Java InstructionHandle类代码示例

import org.apache.bcel.generic.InstructionHandle; //导入依赖的package包/类
@Override
protected InjectionPoint getInjectionPoint(InvokeInstruction invoke, ConstantPoolGen cpg,
                                           InstructionHandle handle) {
    assert invoke != null && cpg != null;

    String method = invoke.getMethodName(cpg);
    String sig    = invoke.getSignature(cpg);

    if(method.equals("registerReceiver")){
        if(sig.contains("Ljava/lang/String;")){
            if(sig.contains(";I)")){
                return new InjectionPoint(new int[]{2}, ANDROID_REGISTER_RECEIVER_TYPE);
            }else{
                return new InjectionPoint(new int[]{1}, ANDROID_REGISTER_RECEIVER_TYPE);
            }
        }
    }
    return InjectionPoint.NONE;
}
 

import org.apache.bcel.generic.InstructionHandle; //导入依赖的package包/类
public void reportMatch(ClassContext classContext, Method method, ByteCodePatternMatch match) {
	MethodGen methodGen = classContext.getMethodGen(method);
	JavaClass javaClass = classContext.getJavaClass();

	BindingSet bindingSet = match.getBindingSet();

	// Note that the lookup of "h" cannot fail, and
	// it is guaranteed to be bound to a FieldVariable.
	Binding binding = bindingSet.lookup("h");
	FieldVariable field = (FieldVariable) binding.getVariable();

	// Ignore fields generated for accesses to Foo.class
	if (field.getFieldName().startsWith("class$"))
		return;

	// Find start and end instructions (for reporting source lines)
	InstructionHandle start = match.getLabeledInstruction("startDC");
	InstructionHandle end = match.getLabeledInstruction("endDC");

	String sourceFile = javaClass.getSourceFileName();
	bugReporter.reportBug(new BugInstance(this, "BCPDC_DOUBLECHECK", NORMAL_PRIORITY)
	        .addClassAndMethod(methodGen, sourceFile)
	        .addField(field).describe("FIELD_ON")
	        .addSourceLine(methodGen, sourceFile, start, end));
}
 

import org.apache.bcel.generic.InstructionHandle; //导入依赖的package包/类
public void transfer(BasicBlock basicBlock, InstructionHandle end, Fact start, Fact result) throws DataflowAnalysisException {
	startTransfer(basicBlock, start);

	copy(start, result);

	if (isFactValid(result)) {
		Iterator<InstructionHandle> i = isForwards() ? basicBlock.instructionIterator() : basicBlock.instructionReverseIterator();

		while (i.hasNext()) {
			InstructionHandle handle = i.next();
			if (handle == end)
				break;

			if (DEBUG && end == null) System.out.print("Transfer " + handle);

			// Transfer the dataflow value
			transferInstruction(handle, basicBlock, result);

			if (DEBUG && end == null) System.out.println(" ==> " + result.toString());
		}
	}

	endTransfer(basicBlock, end, result);
}
 

import org.apache.bcel.generic.InstructionHandle; //导入依赖的package包/类
public void transferInstruction(InstructionHandle handle, BasicBlock basicBlock, ValueNumberFrame fact)
        throws DataflowAnalysisException {

	Location location = new Location(handle, basicBlock);

	ValueNumberFrame atLocation = getFactAtLocation(location);
	copy(fact, atLocation);

	visitor.setFrame(fact);
	visitor.setHandle(handle);
	Instruction ins = handle.getInstruction();
	ins.accept(visitor);

	ValueNumberFrame afterLocation = getFactAfterLocation(location);
	copy(fact, afterLocation);
}
 

import org.apache.bcel.generic.InstructionHandle; //导入依赖的package包/类
@Override
protected InjectionPoint getInjectionPoint(InvokeInstruction invoke, ConstantPoolGen cpg,
                                           InstructionHandle handle) {
    assert invoke != null && cpg != null;

    String method = invoke.getMethodName(cpg);
    String sig    = invoke.getSignature(cpg);
    if(sig.startsWith("(Ljava/lang/String;)")) {
        if(method.startsWith("set")) { // Targeting : x.setPassword("abc123")
            String methodLowerCase = method.toLowerCase();
            for (String password : PASSWORD_WORDS) {
                if (methodLowerCase.contains(password)) {
                    return new InjectionPoint(new int[]{0}, HARD_CODE_PASSWORD_TYPE);
                }
            }
        } else if(PASSWORD_WORDS.contains(method.toLowerCase())) { // Targeting : DSL().user("").password(String x)
            return new InjectionPoint(new int[]{0}, HARD_CODE_PASSWORD_TYPE);
        }
    }
    return InjectionPoint.NONE;
}
 

import org.apache.bcel.generic.InstructionHandle; //导入依赖的package包/类
public void transferInstruction(InstructionHandle handle, BasicBlock basicBlock, LockSet fact)
        throws DataflowAnalysisException {

	Instruction ins = handle.getInstruction();
	short opcode = ins.getOpcode();
	if (opcode == Constants.MONITORENTER || opcode == Constants.MONITOREXIT) {
		ValueNumberFrame frame = vnaDataflow.getFactAtLocation(new Location(handle, basicBlock));

		// NOTE: if the CFG is pruned, there may be unreachable instructions,
		// so make sure frame is valid.
		if (frame.isValid()) {
			int lockNumber = frame.getTopValue().getNumber();
			lockOp(fact, lockNumber, opcode == Constants.MONITORENTER ? 1 : -1);
		}
	} else if ((ins instanceof ReturnInstruction) && isSynchronized && !isStatic) {
		lockOp(fact, vna.getThisValue().getNumber(), -1);
	}
}
 

import org.apache.bcel.generic.InstructionHandle; //导入依赖的package包/类
public void transfer(BasicBlock basicBlock, InstructionHandle end, BlockType start, BlockType result)
		throws DataflowAnalysisException {
	result.copyFrom(start);

	if (start.isValid()) {
		if (basicBlock.isExceptionHandler()) {
			CodeExceptionGen exceptionGen = basicBlock.getExceptionGen();
			ObjectType catchType = exceptionGen.getCatchType();
			if (catchType == null) {
				// Probably a finally block, or a synchronized block
				// exception-compensation catch block.
				result.pushFinally();
			} else {
				// Catch type was explicitly specified:
				// this is probably a programmer-written catch block
				result.pushCatch();
			}
		}
	}
}
 

import org.apache.bcel.generic.InstructionHandle; //导入依赖的package包/类
@Override
    protected InjectionPoint getInjectionPoint(InvokeInstruction invoke, ConstantPoolGen cpg,
                                               InstructionHandle handle) {
        assert invoke != null && cpg != null;

        String method = invoke.getMethodName(cpg);
        String sig    = invoke.getSignature(cpg);
//        System.out.println(sig);
        if(sig.contains("Ljava/lang/String;")) {
            if(method.contains("send") && method.contains("Broadcast") && !method.contains("Sticky")){
//                System.out.println(method);
                if("sendOrderedBroadcastAsUser".equals(method)){
                    return new InjectionPoint(new int[]{5}, ANDROID_BROADCAST_TYPE);
                }
                if("sendOrderedBroadcast".equals(method) && sig.contains("Landroid/content/BroadcastReceiver;")){
                    return new InjectionPoint(new int[]{5}, ANDROID_BROADCAST_TYPE);
                }
                return new InjectionPoint(new int[]{0}, ANDROID_BROADCAST_TYPE);
            }
        }
        return InjectionPoint.NONE;
    }
 

import org.apache.bcel.generic.InstructionHandle; //导入依赖的package包/类
/**
 * @see org.apache.bcel.classfile.Visitor#visitCode
 */
public void visitCode(Code aCode)
{   
    for (Iterator iter = mVisitors.iterator(); iter.hasNext();) {
        IDeepVisitor visitor = (IDeepVisitor) iter.next();
        Visitor v = visitor.getClassFileVisitor();
        aCode.accept(v);
    }
    
    // perform a deep visit
    final byte[] code = aCode.getCode();
    final InstructionList list = new InstructionList(code);
    final Iterator it = list.iterator();
    for (Iterator iter = list.iterator(); iter.hasNext();) {
        InstructionHandle instruction = (InstructionHandle) iter.next();
        visitInstructionHandle(instruction);
    }
}
 

import org.apache.bcel.generic.InstructionHandle; //导入依赖的package包/类
/**
 * Constructs the instance and stores immutable values for reporting
 * 
 * @param detector detctor for reporting
 * @param bugType reported bug type
 * @param originalPriority original priority (without sink confirmation)
 * @param classContext class with the sink
 * @param method method with the sink
 * @param instructionHandle instruction with the sink
 * @param sinkMethod called method (sink)
 * @throws NullPointerException if any argument is null
 */
public InjectionSink(Detector detector, String bugType, int originalPriority,
        ClassContext classContext, Method method, InstructionHandle instructionHandle,
        String sinkMethod) {
    Objects.requireNonNull(detector, "detector");
    Objects.requireNonNull(bugType, "bugType");
    Objects.requireNonNull(classContext, "classContext");
    Objects.requireNonNull(method, "method");
    Objects.requireNonNull(instructionHandle, "instructionHandle");
    this.detector = detector;
    this.bugType = bugType;
    this.originalPriority = originalPriority;
    this.classContext = classContext;
    this.method = method;
    this.instructionHandle = instructionHandle;
    this.sinkMethod = (sinkMethod == null) ? "unknown" : sinkMethod;
}
 

import org.apache.bcel.generic.InstructionHandle; //导入依赖的package包/类
/**
 * Factory method for creating a source line annotation describing the
 * source line number for a visited instruction.
 *
 * @param methodGen the MethodGen object representing the method
 * @param handle    the InstructionHandle containing the visited instruction
 * @return the SourceLineAnnotation, or null if we do not have line number information
 *         for the instruction
 */
public static SourceLineAnnotation fromVisitedInstruction(MethodGen methodGen, String sourceFile, InstructionHandle handle) {
	LineNumberTable table = methodGen.getLineNumberTable(methodGen.getConstantPool());
	String className = methodGen.getClassName();

	int bytecodeOffset = handle.getPosition();

	if (table == null)
		return createUnknown(className, sourceFile, bytecodeOffset, bytecodeOffset);

	int lineNumber = table.getSourceLine(handle.getPosition());
	return new SourceLineAnnotation(className, sourceFile, lineNumber, lineNumber, bytecodeOffset, bytecodeOffset);
}
 

import org.apache.bcel.generic.InstructionHandle; //导入依赖的package包/类
/**
 * Factory method for creating a source line annotation describing
 * the source line numbers for a range of instruction in a method.
 *
 * @param methodGen the method
 * @param start     the start instruction
 * @param end       the end instruction (inclusive)
 */
public static SourceLineAnnotation fromVisitedInstructionRange(MethodGen methodGen, String sourceFile, InstructionHandle start, InstructionHandle end) {
	LineNumberTable lineNumberTable = methodGen.getLineNumberTable(methodGen.getConstantPool());
	String className = methodGen.getClassName();

	if (lineNumberTable == null)
		return createUnknown(className, sourceFile, start.getPosition(), end.getPosition());

	int startLine = lineNumberTable.getSourceLine(start.getPosition());
	int endLine = lineNumberTable.getSourceLine(end.getPosition());
	return new SourceLineAnnotation(className, sourceFile, startLine, endLine, start.getPosition(), end.getPosition());
}
 

import org.apache.bcel.generic.InstructionHandle; //导入依赖的package包/类
private void reportNullDeref(ClassContext classContext, Method method, InstructionHandle exceptionThrowerHandle,
                             String type, int priority) {
	MethodGen methodGen = classContext.getMethodGen(method);
	String sourceFile = classContext.getJavaClass().getSourceFileName();

	BugInstance bugInstance = new BugInstance(this, type, priority)
	        .addClassAndMethod(methodGen, sourceFile)
	        .addSourceLine(methodGen, sourceFile, exceptionThrowerHandle);

	if (DEBUG)
		bugInstance.addInt(exceptionThrowerHandle.getPosition()).describe("INT_BYTECODE_OFFSET");

	bugReporter.reportBug(bugInstance);
}
 

import org.apache.bcel.generic.InstructionHandle; //导入依赖的package包/类
private void reportRedundantNullCheck(ClassContext classContext, Method method, InstructionHandle handle,
                                      RedundantBranch redundantBranch) {
	String sourceFile = classContext.getJavaClass().getSourceFileName();
	MethodGen methodGen = classContext.getMethodGen(method);

	boolean redundantNullCheck = redundantBranch.redundantNullCheck;
	String type = redundantNullCheck
	        ? "RCN_REDUNDANT_CHECKED_NULL_COMPARISION"
	        : "RCN_REDUNDANT_COMPARISON_TO_NULL";
	int priority = redundantNullCheck ? LOW_PRIORITY : NORMAL_PRIORITY;

	bugReporter.reportBug(new BugInstance(this, type, priority)
	        .addClassAndMethod(methodGen, sourceFile)
	        .addSourceLine(methodGen, sourceFile, handle));
}
 

import org.apache.bcel.generic.InstructionHandle; //导入依赖的package包/类
/**
 * Add a source line annotation describing a range of instructions.
 *
 * @param methodGen  the method
 * @param sourceFile source file the method is defined in
 * @param start      the start instruction in the range
 * @param end        the end instruction in the range (inclusive)
 * @return this object
 */
public BugInstance addSourceLine(MethodGen methodGen, String sourceFile, InstructionHandle start, InstructionHandle end) {
	// Make sure start and end are really in the right order.
	if (start.getPosition() > end.getPosition()) {
		InstructionHandle tmp = start;
		start = end;
		end = tmp;
	}
	SourceLineAnnotation sourceLineAnnotation = SourceLineAnnotation.fromVisitedInstructionRange(methodGen, sourceFile, start, end);
	if (sourceLineAnnotation != null)
		add(sourceLineAnnotation);
	return this;
}