Looking for sscanf callers
As you know, finding an unsafe function in the program does not necessarily mean that the program is vulnerable. To confirm if a function is vulnerable we need to analyze the caller functions and analyze the parameters passed to the unsafe function.
Enumerating caller functions
The following code snippet can be used to identify the caller functions:
00 from ghidra.program.database.symbol import FunctionSymbol 01 functionManager = program.getFunctionManager() 02Â Â Â for sscanf in list_of_sscanfs: 03Â Â Â Â Â if isinstance(sscanf, FunctionSymbol): 04Â Â Â Â Â Â Â for ref in sscanf.references: 05Â Â Â Â Â Â Â Â Â caller = functionManager.getFunctionContaining( 06Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â ...