2 ms·

Isn't this impossible as per the halting problem? It would be better to run the code in a sandbox and log all the syscalls it makes, similar to how Cuckoo's ma

• Scea91 4y ago
  Halting problem is only relevant if we are discussing a perfect 100% solution with no false-positives and false-negatives. In real-life it is not of much relevance. I haven't seen a practical case in my life where I would conclude that it is undecidable to say what a function does (happy to see some practical examples if someone has some). For a theoretical program that "uploads credentials iff a sub-program halts" you would probably block it and live with a possible false-positive.
  • PeterisP 4y ago
    > undecidable to say what a function does (happy to see some practical examples if someone has some) Any and all functions that involve templating/plugins/metaprogramming/etc (common in various web frameworks) that can effectively run arbitrary code and thus are undecidable. Also any function that does deserialization and thus will instantiate novel objects with their code, e.g. Python code that uses pickle will often be undecidable as its execution will depend on what exactly is unpickled.