Java ExceptionalUnitGraph类代码示例

import soot.toolkits.graph.ExceptionalUnitGraph; //导入依赖的package包/类
/**
 * This method generates the CFG of a method. It recursively iterates over the units and its successors
 * and creates a graph structure with nodes as units and control-flow between units as edges.
 * @param method
 * @return ControlFlowGraph
 */
public ControlFlowGraph generateControlFlowGraph(VFMethod method) {
	this.method = method;
	Body b = method.getBody();
	nodeNumber=0;
	edgeNumber=0;
	listNodes = new ArrayList<>();
	listEdges = new ArrayList<>();
	ControlFlowGraph g = new ControlFlowGraph();
	Unit head = null;
	eg = new ExceptionalUnitGraph(b);
	List<Unit> list = eg.getHeads();
	Iterator<Unit> it1 = list.iterator();
	while (it1.hasNext()) {
		head = it1.next();
		nodeNumber++;
		VFNode node = new VFNode(getVFUnit(head), nodeNumber);
		listNodes.add(node);
		break;
	}
	traverseUnits(head);
	g.listEdges = listEdges;
	g.listNodes = listNodes;
	return g;
}
 

import soot.toolkits.graph.ExceptionalUnitGraph; //导入依赖的package包/类
protected void internalTransform(
        Body b, String phaseName, Map opts)
{

   
    MHGDominatorsFinder analysis = new MHGDominatorsFinder(new ExceptionalUnitGraph(b));
    Iterator it = b.getUnits().iterator();
    while (it.hasNext()){
        Stmt s = (Stmt)it.next();
        List dominators = analysis.getDominators(s);
        Iterator dIt = dominators.iterator();
        while (dIt.hasNext()){
            Stmt ds = (Stmt)dIt.next();
            String info = ds+" dominates "+s;
            s.addTag(new LinkTag(info, ds, b.getMethod().getDeclaringClass().getName(), "Dominators"));
        }
    }
}
 

import soot.toolkits.graph.ExceptionalUnitGraph; //导入依赖的package包/类
protected void internalTransform(Body b, String phaseName, Map<String, String> options) {
	if (!b.getMethod().isSynchronized() || b.getMethod().isStatic())
		return;
	
	Iterator<Unit> it = b.getUnits().snapshotIterator();
	while (it.hasNext()) {
		Unit u = it.next();
		if (u instanceof IdentityStmt)
			continue;
		
		// This the first real statement. If it is not a MonitorEnter
		// instruction, we generate one
		if (!(u instanceof EnterMonitorStmt)) {
			b.getUnits().insertBeforeNoRedirect(Jimple.v().newEnterMonitorStmt(b.getThisLocal()), u);
			
			// We also need to leave the monitor when the method terminates
			UnitGraph graph = new ExceptionalUnitGraph(b);
			for (Unit tail : graph.getTails())
    			b.getUnits().insertBefore(Jimple.v().newExitMonitorStmt(b.getThisLocal()), tail);
		}
		break;
	}
}
 

import soot.toolkits.graph.ExceptionalUnitGraph; //导入依赖的package包/类
@Override
protected void internalTransform(Body b, String phaseName, Map options) {
	String methodName = b.getMethod().getName();
	if(b.getMethod().getDeclaringClass().getMethods().get(methodId).equals(b.getMethod())){
	//System.out.println("method " + methodName);
	//if method's does not have a single local int variable
	//the skip it
	boolean hasIntLocals = false;
	for(Local l : b.getLocals()){
		if(ValueAnalysis.isAnyIntType(l)){
			hasIntLocals = true;
			break;//at least one local var is an int
		}
	}
	if(!methodName.equals("<clinit>") && hasIntLocals){
		//System.out.println(b.getMethod().getDeclaringClass() + "\t" + b.getMethod().getDeclaringClass().getMethods().indexOf(b.getMethod()) + "\t" + b.getMethod());
		System.out.println("analyzing " + b.getMethod().getSignature());
		System.gc();
		ValueAnalysis va = new ValueAnalysis(new ExceptionalUnitGraph(b), domains, symbolicOn);
	}

}
}
 

import soot.toolkits.graph.ExceptionalUnitGraph; //导入依赖的package包/类
@Override
protected void analyse(SootClass clazz, SootMethod method, Body body) {
	if (!clazz.implementsInterface(Types.X509_TRUST_MANAGER.getClassName()))
		return;

	if (!Signatures.methodSignatureMatches(method, VoidType.v(), "checkServerTrusted", Types.X509_CERTIFICATE_ARRAY, Types.STRING))
		return;

	VulnerabilityState state = VulnerabilityState.UNKNOWN;

	UnitGraph graph = new ExceptionalUnitGraph(body);
	if (!FlowGraphUtils.anyExitThrowsException(graph, Types.CERTIFICATE_EXCEPTION)) {
		state = VulnerabilityState.VULNERABLE;
	}

	clazz.addTag(new TrustManagerTag(state));
	vulnerabilities.add(new Vulnerability(clazz, VulnerabilityType.PERMISSIVE_TRUST_MANAGER, state));
}
 

import soot.toolkits.graph.ExceptionalUnitGraph; //导入依赖的package包/类
@Override
protected void analyse(SootClass clazz, SootMethod method, Body body) {
	if (!clazz.getSuperclass().getType().equals(Types.ABSTRACT_VERIFIER))
		return;

	if (!Signatures.methodSignatureMatches(method, VoidType.v(), "verify", Types.STRING, Types.STRING_ARRAY, Types.STRING_ARRAY))
		return;

	VulnerabilityState state = VulnerabilityState.UNKNOWN;

	UnitGraph graph = new ExceptionalUnitGraph(body);
	if (!FlowGraphUtils.anyExitThrowsException(graph, Types.SSL_EXCEPTION)) {
		state = VulnerabilityState.VULNERABLE;
	}

	clazz.addTag(new HostnameVerifierTag(state));
	vulnerabilities.add(new Vulnerability(clazz, VulnerabilityType.PERMISSIVE_HOSTNAME_VERIFIER, state));
}
 

import soot.toolkits.graph.ExceptionalUnitGraph; //导入依赖的package包/类
/**
 * Returns a list of Map from service names to concrete Soot classes.
 * 
 * @param sm
 * @return
 */
public static Map<Unit, String> getGetUnitStringMap(SootMethod sm, String methodStringObjSig) {
    Map<Unit, String> map = new HashMap<Unit, String>();

    if (!sm.isConcrete()) {
        throw new RuntimeException("error: not concrete method " + sm);
    }

    Body b = null;
    try {
        b = sm.retrieveActiveBody();
    } catch (Exception e) {
        throw new RuntimeException("error: no active body for method " + sm);
    }

    ExceptionalUnitGraph eug = new ExceptionalUnitGraph(b);
    final SmartLocalDefs localDefs = new SmartLocalDefs(eug, new SimpleLiveLocals(eug));
    for (Unit u : b.getUnits()) {
        Stmt s = (Stmt) u;

        if (!s.containsInvokeExpr()) {
            continue;
        }
        InvokeExpr ie = s.getInvokeExpr();
        SootMethodRef smr = ie.getMethodRef();
        String sig = smr.getSignature();

        if (!sig.endsWith(methodStringObjSig)) {
            continue;
        }

        String name = getStringName(b, u, 0);
        map.put(u, name);

    }

    return map;
}
 

import soot.toolkits.graph.ExceptionalUnitGraph; //导入依赖的package包/类
private String findUriDef(Body b, Unit u, Local l) {
    final UnitGraph g = new ExceptionalUnitGraph(b);
    final SmartLocalDefs localDefs = new SmartLocalDefs(g, new SimpleLiveLocals(g));
    final SimpleLocalUses localUses = new SimpleLocalUses(g, localDefs);

    List<Unit> defs = localDefs.getDefsOfAt((Local) l, u);
    if (defs.size() == 0) {
        System.out.println("warning: uri def empty!");
        return null;
    }
    Unit def = defs.get(0);
    logger.debug("uri def: " + def);
    if (def instanceof IdentityStmt) {
        System.out.println("warning: do not handle uri from identity stmt");
        return null;
    } else if (def instanceof AssignStmt) {
        AssignStmt ass = (AssignStmt) def;
        Value r = ass.getRightOp();
        if (r instanceof FieldRef) {
            FieldRef fr = (FieldRef) r;
            SootField sf = fr.getField();
            if (sf.getName().contains("URI")) {
                String auth = getFieldFromClass(sf);
                return auth;
            }
        } else {
            System.out.println("warning: uri: do not handle def '" + def + "'");
            return null;
        }
    }
    return null;
}
 

import soot.toolkits.graph.ExceptionalUnitGraph; //导入依赖的package包/类
private Type getSystemFetcherReturnType(Body b) {
    ExceptionalUnitGraph g = new ExceptionalUnitGraph(b);
    SmartLocalDefs localDefs = new SmartLocalDefs(g,
            new SimpleLiveLocals(g));
    SimpleLocalUses localUses = new SimpleLocalUses(g, localDefs);

    for (Unit u : b.getUnits()) {
        if (u instanceof JReturnStmt) {
            JReturnStmt ret = (JReturnStmt) u;
            Local l = (Local) ret.getOp();
            List<Unit> defs = localDefs.getDefsOfAt(l, u);
            for (Unit d : defs) {
                if (d instanceof AssignStmt) {
                    AssignStmt ass = (AssignStmt) d;
                    Type t = ass.getRightOp().getType();
                    if (t instanceof NullType) {
                        System.out.println("warning: null type! " + ass);
                    } else {
                        System.out.println("ok: found return type: " + t);
                        return t;
                    }
                }
            }
        }
    }
    System.out.println("warning: no return type found returning void!");
    return VoidType.v();
}
 

import soot.toolkits.graph.ExceptionalUnitGraph; //导入依赖的package包/类
/**
 * Get registered account managers
 * 
 * @param sm
 */
public void getRegisterServiceMapping(SootMethod sm) {
    if (!sm.isConcrete())
        return;

    Body b = null;
    try {
        b = sm.retrieveActiveBody();
    } catch (Exception e) {
        throw new RuntimeException("[E] when retrieving body for method " + sm);
    }
    ExceptionalUnitGraph eug = new ExceptionalUnitGraph(b);
    final SmartLocalDefs localDefs = new SmartLocalDefs(eug, new SimpleLiveLocals(eug));
    for (Unit u : b.getUnits()) {
        Stmt s = (Stmt) u;
        if (s.containsInvokeExpr()) {
            InvokeExpr ie = s.getInvokeExpr();
            SootMethodRef smr = ie.getMethodRef();
            String sig = smr.getSignature();
            if (sig.equals(addServiceSig)) {
                System.out.println("statement: " + s);
                List<Unit> defs = new ArrayList<Unit>();
                // arg0 = string representing the service name
                String serviceName = getServiceName(b, u);
                if (serviceName == null)
                    throw new RuntimeException("error: service name is null for '" + u + "'");
                System.out.println("add register manager name: " + serviceName + " " + u);
                // arg1 = IBinder referencing the service class
                Value v = ie.getArg(1);
                if (!(v instanceof Local)) {
                    System.out
                            .println("Warning: adding a register manager without a local reference! Skipping...");
                    continue;
                }
            }
        }
    }
}
 

import soot.toolkits.graph.ExceptionalUnitGraph; //导入依赖的package包/类
public static void main(String[] args) {
	PackManager.v().getPack("jtp").add(
			new Transform("jtp.myTransform", new BodyTransformer() {

				protected void internalTransform(Body body, String phase, Map options) {
					new MyAnalysis(new ExceptionalUnitGraph(body));
					// use G.v().out instead of System.out so that Soot can
					// redirect this output to the Eclipse console
					G.v().out.println(body.getMethod());
				}
				
			}));
	
	soot.Main.main(args);
}
 

import soot.toolkits.graph.ExceptionalUnitGraph; //导入依赖的package包/类
/**
 * Adds <code>StringTag</code>s and <code>ColorTag</code>s to the body
 * in the interest of using Eclipse to relay information to the user.<br/>
 * Every unit that has a busy expression flowing out of it, gets a
 * <code>StringTag</code> describing that fact (per expression).
 * If an expression that is busy out of that unit is also used within
 * it, then we add a <code>ColorTag</code> to that expression.
 * @param b the body to transform
 * @param phaseName the name of the phase this transform belongs to
 * @param options any options to this transform (in this case always empty) 
 */
protected void internalTransform(Body b, String phaseName, Map options) {
	VeryBusyExpressions vbe = new SimpleVeryBusyExpressions(new ExceptionalUnitGraph(b));
	
	for (Unit u : b.getUnits()) {
		for (Value v : vbe.getBusyExpressionsAfter(u)) {
			u.addTag(new StringTag("Busy expression: " + v, TAG_TYPE));
			
			for (ValueBox use : u.getUseBoxes()) {
				if (use.getValue().equivTo(v))
					use.addTag(new ColorTag(ColorTag.RED, TAG_TYPE));
			}
		}
	}
}
 

import soot.toolkits.graph.ExceptionalUnitGraph; //导入依赖的package包/类
protected void internalTransform(Body b, String phaseName, Map<String,String> options) 
{  
  // removes all redundant load-stores
  boolean changed = true;
  PatchingChain<Unit> units = b.getUnits();
  while (changed) {
    changed = false;
    Unit prevprevprev = null, prevprev = null, prev = null;
    ExceptionalUnitGraph eug = new ExceptionalUnitGraph(b);
    Iterator<Unit> it = units.snapshotIterator();
    while (it.hasNext()) {
      Unit u = it.next();
      if (prev != null && prev instanceof PushInst && u instanceof StoreInst) {
        if (prevprev != null && prevprev instanceof StoreInst 
            && prevprevprev != null && prevprevprev instanceof PushInst) {
          Local lprev = ((StoreInst)prevprev).getLocal();
          Local l = ((StoreInst)u).getLocal();
          if (l == lprev && eug.getSuccsOf(prevprevprev).size() == 1 && eug.getSuccsOf(prevprev).size() == 1) {
            fixJumps(prevprevprev, prev, b.getTraps());
            fixJumps(prevprev, u, b.getTraps());
            units.remove(prevprevprev);
            units.remove(prevprev);
            changed = true;
            break;
          }
        }
      }
      prevprevprev = prevprev;
      prevprev = prev;
      prev = u;
    }
  } // end while changes have been made
}
 

import soot.toolkits.graph.ExceptionalUnitGraph; //导入依赖的package包/类
public void internalTransform(Body body, String phaseName, Map<String,String> options) {

	// really, the analysis should be able to use its own results to determine
	// that some branches are dead, but since it doesn't we just iterate.
	boolean changed;
	do {
	    changed=false;

	    NullnessAnalysis analysis=analysisFactory.newAnalysis(new ExceptionalUnitGraph(body));
	    
	    Chain<Unit> units=body.getUnits();
	    Stmt s;
	    for(s=(Stmt) units.getFirst();s!=null;s=(Stmt) units.getSuccOf(s)) {
		if(!(s instanceof IfStmt)) continue;
		IfStmt is=(IfStmt) s;
		Value c=is.getCondition();
		if(!(c instanceof EqExpr || c instanceof NeExpr)) continue;
		BinopExpr e=(BinopExpr) c;
		Immediate i=null;
		if(e.getOp1() instanceof NullConstant) i=(Immediate) e.getOp2();
		if(e.getOp2() instanceof NullConstant) i=(Immediate) e.getOp1();
		if(i==null) continue;
		boolean alwaysNull = analysis.isAlwaysNullBefore(s, i);
		boolean alwaysNonNull = analysis.isAlwaysNonNullBefore(s, i);
		int elim=0; // -1 => condition is false, 1 => condition is true
		if(alwaysNonNull) elim=c instanceof EqExpr ? -1 : 1;
		if(alwaysNull) elim=c instanceof EqExpr ? 1 : -1;
		Stmt newstmt=null;
		if(elim==-1) newstmt=Jimple.v().newNopStmt();
		if(elim==1) newstmt=Jimple.v().newGotoStmt(is.getTarget());
		if(newstmt!=null) {
		    units.swapWith(s,newstmt);
		    s=newstmt;
		    changed=true;
		}
	    }
	} while(changed);
    }
 

import soot.toolkits.graph.ExceptionalUnitGraph; //导入依赖的package包/类
/**
 * This method returns a fresh instance of a {@link SmartLocalDefs} analysis, based
 * on a freshly created {@link ExceptionalUnitGraph} for b, with standard parameters.
 * If the body b's modification count has not changed since the last time such an analysis
 * was requested for b, then the previously created analysis is returned instead.
 * @see Body#getModificationCount()
 */
public SmartLocalDefs getSmartLocalDefsFor(Body b) {
	Pair<Long, SmartLocalDefs> modCountAndSLD = pool.get(b);
	if(modCountAndSLD!=null && modCountAndSLD.o1.longValue() == b.getModificationCount()) {
		return modCountAndSLD.o2;
	} else {
		ExceptionalUnitGraph g = new ExceptionalUnitGraph(b);
		SmartLocalDefs newSLD = new SmartLocalDefs(g, new SimpleLiveLocals( g ));
		pool.put(b, new Pair<Long, SmartLocalDefs>(b.getModificationCount(), newSLD));
		return newSLD;
	}
}