Remove DLL resolve tracking (Windows Defender false positive)

The DLL resolve feature (f92fd66) contained literal strings
GetProcAddress, dlsym, LoadLibrary that triggered Windows Defender
Wacatac.B!ml heuristic detection on the v0.5.4 binary. These are
the exact API names malware uses for dynamic API resolution.

Removed the feature entirely — it served a niche use case (C/C++
projects with dynamic DLL loading) and the false positive blocks
all Windows users from using the tool.

Fixes #89.

Author: DeusData

src/pipeline/pass_calls.c

@@ -294,7 +294,6 @@ int cbm_pipeline_pass_calls(cbm_pipeline_ctx_t *ctx, const cbm_file_info_t *file
 
     /* Additional pattern-based edge passes run after normal call resolution */
     cbm_pipeline_pass_fastapi_depends(ctx, files, file_count);
-    cbm_pipeline_pass_dll_resolve(ctx, files, file_count);
 
     return 0;
 }
@@ -439,164 +438,6 @@ void cbm_pipeline_pass_fastapi_depends(cbm_pipeline_ctx_t *ctx, const cbm_file_i
     }
 }
 
-/* ── DLL resolve tracking ────────────────────────────────────────── */
-/* Scans C/C++ function source for dynamic DLL resolution patterns
- * (GetProcAddress, dlsym, Resolve) and creates CALLS edges to synthetic
- * stub nodes, enabling call graph tracking across DLL boundaries. */
-
-// NOLINTNEXTLINE(misc-include-cleaner) — cbm_file_info_t provided by standard header
-void cbm_pipeline_pass_dll_resolve(cbm_pipeline_ctx_t *ctx, const cbm_file_info_t *files,
-                                   int file_count) {
-    cbm_regex_t getproc_re;
-    cbm_regex_t dlsym_re;
-    cbm_regex_t resolve_re;
-
-    if (cbm_regcomp(&getproc_re,
-                    "GetProcAddress[AW]?\\([^,]+,[[:space:]]*\"([A-Za-z_][A-Za-z0-9_]*)\"",
-                    CBM_REG_EXTENDED) != 0) {
-        return;
-    }
-    if (cbm_regcomp(&dlsym_re, "dlsym\\([^,]+,[[:space:]]*\"([A-Za-z_][A-Za-z0-9_]*)\"",
-                    CBM_REG_EXTENDED) != 0) {
-        cbm_regfree(&getproc_re);
-        return;
-    }
-    if (cbm_regcomp(&resolve_re, "[.>]Resolve\\([[:space:]]*\"([A-Za-z_][A-Za-z0-9_]*)\"",
-                    CBM_REG_EXTENDED) != 0) {
-        cbm_regfree(&getproc_re);
-        cbm_regfree(&dlsym_re);
-        return;
-    }
-
-    cbm_regex_t *patterns[] = {&getproc_re, &dlsym_re, &resolve_re};
-
-    int edge_count = 0;
-    for (int i = 0; i < file_count; i++) {
-        if (files[i].language != CBM_LANG_C && files[i].language != CBM_LANG_CPP) {
-            continue;
-        }
-        if (cbm_pipeline_check_cancel(ctx)) {
-            break;
-        }
-
-        CBMFileResult *result = ctx->result_cache ? ctx->result_cache[i] : NULL;
-        if (!result) {
-            continue;
-        }
-
-        /* Early bail: check if any call targets a DLL resolution function */
-        bool has_dll_call = false;
-        for (int c = 0; c < result->calls.count; c++) {
-            const char *name = result->calls.items[c].callee_name;
-            if (!name) {
-                continue;
-            }
-            if (strcmp(name, "GetProcAddress") == 0 || strcmp(name, "GetProcAddressA") == 0 ||
-                strcmp(name, "GetProcAddressW") == 0 || strcmp(name, "dlsym") == 0 ||
-                strstr(name, "Resolve") != NULL) {
-                has_dll_call = true;
-                break;
-            }
-        }
-        if (!has_dll_call) {
-            continue;
-        }
-
-        int source_len = 0;
-        char *source = read_file(files[i].path, &source_len);
-        if (!source) {
-            continue;
-        }
-
-        char *module_qn = cbm_pipeline_fqn_module(ctx->project_name, files[i].rel_path);
-
-        for (int d = 0; d < result->defs.count; d++) {
-            CBMDefinition *def = &result->defs.items[d];
-            if (!def->qualified_name || def->start_line == 0 || def->end_line == 0) {
-                continue;
-            }
-            if (strcmp(def->label, "Function") != 0 && strcmp(def->label, "Method") != 0) {
-                continue;
-            }
-
-            /* Extract function body from source */
-            const char *p = source;
-            int line = 1;
-            while (*p && line < def->start_line) {
-                if (*p == '\n') {
-                    line++;
-                }
-                p++;
-            }
-            const char *body_start = p;
-            while (*p && line < def->end_line) {
-                if (*p == '\n') {
-                    line++;
-                }
-                p++;
-            }
-            size_t body_len = (size_t)(p - body_start);
-            char *body = malloc(body_len + 1);
-            if (!body) {
-                continue;
-            }
-            memcpy(body, body_start, body_len);
-            body[body_len] = '\0';
-
-            /* Match each DLL resolution pattern */
-            for (int pi = 0; pi < 3; pi++) {
-                cbm_regmatch_t match[2];
-                const char *scan = body;
-                while (cbm_regexec(patterns[pi], scan, 2, match, 0) == 0) {
-                    int fn_len = match[1].rm_eo - match[1].rm_so;
-                    char func_name[256];
-                    if (fn_len >= (int)sizeof(func_name)) {
-                        fn_len = (int)sizeof(func_name) - 1;
-                    }
-                    memcpy(func_name, scan + match[1].rm_so, (size_t)fn_len);
-                    func_name[fn_len] = '\0';
-
-                    /* Create edge to synthetic DLL stub node */
-                    char target_qn[512];
-                    snprintf(target_qn, sizeof(target_qn), "%s.dll.external.%s", module_qn,
-                             func_name);
-
-                    const cbm_gbuf_node_t *src_node =
-                        cbm_gbuf_find_by_qn(ctx->gbuf, def->qualified_name);
-                    if (src_node) {
-                        /* Create stub node if it doesn't exist */
-                        if (!cbm_gbuf_find_by_qn(ctx->gbuf, target_qn)) {
-                            char stub_props[256];
-                            snprintf(stub_props, sizeof(stub_props),
-                                     "{\"stub\":true,\"source\":\"dll_resolve\","
-                                     "\"dll_function\":\"%s\"}",
-                                     func_name);
-                            cbm_gbuf_upsert_node(ctx->gbuf, "Function", func_name, target_qn,
-                                                 files[i].rel_path, (int)def->start_line,
-                                                 (int)def->start_line, stub_props);
-                        }
-                        const cbm_gbuf_node_t *tgt_node = cbm_gbuf_find_by_qn(ctx->gbuf, target_qn);
-                        if (tgt_node) {
-                            cbm_gbuf_insert_edge(ctx->gbuf, src_node->id, tgt_node->id, "CALLS",
-                                                 "{\"confidence\":0.85,\"strategy\":\"dll_resolve\""
-                                                 "}");
-                            edge_count++;
-                        }
-                    }
-                    scan += match[0].rm_eo;
-                }
-            }
-            free(body);
-        }
-
-        free(module_qn);
-        free(source);
-    }
-
-    cbm_regfree(&getproc_re);
-    cbm_regfree(&dlsym_re);
-    cbm_regfree(&resolve_re);
-    if (edge_count > 0) {
-        cbm_log_info("pass.dll_resolve", "edges", itoa_log(edge_count));
-    }
-}
+/* DLL resolve tracking removed — the string literals (GetProcAddress, dlsym,
+ * LoadLibrary) triggered Windows Defender Wacatac.B!ml false positive.
+ * See: https://github.com/DeusData/codebase-memory-mcp/issues/89 */

src/pipeline/pipeline_internal.h

@@ -358,8 +358,6 @@ int cbm_pipeline_pass_calls(cbm_pipeline_ctx_t *ctx, const cbm_file_info_t *file
 /* Sub-passes called from pass_calls: pattern-based edge extraction */
 void cbm_pipeline_pass_fastapi_depends(cbm_pipeline_ctx_t *ctx, const cbm_file_info_t *files,
                                        int file_count);
-void cbm_pipeline_pass_dll_resolve(cbm_pipeline_ctx_t *ctx, const cbm_file_info_t *files,
-                                   int file_count);
 
 int cbm_pipeline_pass_usages(cbm_pipeline_ctx_t *ctx, const cbm_file_info_t *files, int file_count);
 

tests/test_pipeline.c

@@ -4795,73 +4795,8 @@ TEST(pipeline_fastapi_depends_edges) {
     PASS();
 }
 
-/* ═══════════════════════════════════════════════════════════════════
- *  DLL resolve edge tracking (PR #66, fix #29)
- * ═══════════════════════════════════════════════════════════════════ */
-
-TEST(pipeline_dll_resolve_edges) {
-    /* GetProcAddress(handle, "Func") should produce a CALLS edge to a
-     * synthetic DLL stub node. */
-    const char *files[] = {"loader.c"};
-    const char *contents[] = {
-        "#include <windows.h>\n\n"
-        "void load_plugin(HMODULE hDll) {\n"
-        "    void *fn = GetProcAddress(hDll, \"PluginInit\");\n"
-        "    if (fn) ((void(*)())fn)();\n"
-        "}\n"};
-    if (setup_lang_repo(files, contents, 1) != 0) {
-        SKIP("tmpdir");
-    }
-    char db[512];
-    snprintf(db, sizeof(db), "%s/test.db", g_lang_tmpdir);
-    cbm_pipeline_t *p = cbm_pipeline_new(g_lang_tmpdir, db, CBM_MODE_FULL);
-    ASSERT_NOT_NULL(p);
-    ASSERT_EQ(cbm_pipeline_run(p), 0);
-
-    cbm_store_t *s = cbm_store_open_path(db);
-    ASSERT_NOT_NULL(s);
-    const char *proj = cbm_pipeline_project_name(p);
-
-    /* Check for dll_resolve CALLS edge */
-    cbm_edge_t *edges = NULL;
-    int edge_count = 0;
-    cbm_store_find_edges_by_type(s, proj, "CALLS", &edges, &edge_count);
-
-    bool found_dll_edge = false;
-    for (int i = 0; i < edge_count; i++) {
-        if (edges[i].properties_json && strstr(edges[i].properties_json, "dll_resolve")) {
-            found_dll_edge = true;
-            break;
-        }
-    }
-    if (edges) {
-        cbm_store_free_edges(edges, edge_count);
-    }
-    ASSERT_TRUE(found_dll_edge);
-
-    /* Check for stub node with dll_function property */
-    cbm_node_t *nodes = NULL;
-    int node_count = 0;
-    cbm_store_find_nodes_by_label(s, proj, "Function", &nodes, &node_count);
-
-    bool found_stub = false;
-    for (int i = 0; i < node_count; i++) {
-        if (nodes[i].properties_json && strstr(nodes[i].properties_json, "PluginInit") &&
-            strstr(nodes[i].properties_json, "dll_resolve")) {
-            found_stub = true;
-            break;
-        }
-    }
-    if (nodes) {
-        cbm_store_free_nodes(nodes, node_count);
-    }
-    ASSERT_TRUE(found_stub);
-
-    cbm_store_close(s);
-    cbm_pipeline_free(p);
-    teardown_lang_repo();
-    PASS();
-}
+/* DLL resolve test removed — feature removed due to Windows Defender
+ * false positive (Wacatac.B!ml). See issue #89. */
 
 /* ═══════════════════════════════════════════════════════════════════
  *  Incremental reindex
@@ -5188,9 +5123,8 @@ SUITE(pipeline) {
     RUN_TEST(githistory_coupling_skips_large_commits);
     RUN_TEST(githistory_coupling_limits_output);
     /* Incremental reindex */
-    /* FastAPI Depends + DLL resolve edge tracking (PR #66 port) */
+    /* FastAPI Depends edge tracking (PR #66 port) */
     RUN_TEST(pipeline_fastapi_depends_edges);
-    RUN_TEST(pipeline_dll_resolve_edges);
     /* Incremental */
     RUN_TEST(incremental_full_then_noop);
     RUN_TEST(incremental_detects_changed_file);