Java InstanceInvokeExpr类代码示例

import soot.jimple.InstanceInvokeExpr; //导入依赖的package包/类
@Override
public Collection<Pair<AccessGraph, EdgeFunction<TypestateDomainValue>>> generate(Unit unit,
    Collection<SootMethod> calledMethod) {
  boolean matches = false;
  for (SootMethod method : calledMethod) {
    if (initialTrans.matches(method)) {
      matches = true;
    }
  }
  if (!matches)
    return Collections.emptySet();
  if (unit instanceof Stmt && ((Stmt) unit).getInvokeExpr() instanceof InstanceInvokeExpr) {
    InstanceInvokeExpr iie = (InstanceInvokeExpr) ((Stmt) unit).getInvokeExpr();
    Set<Pair<AccessGraph, EdgeFunction<TypestateDomainValue>>> out = new HashSet<>();
    out.add(new Pair<AccessGraph, EdgeFunction<TypestateDomainValue>>(
        new AccessGraph((Local) iie.getBase(), iie.getBase().getType()),
        new TransitionFunction(initialTrans)));
    return out;
  }
  return Collections.emptySet();
}
 

import soot.jimple.InstanceInvokeExpr; //导入依赖的package包/类
protected Collection<Pair<AccessGraph, EdgeFunction<TypestateDomainValue>>> generateAtConstructor(Unit unit,
		Collection<SootMethod> calledMethod, MatcherTransition initialTrans) {
	boolean matches = false;
	for (SootMethod method : calledMethod) {
		if (initialTrans.matches(method)) {
			matches = true;
		}
	}
	if (!matches)
		return Collections.emptySet();
	if (unit instanceof Stmt) {
		Stmt stmt = (Stmt) unit;
		if (stmt.containsInvokeExpr())
			if (stmt.getInvokeExpr() instanceof InstanceInvokeExpr) {
				InstanceInvokeExpr iie = (InstanceInvokeExpr) stmt.getInvokeExpr();
				if (iie.getBase() instanceof Local) {
					Local l = (Local) iie.getBase();
					Set<Pair<AccessGraph, EdgeFunction<TypestateDomainValue>>> out = new HashSet<>();
					out.add(new Pair<AccessGraph, EdgeFunction<TypestateDomainValue>>(
							new AccessGraph(l, l.getType()), new TransitionFunction(initialTrans)));
					return out;
				}
			}
	}
	return Collections.emptySet();
}
 

import soot.jimple.InstanceInvokeExpr; //导入依赖的package包/类
protected Collection<Pair<AccessGraph, EdgeFunction<TypestateDomainValue>>> generateThisAtAnyCallSitesOf(Unit unit,
		Collection<SootMethod> calledMethod, Set<SootMethod> hasToCall, MatcherTransition initialTrans) {
	for (SootMethod callee : calledMethod) {
		if (hasToCall.contains(callee)) {
			if (unit instanceof Stmt) {
				if (((Stmt) unit).getInvokeExpr() instanceof InstanceInvokeExpr) {
					InstanceInvokeExpr iie = (InstanceInvokeExpr) ((Stmt) unit).getInvokeExpr();
					Local thisLocal = (Local) iie.getBase();
					Set<Pair<AccessGraph, EdgeFunction<TypestateDomainValue>>> out = new HashSet<>();
					out.add(new Pair<AccessGraph, EdgeFunction<TypestateDomainValue>>(
							new AccessGraph(thisLocal, thisLocal.getType()), new TransitionFunction(initialTrans)));
					return out;
				}
			}

		}
	}
	return Collections.emptySet();
}
 

import soot.jimple.InstanceInvokeExpr; //导入依赖的package包/类
static String formatInstanceInvoke(InstanceInvokeExpr v) {
	StringBuilder sb = new StringBuilder();
	sb.append(v.getBase().toString()).append(".<")
	.append(shorten(v.getBase().getType().toString()))
	.append(": ").append(shorten(v.getMethod().getReturnType().toString()))
	.append(' ').append(v.getMethod().getName()).append('(');
	for (int i = 0; i < v.getArgCount(); i++) {
		if (i != 0) {
			sb.append(", ");
		}
		sb.append(shorten(v.getArg(i).getType().toString()));
	}
	sb.append(")>(");
	for (int i = 0; i < v.getArgCount(); i++) {
		if (i != 0) {
			sb.append(", ");
		}
		sb.append(format(v.getArg(i)));
	}
	sb.append(')');
	return sb.toString();
}
 

import soot.jimple.InstanceInvokeExpr; //导入依赖的package包/类
private Set<FlowAbstraction> taintApiDefault(Unit call, FlowAbstraction source, Stmt stmt,
		Set<FlowAbstraction> outSet) {
	final List<Value> args = stmt.getInvokeExpr().getArgs();
	final Local baseLocal = stmt.getInvokeExpr() instanceof InstanceInvokeExpr
			? (Local) ((InstanceInvokeExpr) stmt.getInvokeExpr()).getBase() : null;
	Local receiver = null;
	if (stmt instanceof AssignStmt)
		receiver = (Local) ((AssignStmt) stmt).getLeftOp();

	Set<FlowAbstraction> ret = new HashSet<FlowAbstraction>();

	// If a parameter is tainted, we taint the base local and the receiver
	if (source.getLocal() != null && args.contains(source.getLocal())) {
		if (baseLocal != null && !baseLocal.toString().equals("this"))
			ret.add(FlowAbstraction.v(source.getSource(), baseLocal, call, icfg.getMethodOf(call), source));
		if (receiver != null)
			ret.add(FlowAbstraction.v(source.getSource(), receiver, call, icfg.getMethodOf(call), source));
	}

	// If the base local is tainted, we taint the receiver
	if (baseLocal != null && source.getLocal() == baseLocal && receiver != null)
		ret.add(FlowAbstraction.v(source.getSource(), receiver, call, icfg.getMethodOf(call), source));

	return ret;
}
 

import soot.jimple.InstanceInvokeExpr; //导入依赖的package包/类
@Override
public boolean isExclusiveInternal(Stmt stmt, AccessPath taintedPath) {
	SootMethod method = stmt.getInvokeExpr().getMethod();
	
	// Do we have an entry for at least one entry in the given class?
	if (hasWrappedMethodsForClass(method.getDeclaringClass(), true, true, true))
		return true;

	// In aggressive mode, we always taint the return value if the base
	// object is tainted.
	if (aggressiveMode && stmt.getInvokeExpr() instanceof InstanceInvokeExpr) {
		InstanceInvokeExpr iiExpr = (InstanceInvokeExpr) stmt.getInvokeExpr();			
		if (iiExpr.getBase().equals(taintedPath.getPlainValue()))
			return true;
	}
	
	final MethodWrapType wrapType = methodWrapCache.getUnchecked(method);
	return wrapType != MethodWrapType.NotRegistered;
}
 

import soot.jimple.InstanceInvokeExpr; //导入依赖的package包/类
@Override
public boolean supportsCallee(Stmt callSite) {
	// We need an invocation expression
	if (!callSite.containsInvokeExpr())
		return false;

	SootMethod method = callSite.getInvokeExpr().getMethod();
	if (!supportsCallee(method))
		return false;
			
	// We need a method that can create a taint
	if (!aggressiveMode) {
		// Check for a cached wrap type
		final MethodWrapType wrapType = methodWrapCache.getUnchecked(method);
		if (wrapType != MethodWrapType.CreateTaint)
			return false;
	}
	
	// We need at least one non-constant argument or a tainted base
	if (callSite.getInvokeExpr() instanceof InstanceInvokeExpr)
		return true;
	for (Value val : callSite.getInvokeExpr().getArgs())
		if (!(val instanceof Constant))
			return true;
	return false;
}
 

import soot.jimple.InstanceInvokeExpr; //导入依赖的package包/类
boolean handleSpecialCall(InstanceInvokeExpr expr, SootMethod target) {
	String mn = target.getName();
	int np = target.getParameterCount();
	SootClass dc = target.getDeclaringClass();
	
	// Is it a method in a Foo object?
	if (isFoo(dc)) {
		if (mn.equals("foo") && np == 1){
			Variable lvar = new Variable(Variable.Type.FOO);			
			Method foo = new Method("foo", new Variable[0]);
			FooMethodCall fmc = new FooMethodCall(foo);
			fmc.setAssignmentTarget(lvar);
			st.addStatement(fmc);
			return true;
		}
		// Unknown Foo method
		return false;
	}
	// Not a special call
	return false;
}
 

import soot.jimple.InstanceInvokeExpr; //导入依赖的package包/类
/**
 * Obtain the set of possible call targets at given @param callsite.
 */
private void getCallTargets(IVarAbstraction pn, SootMethod src,
		Stmt callsite, ChunkedQueue<SootMethod> targetsQueue)
{
	InstanceInvokeExpr iie = (InstanceInvokeExpr)callsite.getInvokeExpr();
	Local receiver = (Local)iie.getBase();
	NumberedString subSig = iie.getMethodRef().getSubSignature();
	
	// We first build the set of possible call targets
	for (AllocNode an : pn.get_all_points_to_objects()) {
		Type type = an.getType();
		if (type == null) continue;

		VirtualCalls.v().resolve(type, 
				receiver.getType(), subSig, src,
				targetsQueue);
	}
}
 

import soot.jimple.InstanceInvokeExpr; //导入依赖的package包/类
/**
 * Determines if an instance field should be propagated through a method call. This method only
 * checks propagation rule for the field base. It does not check if the field points to an
 * argument, which should be done outside this method.
 * 
 * @param instanceFieldRef An instance field reference.
 * @param invokeExpr An invoke expression for the called method.
 * @return True if the field should be propagated.
 */
public static boolean shouldPropagateInstanceField(InstanceFieldRef instanceFieldRef,
    InvokeExpr invokeExpr) {
  Value fieldBase = instanceFieldRef.getBase();
  List<Value> argList = invokeExpr.getArgs();
  // A field reference should be propagated if the base of the field points to a method argument.
  for (int i = 0; i < argList.size(); ++i) {
    if (sourcePointsToArgument(fieldBase, argList.get(i))) {
      return true;
    }
  }

  // A field reference should be propagated if the base of the field points to the base of the
  // method call for an instance call.
  if (invokeExpr instanceof InstanceInvokeExpr) {
    Value invokeExprBase = ((InstanceInvokeExpr) invokeExpr).getBase();
    if (sourcePointsToArgument(fieldBase, invokeExprBase)) {
      return true;
    }
  }

  return false;
}
 

import soot.jimple.InstanceInvokeExpr; //导入依赖的package包/类
/**
 * Registers default method return value analyses.
 */
public void registerDefaultMethodReturnValueAnalyses() {
  registerMethodReturnValueAnalysis("java.lang.String getName()",
      new MethodReturnValueAnalysis() {

        @Override
        public Set<Object> computeMethodReturnValues(Call call) {
          InvokeExpr invokeExpr = call.stmt.getInvokeExpr();

          if (invokeExpr instanceof InstanceInvokeExpr) {
            InstanceInvokeExpr instanceInvokeExpr = (InstanceInvokeExpr) invokeExpr;
            if (invokeExpr.getMethod().getDeclaringClass().getName().equals("java.lang.Class")) {
              return ArgumentValueManager.v()
                  .getArgumentValueAnalysis(Constants.DefaultArgumentTypes.Scalar.CLASS)
                  .computeVariableValues(instanceInvokeExpr.getBase(), call.stmt);
            }
          }

          return null;
        }
      });
}
 

import soot.jimple.InstanceInvokeExpr; //导入依赖的package包/类
@Override
public Set<AccessPath> getTaintsForMethod(Stmt stmt, AccessPath taintedPath) {
	// method add + added element is tainted -> whole list is tainted
	if(stmt.getInvokeExpr().getMethod().getSubSignature().equals("boolean add(java.lang.Object)"))
		if (taintedPath.getPlainValue().equals(stmt.getInvokeExpr().getArg(0)))
			return Collections.singleton(new AccessPath(((InstanceInvokeExpr) stmt.getInvokeExprBox().getValue()).getBase()));

	// method get + whole list is tainted -> returned element is tainted
	if(stmt.getInvokeExpr().getMethod().getSubSignature().equals("java.lang.Object get(int)"))
		if (stmt.getInvokeExpr() instanceof InstanceInvokeExpr) {
			InstanceInvokeExpr iiExpr = (InstanceInvokeExpr) stmt.getInvokeExpr();
			if (taintedPath.getPlainValue().equals(iiExpr.getBase()))
				if(stmt instanceof JAssignStmt)
					return Collections.singleton(new AccessPath(((JAssignStmt)stmt).getLeftOp()));
		}

	// For the moment, we don't implement static taints on wrappers. Pass it on
	// not to break anything
	if(taintedPath.isStaticFieldRef())
		return Collections.singleton(taintedPath);

	return Collections.emptySet();
}
 

import soot.jimple.InstanceInvokeExpr; //导入依赖的package包/类
/**
 * Gives the type of all the broadcast receiver that may be aborted. It looks at all the calls to abortBroadcast and through the Points-to analysis at the
 * actual class of the base arguments of the calls.
 * @return a set of soot type that may be empty.
 */
private Set<String> abortedBroadcastsTypes() {
    Set <String> result = new HashSet<String>();
    try {
        SootClass receiverClass = scene.getSootClass(ANDROID_CONTENT_BROADCASTRECEIVER);
        SootMethod abortMethod = receiverClass.getMethod(BROADCAST_ABORT_SIGNATURE);
        Iterator<Edge> edges = cg.edgesInto(abortMethod);
        while(edges.hasNext()) {
            Edge edge = edges.next();
            InvokeExpr ie = edge.srcStmt().getInvokeExpr();
            if (ie == null || ! (ie instanceof InstanceInvokeExpr)) continue;
            Value base = ((InstanceInvokeExpr) ie).getBase();
            if (!(base instanceof Local)) continue;
            PointsToSet basePTS = pag.reachingObjects((Local) base);
            addAll(result,basePTS.possibleTypes());
        }
    } catch (RuntimeException e) {
        Out.getLog().println("Error while computing aborted broadcast " + e.getMessage());         
    }
    return result;
}
 

import soot.jimple.InstanceInvokeExpr; //导入依赖的package包/类
@Override
public KillGenInfo processBackwardCallToReturn(Trackable taint, Stmt callSite, InvokeExpr ie) {
	SootMethod method = ie.getMethod();
	List<Taint> taints = Lists.newLinkedList();
	if (ie instanceof InstanceInvokeExpr) {
		Value receiver = ((InstanceInvokeExpr) ie).getBase();
		taints.add(new Taint(callSite, taint, receiver, receiver.getType()));
	}

	for (int i = 0; i < method.getParameterCount(); i++) {
		Type parameterType = method.getParameterType(i);
		if (!(parameterType instanceof PrimType) && !(ie.getArg(i) instanceof Constant)) {
			taints.add(new Taint(callSite, taint, ie.getArg(i), parameterType));
		}
	}

	if (taints.isEmpty())
		return kill();
	else
		return propagate(taints.toArray(new Taint[taints.size()]));
}
 

import soot.jimple.InstanceInvokeExpr; //导入依赖的package包/类
@Override
public Map<Local, SignAnalysis.Sign> callEntryFlowFunction(
		Context<SootMethod, Unit, Map<Local, SignAnalysis.Sign>> context, SootMethod calledMethod, Unit unit,
		Map<Local, SignAnalysis.Sign> inValue) {
	// Initialise result to empty map
	Map<Local, SignAnalysis.Sign> entryValue = topValue();
	// Map arguments to parameters
	InvokeExpr ie = ((Stmt) unit).getInvokeExpr();
	for (int i = 0; i < ie.getArgCount(); i++) {
		Value arg = ie.getArg(i);
		Local param = calledMethod.getActiveBody().getParameterLocal(i);
		assign(param, arg, inValue, entryValue);
	}
	// And instance of the this local
	if (ie instanceof InstanceInvokeExpr) {
		Value instance = ((InstanceInvokeExpr) ie).getBase();
		Local thisLocal = calledMethod.getActiveBody().getThisLocal();
		assign(thisLocal, instance, inValue, entryValue);
	}
	// Return the entry value at the called method
	return entryValue;
}