Java InvokeExpr.getArg方法代码示例

import soot.jimple.InvokeExpr; //导入方法依赖的package包/类
@Override
public KillGenInfo processBackwardCallToReturn(Trackable taint, Stmt callSite, InvokeExpr ie) {
	SootMethod method = ie.getMethod();
	List<Taint> taints = Lists.newLinkedList();
	if (ie instanceof InstanceInvokeExpr) {
		Value receiver = ((InstanceInvokeExpr) ie).getBase();
		taints.add(new Taint(callSite, taint, receiver, receiver.getType()));
	}

	for (int i = 0; i < method.getParameterCount(); i++) {
		Type parameterType = method.getParameterType(i);
		if (!(parameterType instanceof PrimType) && !(ie.getArg(i) instanceof Constant)) {
			taints.add(new Taint(callSite, taint, ie.getArg(i), parameterType));
		}
	}

	if (taints.isEmpty())
		return kill();
	else
		return propagate(taints.toArray(new Taint[taints.size()]));
}
 

import soot.jimple.InvokeExpr; //导入方法依赖的package包/类
@Override
protected KillGenInfo handleMethodCall(Taint taint, Stmt callSite, InvokeExpr ie) {
	if (ie.getMethodRef().getSignature().equals(VALUE_OF)) {
		if (callSite instanceof AssignStmt) {
			AssignStmt definitionStmt = (AssignStmt) callSite;
			final Value returnValue = definitionStmt.getLeftOp();
			if (taint.value.equals(returnValue)) {
				Value objectArg = ie.getArg(0);
				if (AnalysisUtil.isAssignable(taint.type, objectArg.getType()))
					return propagate(new Taint(callSite, taint, objectArg, objectArg.getType()));
				else
					return kill();
			}
		}
	}
	return identity();
}
 

import soot.jimple.InvokeExpr; //导入方法依赖的package包/类
@Override
public Map<Local, SignAnalysis.Sign> callEntryFlowFunction(
		Context<SootMethod, Unit, Map<Local, SignAnalysis.Sign>> context, SootMethod calledMethod, Unit unit,
		Map<Local, SignAnalysis.Sign> inValue) {
	// Initialise result to empty map
	Map<Local, SignAnalysis.Sign> entryValue = topValue();
	// Map arguments to parameters
	InvokeExpr ie = ((Stmt) unit).getInvokeExpr();
	for (int i = 0; i < ie.getArgCount(); i++) {
		Value arg = ie.getArg(i);
		Local param = calledMethod.getActiveBody().getParameterLocal(i);
		assign(param, arg, inValue, entryValue);
	}
	// And instance of the this local
	if (ie instanceof InstanceInvokeExpr) {
		Value instance = ((InstanceInvokeExpr) ie).getBase();
		Local thisLocal = calledMethod.getActiveBody().getThisLocal();
		assign(thisLocal, instance, inValue, entryValue);
	}
	// Return the entry value at the called method
	return entryValue;
}
 

import soot.jimple.InvokeExpr; //导入方法依赖的package包/类
@Override
public Map<Local, Constant> callEntryFlowFunction(Context<SootMethod, Unit, Map<Local, Constant>> context, SootMethod calledMethod, Unit unit, Map<Local, Constant> inValue) {
	// Initialise result to empty map
	Map<Local, Constant> entryValue = topValue();
	// Map arguments to parameters
	InvokeExpr ie = ((Stmt) unit).getInvokeExpr();
	for (int i = 0; i < ie.getArgCount(); i++) {
		Value arg = ie.getArg(i);
		Local param = calledMethod.getActiveBody().getParameterLocal(i);
		assign(param, arg, inValue, entryValue);
	}
	// And instance of the this local
	if (ie instanceof InstanceInvokeExpr) {
		Value instance = ((InstanceInvokeExpr) ie).getBase();
		Local thisLocal = calledMethod.getActiveBody().getThisLocal();
		assign(thisLocal, instance, inValue, entryValue);
	}
	// Return the entry value at the called method
	return entryValue;
}
 

import soot.jimple.InvokeExpr; //导入方法依赖的package包/类
private void prepareHandlerPostDelayed(Body body, Stmt invokeStmt, SootMethodRef reportRef) {
	InvokeExpr expr = invokeStmt.getInvokeExpr();
	
	Value oldValue = expr.getArg(1);
	Value newValue = LongConstant.v(2000L);
	
	expr.setArg(1, newValue);

	// Report the change
	InvokeStmt reportStmt = Jimple.v().newInvokeStmt(Jimple.v().newStaticInvokeExpr(
			reportRef, oldValue, newValue));
	reportStmt.addTag(new InstrumentedCodeTag());
	body.getUnits().insertAfter(reportStmt, invokeStmt);
}
 

import soot.jimple.InvokeExpr; //导入方法依赖的package包/类
private void convertSendTextMessage(SMTBinding taintBinding, InvokeExpr invokeExpr) {
	if(taintBinding != null){				
		//sms number: we know that the length should be at least 4 and the characters are digits
		Value smsNr = invokeExpr.getArg(0);
		if(smsNr.toString().equals(taintBinding.getVariableName())) {					
			SMTLengthMethodCall length = new SMTLengthMethodCall(new SMTBindingValue(taintBinding));
			SMTBinding tmpBinding = stmtVisitor.createTemporalBinding(SMTBinding.TYPE.Int);
			SMTMethodAssignment lengthMethodAssignment = new SMTMethodAssignment(tmpBinding, length);
			SMTAssertStatement lengthMethodAssert = new SMTAssertStatement(lengthMethodAssignment);
			stmtVisitor.addAssertStmtToAllPrograms(lengthMethodAssert);
			// (assert (> int 4 ) )
			SMTValue valueThreeBinding = new SMTConstantValue<Integer>(4);
			SMTSimpleBinaryOperation gtBinaryOperation = new SMTSimpleBinaryOperation(SMTSimpleBinaryOperation.SMTSimpleBinaryOperator.GT, new SMTBindingValue(tmpBinding), valueThreeBinding);
			SMTAssertStatement gtBinaryAssertion = new SMTAssertStatement(gtBinaryOperation);
			stmtVisitor.addAssertStmtToAllPrograms(gtBinaryAssertion);
			
			//second: (assert (RegexIn a (RegexStar (RegexDigit "") ) ) )
			SMTRegexDigitOperation isDigitOperation = new SMTRegexDigitOperation(taintBinding);
			SMTAssertStatement isDigitAssert = new SMTAssertStatement(isDigitOperation);
			//Todo: temporarily disabled this one due to performance reasons; please enable it!!
			stmtVisitor.addAssertStmtToAllPrograms(isDigitAssert);
		}
		//there is no return value
		this.result = null;
	}
	else
		throw new RuntimeException("it should be an assignment!");
}
 

import soot.jimple.InvokeExpr; //导入方法依赖的package包/类
/**
 * Get registered account managers
 * 
 * @param sm
 */
public void getRegisterServiceMapping(SootMethod sm) {
    if (!sm.isConcrete())
        return;

    Body b = null;
    try {
        b = sm.retrieveActiveBody();
    } catch (Exception e) {
        throw new RuntimeException("[E] when retrieving body for method " + sm);
    }
    ExceptionalUnitGraph eug = new ExceptionalUnitGraph(b);
    final SmartLocalDefs localDefs = new SmartLocalDefs(eug, new SimpleLiveLocals(eug));
    for (Unit u : b.getUnits()) {
        Stmt s = (Stmt) u;
        if (s.containsInvokeExpr()) {
            InvokeExpr ie = s.getInvokeExpr();
            SootMethodRef smr = ie.getMethodRef();
            String sig = smr.getSignature();
            if (sig.equals(addServiceSig)) {
                System.out.println("statement: " + s);
                List<Unit> defs = new ArrayList<Unit>();
                // arg0 = string representing the service name
                String serviceName = getServiceName(b, u);
                if (serviceName == null)
                    throw new RuntimeException("error: service name is null for '" + u + "'");
                System.out.println("add register manager name: " + serviceName + " " + u);
                // arg1 = IBinder referencing the service class
                Value v = ie.getArg(1);
                if (!(v instanceof Local)) {
                    System.out
                            .println("Warning: adding a register manager without a local reference! Skipping...");
                    continue;
                }
            }
        }
    }
}
 

import soot.jimple.InvokeExpr; //导入方法依赖的package包/类
/**
 * Explicitly handles String.getChars() which does not really fit our
 * declarative model
 * @param invokeExpr The invocation of String.getChars()
 * @param taintedPath The tainted access path
 * @return The set of new taints to pass on in the taint propagation
 */
private Set<AccessPath> handleStringGetChars(InvokeExpr invokeExpr,
		AccessPath taintedPath) {
	// If the base object is tainted, the third argument gets tainted as
	// well
	if (((InstanceInvokeExpr) invokeExpr).getBase() == taintedPath.getPlainValue())
		return new TwoElementSet<AccessPath>(taintedPath, new AccessPath(
				invokeExpr.getArg(2), true));
	return Collections.singleton(taintedPath);
}
 

import soot.jimple.InvokeExpr; //导入方法依赖的package包/类
/**
 * Return all possible values for an integer local variable.
 * 
 * @param start The statement where the analysis should start.
 * @param local The local variable whose values we are looking for.
 * @param visitedStmts The set of visited statement.
 * @return The set of possible values for the local variable.
 */
private Set<Object> findIntAssignmentsForLocal(Stmt start, Local local, Set<Stmt> visitedStmts) {
  List<DefinitionStmt> assignStmts =
      findAssignmentsForLocal(start, local, true, new HashSet<Pair<Unit, Local>>());
  Set<Object> result = new HashSet<>(assignStmts.size());

  for (DefinitionStmt assignStmt : assignStmts) {
    Value rhsValue = assignStmt.getRightOp();
    if (rhsValue instanceof IntConstant) {
      result.add(((IntConstant) rhsValue).value);
    } else if (rhsValue instanceof LongConstant) {
      result.add(((LongConstant) rhsValue).value);
    } else if (rhsValue instanceof ParameterRef) {
      ParameterRef parameterRef = (ParameterRef) rhsValue;
      Iterator<Edge> edges =
          Scene.v().getCallGraph()
              .edgesInto(AnalysisParameters.v().getIcfg().getMethodOf(assignStmt));
      while (edges.hasNext()) {
        Edge edge = edges.next();
        InvokeExpr invokeExpr = edge.srcStmt().getInvokeExpr();
        Value argValue = invokeExpr.getArg(parameterRef.getIndex());
        if (argValue instanceof IntConstant) {
          result.add(((IntConstant) argValue).value);
        } else if (argValue instanceof LongConstant) {
          result.add(((LongConstant) argValue).value);
        } else if (argValue instanceof Local) {
          Set<Object> newResults =
              findIntAssignmentsForLocal(edge.srcStmt(), (Local) argValue, visitedStmts);
          result.addAll(newResults);
        } else {
          result.add(TOP_VALUE);
        }
      }
    } else {
      return Collections.singleton((Object) TOP_VALUE);
    }
  }

  return result;
}
 

import soot.jimple.InvokeExpr; //导入方法依赖的package包/类
/** Given an invoke expression and a parameter index (0 for the
 * base, strictly positive for others), gets the pointstoset
 * abstracting the potential arguments of this call at the given
 * parameter position
 * @param ie the expression containing the invoke
 * @param index the parameter position
 * @return the pointstoset abstracting the argument contents. */
private PointsToSet getPointsTo(InvokeExpr ie, int index) {
	Value arg; 
	if (index==0)
		arg = ((InstanceInvokeExpr) ie).getBase();
	else arg = ie.getArg(index-1);
	if (arg instanceof Local) 
		return ptAnalysis.reachingObjects((Local) arg);
	else return EmptyPointsToSet.v();
}
 

import soot.jimple.InvokeExpr; //导入方法依赖的package包/类
/**
 * Gives back the set of types of broadcast receivers for dynamic filters that match a set of given actions.
 * @param actions set of actions captured by receivers of interest.
 * @return
 */
private Set <String> dynamicallyFilteredBroadcastTypes(String action) {
    Set <String> result = new HashSet<String>();
    SootClass contextClass;
    SootClass intentFilterClass;
    try {
        contextClass = scene.getSootClass(ANDROID_CONTENT_CONTEXT_WRAPPER);
        intentFilterClass = scene.getSootClass(ANDROID_CONTENT_INTENT_FILTER);
        SootField actionField = intentFilterClass.getField(ACTION_FIELD_SIGNATURE);
        for(String registerSig : REGISTER_SIGNATURES) {
            SootMethod regMethod = contextClass.getMethod(registerSig);
            Iterator<Edge> edges = cg.edgesInto(regMethod);
            while(edges.hasNext()) {
                Edge edge = edges.next();
                InvokeExpr ie = edge.srcStmt().getInvokeExpr();
                if (ie.getArgCount() < 2) continue;
                Value filter = ie.getArg(1);
                if (! (filter instanceof Local)) continue;
                PointsToSet pts = pag.reachingObjects((Local) filter, actionField);
                Set <String> filteredActions = pts.possibleStringConstants();
                if (filteredActions == null || ! filteredActions.contains(action)) continue;
                Value receivers = ie.getArg(0);
                if (! (receivers instanceof Local)) continue;
                PointsToSet ptsReceiver = pag.reachingObjects((Local) receivers);
                addAll(result,ptsReceiver.possibleTypes());
            }
        }
    } catch (RuntimeException e) {
        Out.getLog().println("Error while computing dynamic aborted broadcast " + e.getMessage());  
    }
    return result;
}
 

import soot.jimple.InvokeExpr; //导入方法依赖的package包/类
@Override
public KillGenInfo processBackwardCallToReturn(Trackable taint, Stmt callSite, InvokeExpr ie) {
	Value classNameArg = ie.getArg(0);
	if (classNameArg instanceof NullConstant)
		return KillGenInfo.kill();

	Taint classNameParameter = new Taint(callSite, taint, classNameArg, ie.getMethod().getParameterType(0));
	return KillGenInfo.propagate(classNameParameter);
}
 

import soot.jimple.InvokeExpr; //导入方法依赖的package包/类
@Override
public KillGenInfo processBackwardCallToReturn(Trackable taint, Stmt callSite, InvokeExpr ie) {
	if (!enabled)
		return kill();

	Value classNameArg = ie.getArg(0);
	if (classNameArg instanceof NullConstant)
		return KillGenInfo.kill();

	Taint classNameTaint = new Taint(callSite, taint, classNameArg, ie.getMethod().getParameterType(0));
	classNameTaint.addPayload("checkPackageAccess");
	return KillGenInfo.propagate(classNameTaint);
}
 

import soot.jimple.InvokeExpr; //导入方法依赖的package包/类
@Override
public KillGenInfo processBackwardCallToReturn(Trackable taint, Stmt callSite, InvokeExpr ie) {
	Value classNameArg = ie.getArg(0);
	Value classLoaderArg = ie.getArg(2);

	if (classNameArg instanceof NullConstant || classLoaderArg instanceof NullConstant)
		return KillGenInfo.kill();
	SootMethod method = ie.getMethod();
	Taint classNameParameter = new Taint(callSite, taint, classNameArg, method.getParameterType(0));
	Taint classLoaderParameter = new Taint(callSite, taint, classLoaderArg, method.getParameterType(2));
	return KillGenInfo.propagate(classNameParameter, classLoaderParameter);
}
 

import soot.jimple.InvokeExpr; //导入方法依赖的package包/类
private void generateSMTEqualStmt(InvokeExpr invokeExpr, Value base) {
	//############## a.equals(b), a.equalsIgnoreCase(b) and a.matches(b) treatment ##############
	//(= a b)
			
	//treatment of lhs
	SMTBinding lhs = null;		
	if(stmtVisitor.hasBindingForValue(base))
		lhs = stmtVisitor.getLatestBindingForValue(base);
	else {			
		lhs = stmtVisitor.createNewBindingForValue(base);
		//created a new binding => dynamic values are necessary here for improving the result
		if(lhs.getVersion() == 0) {
			stmtVisitor.addNewDynamicValueForBaseObjectToMap(currentStatement, lhs);
		}	
		stmtVisitor.addValueBindingToVariableDeclaration(base, lhs);			
	}
	
	//treatment of rhs
	Value equalsCheck = invokeExpr.getArg(0);
	SMTValue smtArgumentValue = null;
	if(equalsCheck instanceof StringConstant)
		smtArgumentValue = new SMTConstantValue<String>(((StringConstant) equalsCheck).value);
	else {
		//no constant string available; there is maybe a need for dynamic information to improve the result
		SMTBinding tmpBinding = null;
		if(stmtVisitor.hasBindingForValue(equalsCheck))
			tmpBinding = stmtVisitor.getLatestBindingForValue(equalsCheck);
		else {
			tmpBinding = stmtVisitor.createNewBindingForValue(equalsCheck);
			stmtVisitor.addValueBindingToVariableDeclaration(equalsCheck, tmpBinding);
			//created a new binding => dynamic values are necessary here for improving the result
			stmtVisitor.addNewDynamicValueForArgumentToMap(currentStatement, tmpBinding, 0);
		}				
					
		smtArgumentValue = new SMTBindingValue(tmpBinding);
	}
	
	SMTBinding outerLHS = stmtVisitor.createTemporalBinding(SMTBinding.TYPE.Bool);
	SMTBooleanEqualsAssignment booleanEqualsAssignment = new SMTBooleanEqualsAssignment(outerLHS, new SMTBindingValue(lhs), smtArgumentValue);
	SMTAssertStatement booleanEqualsnAssert = new SMTAssertStatement(booleanEqualsAssignment);
	stmtVisitor.addAssertStmtToAllPrograms(booleanEqualsnAssert);
	
	// result is treated in JimpleStmtVisitor
	this.result = outerLHS;						
}