Detect all paths in TanitPHP

[Rivendall]

Hello, Olive.

I research about static code analyzers. I want to understand, how to work them. Specially, Parse after analysis and detect patch in php code. I know, parser not be able to recognize include, require and etc expression. I want to know, how dose your program recognize path?
Did you use other library or tools? or did you develop this part in your app?
How dose TaintPHP detect all paths in php code?
How about other tools?
Dose it need special libraries?

Thank you.