My friend Chris wrote an interesting paper on inferring things from static analysis based on the calling of known functions to re-construct program flow and even find bugs: http://chris.rohlf.googlepages.com/Static_DS_REC.pdf

Yeah he's an Ubuntu / Linux geek - and I try not to hold that against him.  And like a good friend I've offered to generate new X.509 certs for him. :)