Java InstanceFieldRef类代码示例

import soot.jimple.InstanceFieldRef; //导入依赖的package包/类
private Set<FlowAbstraction> getTaints(Value right, Value left, FlowAbstraction source, Unit src) {
	Set<FlowAbstraction> ret = new HashSet<FlowAbstraction>();
	FlowAbstraction fa = getTaint(right, left, source, src);
	if (fa != null)
		ret.add(fa);

	// f0 = o.x {o} -> taint f0 and o.x if o is API object
	if (right instanceof InstanceFieldRef && source.getLocal() != null && source.getFields().length == 0) {
		String type = ((InstanceFieldRef) right).getBase().getType().toString();
		// if o is an API object (ex: Point)
		if (!inProject(type)) {
			fa = FlowAbstraction.v(source.getSource(), right, src, icfg.getMethodOf(src), source);
			if (fa.hasPrefix(source.getLocal())) {
				ret.add(fa);
				fa = FlowAbstraction.v(source.getSource(), left, src, icfg.getMethodOf(src), source);
				ret.add(fa);
			}
		}

	}
	return ret;
}
 

import soot.jimple.InstanceFieldRef; //导入依赖的package包/类
/**
 * Gets the points-to-set for the given value
 * @param targetValue The value for which to get the points-to-set
 * @return The points-to-set for the given value
 */
private PointsToSet getPointsToSet(Value targetValue) {
	PointsToAnalysis pta = Scene.v().getPointsToAnalysis();
	synchronized (pta) {			
		if (targetValue instanceof Local)
			return pta.reachingObjects((Local) targetValue);
		else if (targetValue instanceof InstanceFieldRef) {
			InstanceFieldRef iref = (InstanceFieldRef) targetValue;
			return pta.reachingObjects((Local) iref.getBase(), iref.getField());
		}
		else if (targetValue instanceof StaticFieldRef) {
			StaticFieldRef sref = (StaticFieldRef) targetValue;
			return pta.reachingObjects(sref.getField());
		}
		else if (targetValue instanceof ArrayRef) {
			ArrayRef aref = (ArrayRef) targetValue;
			return pta.reachingObjects((Local) aref.getBase());
		}
		else
			throw new RuntimeException("Unexpected value type for aliasing: " + targetValue.getClass());
	}
}
 

import soot.jimple.InstanceFieldRef; //导入依赖的package包/类
@Override
public void computeAliasTaints(Abstraction d1, Stmt src, Value targetValue,
		Set<Abstraction> taintSet, SootMethod method, Abstraction newAbs) {
	// Use global aliasing
	Value baseValue = ((InstanceFieldRef) targetValue).getBase();
	Set<AccessPath> aliases = methodToAliases.getUnchecked(method).get
			(new AccessPath(baseValue, true));
	if (aliases != null)
		for (AccessPath ap : aliases) {
			Abstraction aliasAbs = newAbs.deriveNewAbstraction(
					ap.merge(newAbs.getAccessPath()), null);
			if (taintSet.add(aliasAbs))
				// We have found a new alias. This new base object may however yet
				// again alias with something, so we need to check again
				if (ap.isInstanceFieldRef()) {
					InstanceFieldRef aliasBaseVal = Jimple.v().newInstanceFieldRef
							(ap.getPlainValue(), ap.getFirstField().makeRef());
					computeAliasTaints(d1, src, aliasBaseVal, taintSet, method, aliasAbs);
				}
		}
}
 

import soot.jimple.InstanceFieldRef; //导入依赖的package包/类
/**
 * Checks whether the given base value matches the base of the given
 * taint abstraction
 * @param baseValue The value to check
 * @param source The taint abstraction to check
 * @return True if the given value has the same base value as the given
 * taint abstraction, otherwise false
 */
protected boolean baseMatches(final Value baseValue, Abstraction source) {
	if (baseValue instanceof Local) {
		if (baseValue.equals(source.getAccessPath().getPlainValue()))
			return true;
	}
	else if (baseValue instanceof InstanceFieldRef) {
		InstanceFieldRef ifr = (InstanceFieldRef) baseValue;
		if (ifr.getBase().equals(source.getAccessPath().getPlainValue())
				&& source.getAccessPath().firstFieldMatches(ifr.getField()))
			return true;
	}
	else if (baseValue instanceof StaticFieldRef) {
		StaticFieldRef sfr = (StaticFieldRef) baseValue;
		if (source.getAccessPath().firstFieldMatches(sfr.getField()))
			return true;
	}
	return false;
}
 

import soot.jimple.InstanceFieldRef; //导入依赖的package包/类
public void jimplify (DexBody body) {
      TwoRegisterInstruction i = (TwoRegisterInstruction)instruction;
      int dest = i.getRegisterA();
      int object = i.getRegisterB();
      FieldReference f = (FieldReference)((ReferenceInstruction)instruction).getReference();
      InstanceFieldRef r = Jimple.v().newInstanceFieldRef(body.getRegisterLocal(object),
                                                          getSootFieldRef(f));
      assign = Jimple.v().newAssignStmt(body.getRegisterLocal(dest), r);
      setUnit(assign);
      addTags(assign);
      body.add(assign);
      
if (IDalvikTyper.ENABLE_DVKTYPER) {
	Debug.printDbg(IDalvikTyper.DEBUG, "constraint: "+ assign);
        int op = (int)instruction.getOpcode().value;
        DalvikTyper.v().setType(assign.getLeftOpBox(), r.getType(), false);
      }
  }
 

import soot.jimple.InstanceFieldRef; //导入依赖的package包/类
public void jimplify (DexBody body) {
      TwoRegisterInstruction i = (TwoRegisterInstruction)instruction;
      int source = i.getRegisterA();
      int object = i.getRegisterB();
      FieldReference f = (FieldReference)((ReferenceInstruction)instruction).getReference();
      InstanceFieldRef instanceField = Jimple.v().newInstanceFieldRef(body.getRegisterLocal(object),
                           getSootFieldRef(f));
      Local sourceValue = body.getRegisterLocal(source);
      assign = getAssignStmt(body, sourceValue, instanceField);
      setUnit(assign);
      addTags(assign);
      body.add(assign);

if (IDalvikTyper.ENABLE_DVKTYPER) {
	Debug.printDbg(IDalvikTyper.DEBUG, "constraint: "+ assign);
        int op = (int)instruction.getOpcode().value;
        DalvikTyper.v().setType(assign.getRightOpBox(), instanceField.getType(), true);
      }
  }
 

import soot.jimple.InstanceFieldRef; //导入依赖的package包/类
private void checkAccessStmt(Stmt sootStmt, SootMethod currentMethod)
{
	if(sootStmt.containsFieldRef())
	{
		SootField accessField = sootStmt.getFieldRef().getField();
   		boolean isWrite = (((DefinitionStmt)sootStmt).getLeftOp() instanceof FieldRef);
   		boolean isStatic = (sootStmt.getFieldRef() instanceof StaticFieldRef);
   		Value object = isStatic ? NullConstant.v() : ((InstanceFieldRef)sootStmt.getFieldRef()).getBase();
   		
   		String methodSig = currentMethod.getSignature();
   		
   		List<Value> currentLocks = new ArrayList<Value>(lockStack);
   		
   		System.out.println(isWrite+" access on "+isStatic+" field "+accessField+" of "+object+" in "+methodSig+" with "+currentLocks.size()+" locks");
   		
   		if(!variableAccesses.containsKey(methodSig))
   		{
   			variableAccesses.put(methodSig, new HashSet<VariableAccess>());
   		}
   		variableAccesses.get(currentMethod.getSignature()).add(
   				new VariableAccess(accessField, sootStmt, currentMethod, isWrite, isStatic, currentLocks));
	}
}
 

import soot.jimple.InstanceFieldRef; //导入依赖的package包/类
/**
 * Determines if an instance field should be propagated through a method call. This method only
 * checks propagation rule for the field base. It does not check if the field points to an
 * argument, which should be done outside this method.
 * 
 * @param instanceFieldRef An instance field reference.
 * @param invokeExpr An invoke expression for the called method.
 * @return True if the field should be propagated.
 */
public static boolean shouldPropagateInstanceField(InstanceFieldRef instanceFieldRef,
    InvokeExpr invokeExpr) {
  Value fieldBase = instanceFieldRef.getBase();
  List<Value> argList = invokeExpr.getArgs();
  // A field reference should be propagated if the base of the field points to a method argument.
  for (int i = 0; i < argList.size(); ++i) {
    if (sourcePointsToArgument(fieldBase, argList.get(i))) {
      return true;
    }
  }

  // A field reference should be propagated if the base of the field points to the base of the
  // method call for an instance call.
  if (invokeExpr instanceof InstanceInvokeExpr) {
    Value invokeExprBase = ((InstanceInvokeExpr) invokeExpr).getBase();
    if (sourcePointsToArgument(fieldBase, invokeExprBase)) {
      return true;
    }
  }

  return false;
}
 

import soot.jimple.InstanceFieldRef; //导入依赖的package包/类
@Override
public void visitHeapInst(Unit u) {
	if (u instanceof JAssignStmt){
		JAssignStmt as = (JAssignStmt) u;
		
        if (SootUtilities.isFieldLoad(as)) {
            if(as.rightBox.getValue() instanceof InstanceFieldRef)
                if (!(((InstanceFieldRef)as.rightBox.getValue()).getBase() instanceof Local))
                    return;
        }
        if (SootUtilities.isFieldStore(as)) {
            if(as.rightBox.getValue() instanceof InstanceFieldRef)
        	    if (!(((InstanceFieldRef)as.leftBox.getValue()).getBase() instanceof Local))
                    return;
        }
	}
    
    add(u);
}
 

import soot.jimple.InstanceFieldRef; //导入依赖的package包/类
public DNF getErrSuf(Unit q) {
	if (!(q instanceof AssignStmt)) return null;
	AssignStmt s = (AssignStmt)q;
	soot.Value lhs = s.getLeftOp();
	soot.Value rhs = s.getRightOp();

	soot.Value rx;
	if (rhs instanceof ArrayRef)
		rx = ((ArrayRef)rhs).getBase();
	else if (rhs instanceof InstanceFieldRef)
		rx = ((InstanceFieldRef)rhs).getBase();
	else if (lhs instanceof ArrayRef)
		rx = ((ArrayRef)lhs).getBase();
	else if (lhs instanceof InstanceFieldRef)
		rx = ((InstanceFieldRef)lhs).getBase();
	else
		throw new RuntimeException("Wrong query + " + q);
	EscVVariable escv = null;
	if (rx instanceof Local) {
		int vidx = this.getDomVIdx((Local)rx);
		escv = new EscVVariable(vidx,domV);
	}
	return new DNF(new ClauseSizeCMP(), escv, Value.E());
}
 

import soot.jimple.InstanceFieldRef; //导入依赖的package包/类
/**
 * Gets the points-to-set for the given value
 * @param targetValue The value for which to get the points-to-set
 * @return The points-to-set for the given value
 */
private PointsToSet getPointsToSet(Value targetValue) {
	if (targetValue instanceof Local)
		return Scene.v().getPointsToAnalysis().reachingObjects((Local) targetValue);
	else if (targetValue instanceof InstanceFieldRef) {
		InstanceFieldRef iref = (InstanceFieldRef) targetValue;
		return Scene.v().getPointsToAnalysis().reachingObjects((Local) iref.getBase(), iref.getField());
	}
	else if (targetValue instanceof StaticFieldRef) {
		StaticFieldRef sref = (StaticFieldRef) targetValue;
		return Scene.v().getPointsToAnalysis().reachingObjects(sref.getField());
	}
	else if (targetValue instanceof ArrayRef) {
		ArrayRef aref = (ArrayRef) targetValue;
		return Scene.v().getPointsToAnalysis().reachingObjects((Local) aref.getBase());
	}
	else
		throw new RuntimeException("Unexpected value type for aliasing: " + targetValue.getClass());
}
 

import soot.jimple.InstanceFieldRef; //导入依赖的package包/类
@Override
public void computeAliasTaints(Abstraction d1, Stmt src, Value targetValue,
		Set<Abstraction> taintSet, SootMethod method, Abstraction newAbs) {
	// If we don't have an alias set for this method yet, we compute it
	if (!globalAliases.containsRow(method))
		computeGlobalAliases(method);
	
	// Use global aliasing
	Value baseValue = ((InstanceFieldRef) targetValue).getBase();
	Set<AccessPath> aliases = globalAliases.get(method, new AccessPath(
			baseValue));
	if (aliases != null)
		for (AccessPath ap : aliases) {
			Abstraction aliasAbs = newAbs.deriveNewAbstraction(
					ap.merge(newAbs.getAccessPath()), src);
			taintSet.add(aliasAbs);
		}
}
 

import soot.jimple.InstanceFieldRef; //导入依赖的package包/类
/** x = y.s; //y.s.f is an alias
 * x.f = tainted;
 * g = y.s; //call isAliasBase(y.s), return true
 * j = g.f; 
 * n = y; //n.s.f
 * sink(j);
 */
public boolean isWithinAccessPath(Value value){
	boolean result = false;
	if(value instanceof InstanceFieldRef){
		InstanceFieldRef ifr = (InstanceFieldRef) value;
		if(ifr.getBase().toString().equals(aliasBase.toString())){
			if(accessPath.size() > 0){
				SootFieldRef sfr = ifr.getFieldRef();
				if(accessPath.get(0).toString().equals(sfr.toString())){
					result = true;
				}
			}
		}
	}else{
		if(value.toString().equals(aliasBase.toString())){
			result = true;
		}
	}
	return result;
}
 

import soot.jimple.InstanceFieldRef; //导入依赖的package包/类
/**
 * 
 * @param value
 * @param currUnit
 * @return ==
 */
public Set<AliasValue> isAlias(Value value, Unit currUnit){
	Set<AliasValue> result = new HashSet<AliasValue>();
	if(value instanceof InstanceFieldRef){
		for(AliasValue av : aliasSet){
			TaintValue tv = av.getSource();
			int activationIndex = 0;
			if(tv == null){
				activationIndex = av.getActivationIndex();
			}else{
				activationIndex = allUnits.indexOf(tv.getActivation());
			}
			if(av.isMe((InstanceFieldRef)value) && activationIndex < allUnits.indexOf(currUnit)){
				result.add(av);
			}
		}
	}
	return result;
}
 

import soot.jimple.InstanceFieldRef; //导入依赖的package包/类
private void foundNewTaint(Unit currUnit, Value lv){
	if(spa.getPathSummary().alreadyInTaintsSet(currUnit, lv)){
		return;
	}
	if(lv instanceof StaticFieldRef){
		spa.getPathSummary().addStaticFieldRefTV((StaticFieldRef) lv);
	}
	//first add the left value to taints set
	TaintValue tv = new TaintValue(currUnit, lv);
	spa.getPathSummary().addTaintValue(tv);
	//then, whether the left value is a FieldRef (only instance field can have alias) TODO
	if(lv instanceof InstanceFieldRef){
		tv.setHeapAssignment(true);
		BackwardAnalysis ba = new BackwardAnalysis(currUnit, tv, spa);
		ba.startBackward();
	}
}