a question for use

[zhefox]

How can I write a rule to determine if the arguments of a function are passed by reference to the function that calls it?

[Martyx00]

This is very hard to do as in C (and also the pseudo-C used by IDA) there is only pass by value. You are actually passing the value of a pointer rather than reference and in this case it may sometimes be impossible to distinguish between simple constant/variable and a pointer.

Anyway, I have put some basic code into the dev branch here: https://github.com/Accenture/VulFi/commit/9a88f82908083fd4271dbaa6deee0825fd02cea4

You can create a custom rule like this:

[
    {
        "name": "RULE NAME",
        "function_names":[
            "func",
            "func2"
        ],
        "wrappers":true,
        "mark_if":{
            "High":"param[0].is_pointer()",
            "Medium":"False",
            "Low": "False"
        }
    }
]

Keep in mind that this will be highly unreliable as there may be a lot of cases where the decompiler output will treat passing pointers as arguments as simple int values.