LAVA实现源码文件分析

fninstr.py

First analysis.

Determine complete set of named function we have seen.
确定已经发现的所有命名函数的完整集合。
Four sources of information for this.

1. Function definitions. We know it’s a definition if it contains an implementation (body)
2. Function declarations (prototype, with return type, and param types)
3. Function calls. No fn should be called unless we have a prototype for it? If we are looking at preprocessed code.

Second analysis.

**Determine which functions we will instrument. **
确定哪些函数需要插桩
This is a little more complicated than determining which are internal functions for which we have bodies and which are not. When we say we will instrument a
function we mean both of the following.

• Adding lava queries to body (that could later find DUAs or ATPs
  un