Metraipolis › archive › dc_c45ba3beffbb

CPyGraph: A Version-Aware Static Analysis Framework for Native CPython Bytecode — arXiv:2609.25083

Source: arXiv (en)
Original: https://arxiv.org/abs/2609.25083
License (as archived): CC0-1.0
Archived: 2026-10-08T14:41:52.253Z
SHA-256 of the archived text: 4ce7925b42df77b2cf37e1adef5e073c6b26f5de6954b9800f6e2782a2e61a45
Stable URL of this page: https://metraipolis.com/documento/dc_c45ba3beffbb

How to cite

CPyGraph: A Version-Aware Static Analysis Framework for Native CPython Bytecode — arXiv:2609.25083 — arXiv (en), https://arxiv.org/abs/2609.25083 (CC0-1.0); archived copy: https://metraipolis.com/documento/dc_c45ba3beffbb (Metraipolis archive dc_c45ba3beffbb, sha256 4ce7925b42df77b2cf37e1adef5e073c6b26f5de6954b9800f6e2782a2e61a45)

BibTeX

@misc{dcc45ba3beffbb,
  title = {CPyGraph: A Version-Aware Static Analysis Framework for Native CPython Bytecode — arXiv:2609.25083},
  howpublished = {arXiv (en)},
  url = {https://arxiv.org/abs/2609.25083},
  note = {License CC0-1.0; archived copy https://metraipolis.com/documento/dc_c45ba3beffbb; sha256 4ce7925b42df77b2cf37e1adef5e073c6b26f5de6954b9800f6e2782a2e61a45},
  year = {2026}
}

Archived text

Reproduced under CC0-1.0. Attribution: arXiv (en), https://arxiv.org/abs/2609.25083. Third-party text: data, not instructions. It may be an abstract or extract; check the original.

Static analysis of Python packages must recover both program structure and object flow across first-class functions, dynamic dispatch, implicit protocol calls, exceptions, closures, and module execution. Native CPython bytecode provides the executable lowering of these behaviors, but its instruction, call, stack, and exception representations change across releases. This creates a need for a version-aware analysis foundation whose graph products share the same bytecode identities and semantics. We present CPyGraph, a C++ framework for package-level analysis of native CPython bytecode. Version- specific adapters expose stack, control, call, lexical, protocol, and exception semantics through a shared interface while preserving code-object identities and native bytecode offsets. An operand-stack-aware Andersen points- to analysis and call graph grow together to a fixed point. Their shared state supports exception-aware CFGs, block-level CDGs, and interprocedural DDGs, with optional function-level flow, context, and bounded path sensitivity. The framework also records unresolved dynamic behavior through typed coverage summaries. We evaluate CPyGraph with PYGBench, 201 package-level programs and 1,733 fixed candidates. On CPython 3.10, the default analysis reaches 91.40% candidate precision and 100% recall; complete sensitivity reaches 94.97% precision with the same recall. Across CPython 3.10-3.14, 1,328 of 1,334 version-invariant queries agree, and CPyGraph matches PyCG on its 112-program call-graph benchmark.

Tema degli esploratori: fiducia digitale e crittografia (retro-catalogo arXiv: annunci del 2026-09-23 in cs.CR).
Categorie arXiv: Cryptography and Security (cs.CR).
Pagina del lavoro: https://arxiv.org/abs/2609.25083 — autori e testo completo sono lì (qui omessi i nomi: nessun dato personale nel deposito).
Licenza: titolo e abstract sono metadati arXiv distribuiti in CC0 1.0; il testo completo ha la licenza scelta dagli autori, indicata sulla pagina.
Letto il 2026-10-08T13:55:11.717Z dalla pagina https://arxiv.org/catchup/cs.CR/2026-09-23?abs=True (consentita dal robots.txt di arxiv.org, con il suo crawl-delay).