ref[0]] = []
+            out_refs[ref[0]].append(ref[1])
+        return {src: sorted(dst) for src, dst in out_refs.items()}
+
+    def isRecursiveFunction(self, func_addr):
+        ins_addrs = set()
+        out_refs = set()
+        for block in self.functions[func_addr]:
+            for ins in block:
+                ins_addr = ins[0]
+                ins_addrs.add(ins_addr)
+                if ins_addr in self.code_refs_from:
+                    for to_addr in self.code_refs_from[ins_addr]:
+                        out_refs.add(to_addr)
+        return func_addr in out_refs
+
+    def isLeafFunction(self, func_addr):
+        ins_addrs = set()
+        out_refs = set()
+        for block in self.functions[func_addr]:
+            for ins in block:
+                ins_addr = ins[0]
+                ins_addrs.add(ins_addr)
+                if ins_addr in self.code_refs_from:
+                    for to_addr in self.code_refs_from[ins_addr]:
+                        out_refs.add(to_addr)
+        return len(out_refs.difference(ins_addrs)) == 0
+
+    def _initApiRefs(self):
+        for api_offset in self.apis:
+            api = self.apis[api_offset]
+            for ref in api["referencing_addr"]:
+                self.addr_to_api[ref] = "{}!{}".format(api["dll_name"], api["api_name"])
+
+    def getAllApiRefs(self):
+        all_api_refs = {}
+        for function_addr in self.functions:
+            all_api_refs.update(self.getApiRefs(function_addr))
+        return all_api_refs
+
+    def getApiRefs(self, func_addr):
+        if not self.addr_to_api:
+            self._initApiRefs()
+        api_refs = {}
+        for block in self.functions[func_addr]:
+            for ins in block:
+                if ins[0] in self.addr_to_api:
+                    api_refs[ins[0]] = self.addr_to_api[ins[0]]
+        return api_refs
+
+    def addStringRef(self, func_addr, ref_addr, string):
+        if func_addr not in self.stringrefs:
+            self.stringrefs[func_addr] = {}
+        self.stringrefs[func_addr][ref_addr] = string
+
+    def getStringRefsForFunction(self, func_addr):
+        # addr with ref: str
+        if func_addr in self.stringrefs:
+            return self.stringrefs[func_addr]
+        return {}
+
+    def __str__(self):
+        return f"-> {self.getAnalysisDuration():5.2f}s | {len(self.functions):5d} Func (status: {self.getAnalysisOutcome()})"

smda/DisassemblyStatistics.py

@@ -0,0 +1,86 @@
+class DisassemblyStatistics:
+    num_functions = None
+    num_recursive_functions = None
+    num_leaf_functions = None
+    num_basic_blocks = None
+    num_instructions = None
+    num_api_calls = None
+    num_function_calls = None
+    num_failed_functions = None
+    num_failed_instructions = None
+
+    def __init__(self, disassembly_result=None):
+        if disassembly_result is not None:
+            self.num_functions = len(disassembly_result.functions)
+            self.num_recursive_functions = len(disassembly_result.recursive_functions)
+            self.num_leaf_functions = len(disassembly_result.leaf_functions)
+            self.num_basic_blocks = self._countBlocks(disassembly_result)
+            self.num_instructions = self._countInstructions(disassembly_result)
+            self.num_api_calls = self._countApiCalls(disassembly_result)
+            self.num_function_calls = self._countFunctionCalls(disassembly_result)
+            self.num_failed_functions = len(disassembly_result.failed_analysis_addr)
+            self.num_failed_instructions = len(disassembly_result.errors)
+
+    def _countBlocks(self, disassembly_result):
+        num_blocks = 0
+        for _, blocks in disassembly_result.functions.items():
+            num_blocks += len(blocks)
+        return num_blocks
+
+    def _countApiCalls(self, disassembly_result):
+        return len(disassembly_result.getAllApiRefs())
+
+    def _countInstructions(self, disassembly_result):
+        num_ins = 0
+        for function_offset in sorted(disassembly_result.functions):
+            for block in disassembly_result.functions[function_offset]:
+                num_ins += len(block)
+        return num_ins
+
+    def _countFunctionCalls(self, disassembly_result):
+        num_calls = 0
+        for function_start in disassembly_result.functions:
+            if function_start in disassembly_result.code_refs_to:
+                num_calls += len(disassembly_result.code_refs_to[function_start])
+        return num_calls
+
+    @classmethod
+    def fromDict(cls, statistics_dict):
+        statistics = cls(None)
+        statistics.num_functions = statistics_dict["num_functions"]
+        statistics.num_recursive_functions = statistics_dict["num_recursive_functions"]
+        statistics.num_leaf_functions = statistics_dict["num_leaf_functions"]
+        statistics.num_basic_blocks = statistics_dict["num_basic_blocks"]
+        statistics.num_instructions = statistics_dict["num_instructions"]
+        statistics.num_api_calls = statistics_dict["num_api_calls"]
+        statistics.num_function_calls = statistics_dict["num_function_calls"]
+        statistics.num_failed_functions = statistics_dict["num_failed_functions"]
+        statistics.num_failed_instructions = statistics_dict["num_failed_instructions"]
+        return statistics
+
+    def toDict(self):
+        return {
+            "num_functions": self.num_functions,
+            "num_recursive_functions": self.num_recursive_functions,
+            "num_leaf_functions": self.num_leaf_functions,
+            "num_basic_blocks": self.num_basic_blocks,
+            "num_instructions": self.num_instructions,
+            "num_api_calls": self.num_api_calls,
+            "num_function_calls": self.num_function_calls,
+            "num_failed_functions": self.num_failed_functions,
+            "num_failed_instructions": self.num_failed_instructions,
+        }
+
+    def __add__(self, other):
+        if not isinstance(other, DisassemblyStatistics):
+            raise ValueError("Needs another DisassemblyStatistics to perform addition of values")
+        self.num_functions += other.num_functions
+        self.num_recursive_functions += other.num_recursive_functions
+        self.num_leaf_functions += other.num_leaf_functions
+        self.num_basic_blocks += other.num_basic_blocks
+        self.num_instructions += other.num_instructions
+        self.num_api_calls += other.num_api_calls
+        self.num_function_calls += other.num_function_calls
+        self.num_failed_functions += other.num_failed_functions
+        self.num_failed_instructions += other.num_failed_instructions
+        return self

smda/SmdaConfig.py

@@ -0,0 +1,44 @@
+import logging
+import os
+
+
+class SmdaConfig:
+    # note to self: always change this in setup.py as well!
+    VERSION = "2.4.2"
+    ESCAPER_DOWNWARD_COMPATIBILITY = "1.13.16"
+    CONFIG_FILE_PATH = str(os.path.abspath(__file__))
+    PROJECT_ROOT = str(os.path.abspath(os.sep.join([CONFIG_FILE_PATH, "..", ".."])))
+
+    ### An (optional) WinAPI database as generated by ApiScout (https://github.com/danielplohmann/apiscout)
+    API_COLLECTION_FILES = {}
+    ### global logging-config setup
+    # Only do basicConfig if no handlers have been configured
+    LOG_PATH = "./"
+    LOG_LEVEL = logging.INFO
+    LOG_FORMAT = "%(asctime)-15s: %(name)-32s - %(message)s"
+
+    ### SMDA disassembler config
+    # maximum time in seconds for disassembly to complete
+    TIMEOUT = 300
+    # maximum number of bytes to allocate while loading
+    MAX_IMAGE_SIZE = 100 * 1024 * 1024
+    # store raw binary buffer in SmdaReport to enable carving data from refs
+    STORE_BUFFER = False
+    # extract strings during disassembly
+    WITH_STRINGS = False
+    # the queue to use for candidate management
+    CANDIDATE_QUEUE = "PriorityQueue"  # choose from: ["BracketQueue", "PriorityQueue"]
+    # improve disassembly by resolving references through data flows
+    USE_ALIGNMENT = True
+    USE_SYMBOLS_AS_CANDIDATES = True
+    RESOLVE_REGISTER_CALLS = True
+    # limit this to avoid blowing up analysis time for weird samples
+    MAX_INDIRECT_CALLS_PER_BASIC_BLOCK = 50
+    HIGH_ACCURACY = True
+    RESOLVE_TAILCALLS = False
+    # optional metadata generation options
+    CALCULATE_SCC = True
+    CALCULATE_NESTING = True
+    CALCULATE_HASHING = True
+    # confidence score to use for filtering functions before including them in the output
+    CONFIDENCE_THRESHOLD = 0.0