Should we just run backtracer on every function and for r0-r3? Then we could just query for the functions we care about.

[alecdeshotels]

This would also make it much easier to query for a parameter such as a file path and then see which function it gets used in. Backtracer should also include code address for easy manual investigation.

I could also do something like

calledFunc(process(...),function(...),address(...),r0("some value"),r1(unknown),r2("some value"),r3(unknown)).
%this way we can use atoms instead of strings to represent sentinel values for when we don't find a valid value for the register.
%most of the time our queries should be aware of which registers are relevant anyway such as only considerring r0 and r1 for a chmod function.

We would need to do some post processing on the register values depending on the data type of the parameters. Fortunately, IDA can infer the parameters for well known functions, and we can use this information to know how to process each parameter. Our prolog facts could also include the data type (e.g., r0(rawValue(0x2382AB32),type("const char*),processed_value("/var/mobile/Media/")).)