Currently, for a matched signature, we're exposing the following things -
- Identifier keywords / expression that caused a call to happen
- Caller Function node definition
- Callee function node definition (if available)
For examples like this -
class Class1:
def method1():
xyz(...)
With available match information for xyz function, we can easily get these values -
- definition of
method1
- identifier causing this match -
xyz
However, for use cases like malware analysis, it could be better to have more context about matched evidences
eg. method1 could have different meaning in Class1 and Class2
We should think about a way for consumer to get this information (maybe at multiple levels like, scope, function, class, file etc)