When we're doing reverse engineering, we have a few levels of models. One of them is the instruction semantics model, which tells us what every native instruction does to modify instruction state. We're making progress there. However, another problem is that of platform semantics, which is at a higher level.
For example, a high-level model of a userspace linux program would need to include information about mprotect and that it can alter the visibility of certain regions of code. Threading and callback semantics are also a platform modeling issue, we can discover a programs entrypoint from its header (which is another kind of semantic! but one we're probably not going to compromise on), but other entrypoints are published in the program in the form of arguments to atexit, pthread_create, etc.
What is our current best effort/state of the art at capturing this high level platform information in a way that is understood by practicioners? What about by mechanical / automated understanding systems? I know that IDA has (or has to have) information about different platform APIs, it seems to know that when an immediate is a parameter to pthread_create then that immediate is a pointer to code and should be treated as such. What do we have beyond that?