New AI-Hybrid Tool Reconstructs Hidden Function Calls in C Programs Using Opaque Code

Computer scientists have unveiled Facet, an analysis system that tackles a longstanding challenge in understanding how C programs dispatch function calls when critical type metadata is missing. The tool combines symbolic analysis with AI decision-making to reconstruct function-pointer relationships in code that has been compiled to a stripped-down intermediate form.

The Challenge of Opaque Pointers#

Modern compilers increasingly abandon detailed type information in favor of opaque pointers—memory addresses without metadata about what data they reference. LLVM 17, a widely used compiler infrastructure, removed pointee types entirely. This change broke traditional call-graph analysis methods that relied on type matching to link indirect function calls to their targets.

Traditional tools like MLTA had used type information to match a function pointer at a particular field in a data structure with other functions assigned to that same field. Once that type label vanished, the matching key itself disappeared, leaving analyses unable to trace which functions a program could dispatch through a pointer.

How Facet Reconstructs the Missing Links#

Facet decouples the problem into two tractable parts:

• Field identification: The system pinpoints the structure field from which an indirect call loads its function pointer, even without type annotations.
• Function recovery: It separately gathers all functions the program assigns to that field through initializers, stores, and data copies.

The tool then connects these two pieces by field identity alone—without requiring an unbroken value-flow path through the code. Facet classifies each proposed call-graph link under distinct evidence rules for both adding and removing edges, and records the reasoning behind every refinement. When symbolic analysis leaves ambiguity, a language model steps in to resolve only the remaining uncertain cases among candidates bounded by static analysis.

Results and Real-World Impact#

Testing on 14 C programs showed substantial improvement. Facet reduced the mean set of potential function targets from 25.9 down to 5.2 per call site, while lifting observed recall from 0.79 to 0.99. Its recovered field identities matched the types found in unstripped (typed) intermediate representations at 98.1% of sites both analyses could resolve.