Java SpecialInvokeExpr类代码示例

import soot.jimple.SpecialInvokeExpr; //导入依赖的package包/类
@Override
public void caseSpecialInvokeExpr(SpecialInvokeExpr v) {
	//is the invokeExpr a source method?
	if(isSourceMethod(v)) {
		StringConstant newSourceValue = StringConstant.v("loggingPoint");
		SMTBinding binding = stmtVisitor.createNewBindingForValue(newSourceValue);
		stmtVisitor.addValueBindingToVariableDeclaration(newSourceValue, binding);				
		//no smt-statement required, just return the binding
		this.result = binding;
		
		// Additionally check whether the source method need special treatment
		if(isExpressionThatNeedsToBeConvertedToSMT(v)) {
			convertSpecialExpressionsToSMT(v, currentStatement);
		}
		
	} else {
		if(isStringOperationSupportedBySMT(v))
			convertStringOperationToSMT(v, v.getBase());
		else if(isExpressionThatNeedsToBeConvertedToSMT(v))
			convertSpecialExpressionsToSMT(v, currentStatement);
		else
			convertAPIMethodToSMT(v);
	}
}
 

import soot.jimple.SpecialInvokeExpr; //导入依赖的package包/类
private boolean isCallToSuper(SpecialInvokeExpr sie) {
	SootClass classWithInvokation = sie.getMethod().getDeclaringClass();
	SootClass currentClass = stmtV.getBelongingClass();
	while (currentClass.hasSuperclass()) {
		currentClass = currentClass.getSuperclass();
		if (currentClass.equals(classWithInvokation)) {
			return true;
		}
	}
	
	// If we're dealing with phantom classes, we might not actually
	// arrive at java.lang.Object. In this case, we should not fail
	// the check
	if (currentClass.isPhantom() && !currentClass.getName().equals("java.lang.Object"))
		return true;
	
	return false; // we arrived at java.lang.Object and did not find a declaration
}
 

import soot.jimple.SpecialInvokeExpr; //导入依赖的package包/类
/** Returns the target for the given SpecialInvokeExpr. */
public SootMethod resolveSpecialDispatch(SpecialInvokeExpr ie, SootMethod container)
{
    container.getDeclaringClass().checkLevel(SootClass.HIERARCHY);
    SootMethod target = ie.getMethod();
    target.getDeclaringClass().checkLevel(SootClass.HIERARCHY);

    /* This is a bizarre condition!  Hopefully the implementation is correct.
       See VM Spec, 2nd Edition, Chapter 6, in the definition of invokespecial. */
    if ("<init>".equals(target.getName()) || target.isPrivate())
        return target;
    else if (isClassSubclassOf(target.getDeclaringClass(), container.getDeclaringClass()))
        return resolveConcreteDispatch(container.getDeclaringClass(), target);
    else
        return target;
}
 

import soot.jimple.SpecialInvokeExpr; //导入依赖的package包/类
public void fill() {
    DomI domI = (DomI) doms[0];
    DomM domM = (DomM) doms[1];
    int numI = domI.size();
    for (int iIdx = 0; iIdx < numI; iIdx++) {
        Unit i = (Unit) domI.get(iIdx);
        if(SootUtilities.isInvoke(i)){
        	InvokeExpr ie = SootUtilities.getInvokeExpr(i);
        	if(ie instanceof SpecialInvokeExpr){
        		SootMethod m = ie.getMethod();
    			m = StubRewrite.maybeReplaceCallDest(SootUtilities.getMethod(i), m);
                int mIdx = domM.indexOf(m);
                if (mIdx >= 0)
                    add(iIdx, mIdx);
                else if (Config.verbose >= 2)
                    Messages.log(NOT_FOUND, m, SootUtilities.toLocStr(i));
        	}
        }
    }
}
 

import soot.jimple.SpecialInvokeExpr; //导入依赖的package包/类
@Override
public void caseSpecialInvokeExpr(SpecialInvokeExpr v) {
	logger.fine("Invoke expression is of type SpecialInvoke");
	logger.finest(v.toString());
	rightElement = RightElement.NOT;

	if (actualContext == StmtContext.INVOKE 
			|| actualContext == StmtContext.ASSIGNRIGHT ) {
		Local[] args = vh.getArgumentsForInvokedMethod(v);
		String method = v.getMethod().toString();

		if (ExternalClasses.methodMap.containsKey(method)) {
			logger.fine("Found an external class " + method);
			logger.fine("This class is treated in a special way");
			ExternalClasses.receiveCommand(method, callingStmt, args);
		} else {
			logger.fine("Found an external class " + method);
			logger.fine("This class is treated as an internal class");
			JimpleInjector.storeArgumentLevels(callingStmt, args);
		}
	} else {
		throw new InternalAnalyzerException(
				"Unexpected Context for Invoke Expression");
	}
}
 

import soot.jimple.SpecialInvokeExpr; //导入依赖的package包/类
public void caseSpecialInvokeExpr(SpecialInvokeExpr expr) {
	// Constructor calls, maybe
	Variable bvar = st.getLocalVariable((Local)expr.getBase());
	SootMethod m = expr.getMethod();
	if (m.getName().equals("<init>")) {
		SootClass dc = m.getDeclaringClass();
		if (isFoo(dc)) {
			FooInit fi = new FooInit();
			fi.setAssignmentTarget(bvar);
			st.addStatement(fi);
			return;
		}
	}
	handleCall(expr, expr.getMethod());
}
 

import soot.jimple.SpecialInvokeExpr; //导入依赖的package包/类
private InvokeStmt getFirstSpecialInvoke(Body b){
    for (Unit u : b.getUnits()) {
        Stmt s = (Stmt)u;
        if (!(s instanceof InvokeStmt)) continue;

        InvokeExpr invokeExpr = ((InvokeStmt)s).getInvokeExpr();
        if (!(invokeExpr instanceof SpecialInvokeExpr)) continue;

        return (InvokeStmt)s;        
    }
    // but there will always be either a call to this() or to super()
    // from the constructor
    return null;
}
 

import soot.jimple.SpecialInvokeExpr; //导入依赖的package包/类
@Override
public Set<SootMethod> load(Unit u) throws Exception {
	Stmt stmt = (Stmt)u;
	InvokeExpr ie = stmt.getInvokeExpr();
	FastHierarchy fastHierarchy = Scene.v().getFastHierarchy();
	//FIXME Handle Thread.start etc.
	if(ie instanceof InstanceInvokeExpr) {
		if(ie instanceof SpecialInvokeExpr) {
			//special
			return Collections.singleton(ie.getMethod());
		} else {
			//virtual and interface
			InstanceInvokeExpr iie = (InstanceInvokeExpr) ie;
			Local base = (Local) iie.getBase();
			RefType concreteType = bodyToLMNAA.getUnchecked(unitToOwner.get(u)).concreteType(base, stmt);
			if(concreteType!=null) {
				//the base variable definitely points to a single concrete type 
				SootMethod singleTargetMethod = fastHierarchy.resolveConcreteDispatch(concreteType.getSootClass(), iie.getMethod());
				return Collections.singleton(singleTargetMethod);
			} else {
				SootClass baseTypeClass;
				if(base.getType() instanceof RefType) {
					RefType refType = (RefType) base.getType();
					baseTypeClass = refType.getSootClass();
				} else if(base.getType() instanceof ArrayType) {
					baseTypeClass = Scene.v().getSootClass("java.lang.Object");
				} else if(base.getType() instanceof NullType) {
					//if the base is definitely null then there is no call target
					return Collections.emptySet();
				} else {
					throw new InternalError("Unexpected base type:"+base.getType());
				}
				return fastHierarchy.resolveAbstractDispatch(baseTypeClass, iie.getMethod());
			}
		}
	} else {
		//static
		return Collections.singleton(ie.getMethod());
	}
}
 

import soot.jimple.SpecialInvokeExpr; //导入依赖的package包/类
@Override
public void caseSpecialInvokeExpr(SpecialInvokeExpr sie) {
	BuilderMethodReference method = DexPrinter.toMethodReference
			(sie.getMethodRef(), dexFile);
	List<Register> arguments = getInstanceInvokeArgumentRegs(sie);
	if (isCallToConstructor(sie) || isCallToPrivate(sie)) {
           stmtV.addInsn(buildInvokeInsn("INVOKE_DIRECT", method, arguments), origStmt);
	} else if (isCallToSuper(sie)) {
           stmtV.addInsn(buildInvokeInsn("INVOKE_SUPER", method, arguments), origStmt);
	} else {
		// This should normally never happen, but if we have such a
		// broken call (happens in malware for instance), we fix it.
           stmtV.addInsn(buildInvokeInsn("INVOKE_VIRTUAL", method, arguments), origStmt);
	}
}
 

import soot.jimple.SpecialInvokeExpr; //导入依赖的package包/类
/** Returns the target for the given SpecialInvokeExpr. */
public SootMethod resolveSpecialDispatch(SpecialInvokeExpr ie, SootMethod container)
{
    SootMethod target = ie.getMethod();

    /* This is a bizarre condition!  Hopefully the implementation is correct.
       See VM Spec, 2nd Edition, Chapter 6, in the definition of invokespecial. */
    if (target.getName().equals("<init>") || target.isPrivate())
        return target;
    else if (isSubclass(target.getDeclaringClass(), container.getDeclaringClass()))
        return resolveConcreteDispatch(container.getDeclaringClass(), target );
    else
        return target;
}
 

import soot.jimple.SpecialInvokeExpr; //导入依赖的package包/类
/** This method change all new Obj/<init>(args) pairs to new Obj(args) idioms. */
protected void internalTransform(Body b, String phaseName, Map options)
{
    GrimpBody body = (GrimpBody)b;

    if(Options.v().verbose())
        G.v().out.println("[" + body.getMethod().getName() +
            "] Folding constructors...");

  Chain units = body.getUnits();
  List<Unit> stmtList = new ArrayList<Unit>();
  stmtList.addAll(units);

  Iterator<Unit> it = stmtList.iterator();
  
  LocalUses localUses = LocalUses.Factory.newLocalUses(b);

  /* fold in NewExpr's with specialinvoke's */
  while (it.hasNext())
    {
      Stmt s = (Stmt)it.next();
        
      if (!(s instanceof AssignStmt))
        continue;
        
      /* this should be generalized to ArrayRefs */
      Value lhs = ((AssignStmt)s).getLeftOp();
      if (!(lhs instanceof Local))
        continue;
        
      Value rhs = ((AssignStmt)s).getRightOp();
      if (!(rhs instanceof NewExpr))
        continue;

      /* TO BE IMPLEMENTED LATER: move any copy of the object reference
         for lhs down beyond the NewInvokeExpr, with the rationale
         being that you can't modify the object before the constructor
         call in any case.

         Also, do note that any new's (object creation) without
         corresponding constructors must be dead. */
       
      List lu = localUses.getUsesOf(s);
      Iterator luIter = lu.iterator();
      boolean MadeNewInvokeExpr = false;
       
      while (luIter.hasNext())
        {
          Unit use = ((UnitValueBoxPair)(luIter.next())).unit;
          if (!(use instanceof InvokeStmt))
            continue;
          InvokeStmt is = (InvokeStmt)use;
          if (!(is.getInvokeExpr() instanceof SpecialInvokeExpr) ||
              lhs != ((SpecialInvokeExpr)is.getInvokeExpr()).getBase())
            continue;
          
          SpecialInvokeExpr oldInvoke = 
            ((SpecialInvokeExpr)is.getInvokeExpr());
          LinkedList invokeArgs = new LinkedList();
          for (int i = 0; i < oldInvoke.getArgCount(); i++)
            invokeArgs.add(oldInvoke.getArg(i));
          
          AssignStmt constructStmt = Grimp.v().newAssignStmt
            ((AssignStmt)s);
          constructStmt.setRightOp
            (Grimp.v().newNewInvokeExpr
             (((NewExpr)rhs).getBaseType(), oldInvoke.getMethodRef(), invokeArgs));
          MadeNewInvokeExpr = true;
          
          use.redirectJumpsToThisTo(constructStmt);
          units.insertBefore(constructStmt, use);
          units.remove(use);
        }
      if (MadeNewInvokeExpr)
        {
          units.remove(s);
        }
    }
}
 

import soot.jimple.SpecialInvokeExpr; //导入依赖的package包/类
@Override
protected void transform(ValueBox invocationBox, SpecialInvokeExpr invocation,
                         CompositeExpressionTransformer transforms) {
    // StringBuilder.<init>(...) -> new AugmentedStringBuilder.<init>(...)
    SootMethodRef newMethodRef = soot.Scene.v()
            .getSootClass(getReplacementClass().getName())
            .getMethod("<init>", invocation.getArgs().stream().map(Value::getType).collect(Collectors.toList()))
            .makeRef();
    invocation.setMethodRef(newMethodRef);

    // Add a one-time transform to handle instantiation, which is assumed to immediately follow this statement
    transforms.add(new OneTimeTransform(new InstantiationTransformer(getTargetClass(), getReplacementClass())));
}
 

import soot.jimple.SpecialInvokeExpr; //导入依赖的package包/类
private static void initializePeP(SootClass sc){
		SootMethod onCreate = null;
		log.info("add Pep initialization in class "+ sc);
		for(SootMethod sm : sc.getMethods()){
			if(sm.getName().equals("onCreate") && 
					sm.getParameterCount() == 1 && 
					sm.getParameterType(0).toString().equals("android.os.Bundle")){
				onCreate = sm;
			}
		}
	
		if(onCreate != null){
			List<Unit> generated = new ArrayList<Unit>();
			Body body = onCreate.retrieveActiveBody();
			
			Local thisLocal = body.getThisLocal();
			SootClass context = Scene.v().forceResolve("android.content.Context", SootClass.BODIES);
//				SootMethod applicationContext =sc.getMethod("android.content.Context getApplicationContext()");
			SootMethod applicationContext = context.getMethod("android.content.Context getApplicationContext()");
			SpecialInvokeExpr virtInvExpr = Jimple.v().newSpecialInvokeExpr(thisLocal, applicationContext.makeRef());
			
			Local applicationContextLocal = generateFreshLocal(body, RefType.v("android.content.Context"));
			generated.add(Jimple.v().newAssignStmt(applicationContextLocal, virtInvExpr));
			
			List<Object> args = new ArrayList<Object>();
			args.add(RefType.v("android.content.Context"));
			args.add(applicationContextLocal);
			
			StaticInvokeExpr staticInvExpr = Instrumentation.createJimpleStaticInvokeExpr(Settings.instance.INSTRUMENTATION_HELPER_JAVA, Settings.instance.INSTRUMENTATION_HELPER_INITIALIZE_METHOD, args);
			generated.add(Jimple.v().newInvokeStmt(staticInvExpr));
			
			Unit onCreateSpecialInvoke = getSuperOnCreateUnit(body);
			if(onCreateSpecialInvoke == null)
				throw new RuntimeException("error: super.onCreate() statement missing in method "+ onCreate);
			
			body.getUnits().insertAfter(generated, onCreateSpecialInvoke);
		}
		
		
	}
 

import soot.jimple.SpecialInvokeExpr; //导入依赖的package包/类
@Override
public Set<SootMethod> load(Unit u) throws Exception {
	Stmt stmt = (Stmt) u;
	InvokeExpr ie = stmt.getInvokeExpr();
	FastHierarchy fastHierarchy = Scene.v().getFastHierarchy();
	// FIXME Handle Thread.start etc.
	if (ie instanceof InstanceInvokeExpr) {
		if (ie instanceof SpecialInvokeExpr) {
			// special
			return Collections.singleton(ie.getMethod());
		} else {
			// virtual and interface
			InstanceInvokeExpr iie = (InstanceInvokeExpr) ie;
			Local base = (Local) iie.getBase();
			RefType concreteType = bodyToLMNAA.getUnchecked(unitToOwner.get(u)).concreteType(base,
					stmt);
			if (concreteType != null) {
				// the base variable definitely points to a
				// single concrete type
				SootMethod singleTargetMethod = fastHierarchy
						.resolveConcreteDispatch(concreteType.getSootClass(), iie.getMethod());
				return Collections.singleton(singleTargetMethod);
			} else {
				SootClass baseTypeClass;
				if (base.getType() instanceof RefType) {
					RefType refType = (RefType) base.getType();
					baseTypeClass = refType.getSootClass();
				} else if (base.getType() instanceof ArrayType) {
					baseTypeClass = Scene.v().getSootClass("java.lang.Object");
				} else if (base.getType() instanceof NullType) {
					// if the base is definitely null then there
					// is no call target
					return Collections.emptySet();
				} else {
					throw new InternalError("Unexpected base type:" + base.getType());
				}
				return fastHierarchy.resolveAbstractDispatch(baseTypeClass, iie.getMethod());
			}
		}
	} else {
		// static
		return Collections.singleton(ie.getMethod());
	}
}
 

import soot.jimple.SpecialInvokeExpr; //导入依赖的package包/类
public void caseSpecialInvokeExpr(SpecialInvokeExpr v) {
	printInvokeExpr(v);		
}