What is a subset of the problems that static analysis cannot capture?

Question

I am trying to understand the difference between static analysis and dynamic analysis for the purpose of program execution, to detect security vulnerabilities.

It is quite clear that the primary weakness of dynamic analysis lies in the fact that it cannot investigate all the possible states that the program may fall into, since it relies on the actual execution of the program with a certain set of inputs.

However, the static analysis seems to cause all possible states of the programs, so I cannot imagine a scenario where the static analysis might fail, although I am sure that such a scenario exists. Most of the links I looked at seem to vaguely say that "abstract state analysis" is not as accurate as dynamic analysis can give, but it is too fluffy for me.

Can someone give a simple explanation of concrete examples of where static analysis fails and dynamic analysis is needed?

Answer 1

Static analysis cannot be complete for all programs if Turing complete is an input format (including almost all programming languages), since in the general case it is impossible to determine whether any part of the code is running or not: you cannot determine whether the code stops before it endings i.e. execution ends (if it goes into an infinite loop, then any “problem” beyond it is fictitious, since it is unattainable) - a problem known as a problem.

However, in principle, all possible problems can be found if you also allow the analysis to output “problems” that do not actually exist. This is what almost all static analysis tools do - a large amount of engineering effort has been expended to minimize the amount of false problems that they report.

In addition, it is worth noting that some state intelligence systems essentially execute a program for each state (as a rule, stop a new study if the state has become equivalent), however, many programs have impractically large input spaces (consider any program that uses text input!) , which makes them almost impossible for a complete study of all conditions.