Java InvokeExpr.getArgCount方法代码示例

import soot.jimple.InvokeExpr; //导入方法依赖的package包/类
@Override
public boolean tryApply(SootStmtSwitch ss, Value lhs, InvokeExpr ivk) {
	SootMethod sm = ivk.getMethod();
	if (this.methodSignature.equals(sm.getSignature()) && this.guardPosition<ivk.getArgCount()) {
		ivk.getArg(this.guardPosition).apply(ss.getValueSwitch());
		ProgramFactory pf = GlobalsCache.v().getPf();
		Expression guard = TranslationHelpers.castBoogieTypes(
				ss.getValueSwitch().getExpression(), pf.getBoolType());
		if (this.guardNegated) {
			guard = pf.mkUnaryExpression(BoogieType.boolType, UnaryOperator.LOGICNEG, guard);
		}	
		Attribute[] attributes = TranslationHelpers.javaLocation2Attribute(ss.getCurrentStatement());
		ss.addStatement(pf.mkAssertStatement(attributes, guard));
		return true;
	}
		return false;
}
 

import soot.jimple.InvokeExpr; //导入方法依赖的package包/类
@Override
public boolean tryApply(SootStmtSwitch ss, Value lhs, InvokeExpr ivk) {
	SootMethod sm = ivk.getMethod();
	if (this.methodSignature.equals(sm.getSignature()) && Math.max(lpos, rpos)<ivk.getArgCount()) {
		ivk.getArg(this.lpos).apply(ss.getValueSwitch());
		Expression left = ss.getValueSwitch().getExpression();
		ivk.getArg(this.rpos).apply(ss.getValueSwitch());
		Expression right = ss.getValueSwitch().getExpression();
		
		ProgramFactory pf = GlobalsCache.v().getPf();
		Expression guard = pf.mkBinaryExpression(BoogieType.boolType, bop, left, right);
		if (this.guardNegated) {
			guard = pf.mkUnaryExpression(BoogieType.boolType, UnaryOperator.LOGICNEG, guard);
		}	
		Attribute[] attributes = TranslationHelpers.javaLocation2Attribute(ss.getCurrentStatement());
		ss.addStatement(pf.mkAssertStatement(attributes, guard));
		return true;
	}
		return false;
}
 

import soot.jimple.InvokeExpr; //导入方法依赖的package包/类
private void handleInvoke(InvokeExpr invokeExpr) {
    method = invokeExpr.getMethod();
    MethodEnvironment me = getStore().getMethodEnvironment(method);
    addConstraints(me.getCalleeSignatureConstraints());
    handleInheritedWriteEffect(me.getCalleeSignatureConstraints());
    String signature = me.getCalleeSiganture();
    for (int i = 0; i < invokeExpr.getArgCount(); i++) {
        SecurityConstraintValueReadSwitch argSwitch =
            getReadSwitch(invokeExpr.getArg(i));
        addInheritedWriteEffects(argSwitch.getInheritedWriteEffects());
        addParameterConstraints(argSwitch, signature, i);
        addConstraints(argSwitch.getConstraints());
    }
    addProgramCounterConstraint(signature);
    ComponentReturnRef retRef = new ComponentReturnRef(signature);
    addReadComponent(retRef);
    handleDimension(method.getReturnType(), retRef);
}
 

import soot.jimple.InvokeExpr; //导入方法依赖的package包/类
@Override
public Map<Local, SignAnalysis.Sign> callEntryFlowFunction(
		Context<SootMethod, Unit, Map<Local, SignAnalysis.Sign>> context, SootMethod calledMethod, Unit unit,
		Map<Local, SignAnalysis.Sign> inValue) {
	// Initialise result to empty map
	Map<Local, SignAnalysis.Sign> entryValue = topValue();
	// Map arguments to parameters
	InvokeExpr ie = ((Stmt) unit).getInvokeExpr();
	for (int i = 0; i < ie.getArgCount(); i++) {
		Value arg = ie.getArg(i);
		Local param = calledMethod.getActiveBody().getParameterLocal(i);
		assign(param, arg, inValue, entryValue);
	}
	// And instance of the this local
	if (ie instanceof InstanceInvokeExpr) {
		Value instance = ((InstanceInvokeExpr) ie).getBase();
		Local thisLocal = calledMethod.getActiveBody().getThisLocal();
		assign(thisLocal, instance, inValue, entryValue);
	}
	// Return the entry value at the called method
	return entryValue;
}
 

import soot.jimple.InvokeExpr; //导入方法依赖的package包/类
@Override
public Map<Local, Constant> callEntryFlowFunction(Context<SootMethod, Unit, Map<Local, Constant>> context, SootMethod calledMethod, Unit unit, Map<Local, Constant> inValue) {
	// Initialise result to empty map
	Map<Local, Constant> entryValue = topValue();
	// Map arguments to parameters
	InvokeExpr ie = ((Stmt) unit).getInvokeExpr();
	for (int i = 0; i < ie.getArgCount(); i++) {
		Value arg = ie.getArg(i);
		Local param = calledMethod.getActiveBody().getParameterLocal(i);
		assign(param, arg, inValue, entryValue);
	}
	// And instance of the this local
	if (ie instanceof InstanceInvokeExpr) {
		Value instance = ((InstanceInvokeExpr) ie).getBase();
		Local thisLocal = calledMethod.getActiveBody().getThisLocal();
		assign(thisLocal, instance, inValue, entryValue);
	}
	// Return the entry value at the called method
	return entryValue;
}
 

import soot.jimple.InvokeExpr; //导入方法依赖的package包/类
@Override
public FlowFunction<WrappedAccessGraph> getCallToReturnFlowFunction(WrappedAccessGraph sourceFact, final Unit callStmt,
		Unit returnSite, boolean hasCallees) {
	if (!hasCallees) {
		return Identity.v();
	}
	if (!(callStmt instanceof Stmt)) {
		return Identity.v();
	}
	Stmt callSite = (Stmt) callStmt;
	if (!callSite.containsInvokeExpr()) {
		return Identity.v();
	}

	final InvokeExpr invokeExpr = callSite.getInvokeExpr();
	final SootMethod callee = invokeExpr.getMethod();
	return new FlowFunction<WrappedAccessGraph>() {
		@Override
		public Set<WrappedAccessGraph> computeTargets(WrappedAccessGraph source) {
			for (int i = 0; i < invokeExpr.getArgCount(); i++) {
				if (source.baseMatches(invokeExpr.getArg(i))) {
					return Collections.emptySet();
				}
			}
			if (invokeExpr instanceof InstanceInvokeExpr) {
				InstanceInvokeExpr iie = (InstanceInvokeExpr) invokeExpr;
				Value base = iie.getBase();
				if (source.baseMatches(base)) {
					return Collections.emptySet();
				}
			}
			return Collections.singleton(source);
		}
	};
}
 

import soot.jimple.InvokeExpr; //导入方法依赖的package包/类
/***** API calls *****/

	// Sanitizer for user study. Kill the parameter and its aliases
	private boolean applySanitizer(Unit call, FlowAbstraction source) {

		// Call itself
		Stmt stmt = (Stmt) call;
		final String target = stmt.getInvokeExpr().getMethod().getSignature();
		final List<Value> args = stmt.getInvokeExpr().getArgs();

		if (!target.equals("<sanitizers.Sanitizer: void sanitize(java.lang.Object)>"))
			return false;

		if (killforSanit(call, args.get(0), source))
			return true;

		// Case of valueOf for primitive types
		// a = Integer.valueOf(b); and sanit(a) -> must also treat aliases of b
		List<Unit> predecessors = icfg.getPredsOf(call);
		for (Unit predecessor : predecessors) {
			if (predecessor instanceof DefinitionStmt) {
				DefinitionStmt def = (DefinitionStmt) predecessor;
				if (def.getLeftOp().equals(args.get(0)) && def.getRightOp() instanceof StaticInvokeExpr) {
					InvokeExpr expr = (StaticInvokeExpr) def.getRightOp();
					final SootMethod method = expr.getMethod();
					if (method.getName().equals("valueOf") && expr.getArgCount() == 1
							&& method.getDeclaringClass().getType().equals(method.getReturnType())
							&& isPrimitiveType(method.getReturnType())) {
						if (killforSanit(predecessor, expr.getArg(0), source))
							return true;
					}
				}
			}
		}
		return false;
	}
 

import soot.jimple.InvokeExpr; //导入方法依赖的package包/类
private void handleInvokeExpr(InvokeExpr ie, Stmt stmt)
{
	SootMethodRef m = ie.getMethodRef();

	if ( ie instanceof InstanceInvokeExpr )
	{
		InstanceInvokeExpr iie = (InstanceInvokeExpr)ie;
		iie.setBase(this.uv.visit(
			iie.getBase(),m.declaringClass().getType(), stmt));
	}

	for ( int i = 0; i < ie.getArgCount(); i++ )
		ie.setArg(i, this.uv.visit(
			ie.getArg(i), m.parameterType(i), stmt));
}
 

import soot.jimple.InvokeExpr; //导入方法依赖的package包/类
@Override
public boolean tryApply(SootStmtSwitch ss, Value lhs, InvokeExpr ivk) {
	SootMethod sm = ivk.getMethod();
	if (this.methodSignature.equals(sm.getSignature()) && this.guardPosition<ivk.getArgCount()) {
		ivk.getArg(this.guardPosition).apply(ss.getValueSwitch());
		ProgramFactory pf = GlobalsCache.v().getPf();
		BinaryOperator be = (this.guardNegated) ? BinaryOperator.COMPEQ : BinaryOperator.COMPNEQ;
		Expression guard =  pf.mkBinaryExpression(BoogieType.boolType, be, ss.getValueSwitch().getExpression(), SootPrelude.v().getNullConstant());
		Attribute[] attributes = TranslationHelpers.javaLocation2Attribute(ss.getCurrentStatement());
		ss.addStatement(pf.mkAssertStatement(attributes, guard));
		return true;
	}
		return false;
}
 

import soot.jimple.InvokeExpr; //导入方法依赖的package包/类
/**
 * Gives back the set of types of broadcast receivers for dynamic filters that match a set of given actions.
 * @param actions set of actions captured by receivers of interest.
 * @return
 */
private Set <String> dynamicallyFilteredBroadcastTypes(String action) {
    Set <String> result = new HashSet<String>();
    SootClass contextClass;
    SootClass intentFilterClass;
    try {
        contextClass = scene.getSootClass(ANDROID_CONTENT_CONTEXT_WRAPPER);
        intentFilterClass = scene.getSootClass(ANDROID_CONTENT_INTENT_FILTER);
        SootField actionField = intentFilterClass.getField(ACTION_FIELD_SIGNATURE);
        for(String registerSig : REGISTER_SIGNATURES) {
            SootMethod regMethod = contextClass.getMethod(registerSig);
            Iterator<Edge> edges = cg.edgesInto(regMethod);
            while(edges.hasNext()) {
                Edge edge = edges.next();
                InvokeExpr ie = edge.srcStmt().getInvokeExpr();
                if (ie.getArgCount() < 2) continue;
                Value filter = ie.getArg(1);
                if (! (filter instanceof Local)) continue;
                PointsToSet pts = pag.reachingObjects((Local) filter, actionField);
                Set <String> filteredActions = pts.possibleStringConstants();
                if (filteredActions == null || ! filteredActions.contains(action)) continue;
                Value receivers = ie.getArg(0);
                if (! (receivers instanceof Local)) continue;
                PointsToSet ptsReceiver = pag.reachingObjects((Local) receivers);
                addAll(result,ptsReceiver.possibleTypes());
            }
        }
    } catch (RuntimeException e) {
        Out.getLog().println("Error while computing dynamic aborted broadcast " + e.getMessage());  
    }
    return result;
}
 

import soot.jimple.InvokeExpr; //导入方法依赖的package包/类
@Override
protected void internalTransform(Body b, String phaseName,
		Map<String, String> options) {
	// Do not instrument methods in framework classes
	if (!canInstrumentMethod(b.getMethod()))
		return;
	
	// Iterate over all statements. For each definition statement that
	// defines a string, report the string to the server.
	for (Iterator<Unit> unitIt = b.getUnits().snapshotIterator(); unitIt.hasNext(); ) {
		Unit curUnit = unitIt.next();
		
		// If we're still inside the IdentityStmt block, there's nothing to
		// instrument
		if (curUnit instanceof IdentityStmt ||
				// If this unit was instrumented by another transformer, there's nothing to instrument
				curUnit.hasTag(InstrumentedCodeTag.name))
			continue;			
		
		if (instrumentOnlyComparisons) {
			// Is this a comparison?
			Stmt curStmt = (Stmt) curUnit;
			if (!curStmt.containsInvokeExpr())
				continue;
			InvokeExpr invExpr = curStmt.getInvokeExpr();
			if (comparisonSignatures.contains(invExpr.getMethod().getSignature())) {					
				if (invExpr instanceof InstanceInvokeExpr)
					checkAndReport(b, curStmt, ((InstanceInvokeExpr) invExpr).getBase(), -1);
				for (int i = 0; i < invExpr.getArgCount(); i++)
					checkAndReport(b, curStmt, invExpr.getArg(i), i);
			}
			
			// Do not look for anything else
			continue;
		}
		
		// We only care about statements that define strings
		if (!(curUnit instanceof AssignStmt))
			continue;
		AssignStmt assignStmt = (AssignStmt) curUnit;
		checkAndReport(b, assignStmt, assignStmt.getLeftOp(), -1);
	}

}
 

import soot.jimple.InvokeExpr; //导入方法依赖的package包/类
@Override
public void caseInvokeStmt(InvokeStmt stmt) {
	InvokeExpr invokeExpr = stmt.getInvokeExpr();
	SootClass declaringClass = invokeExpr.getMethod().getDeclaringClass();
	if(exprVisitor.isExpressionThatNeedsToBeConvertedToSMT(invokeExpr))
		exprVisitor.convertSpecialExpressionsToSMT(invokeExpr, stmt);
	else if(UtilInstrumenter.isAppDeveloperCode(declaringClass)) {
		SootMethod method = invokeExpr.getMethod();
		Body body = method.retrieveActiveBody();
		
		SMTBinding newRhs = getBindingForTaintedValue(stmt);
		//if there is no taint-tracking involved (newRhs == null), we do not have to do anything here
		if(newRhs == null)
			return;
		
		int indexOfInterest = -1;
		for(int i = 0; i < invokeExpr.getArgCount(); i++) {
			if(newRhs.getVariableName().equals(invokeExpr.getArg(i).toString())) {
				indexOfInterest = i;
				break;
			}
		}
		
		if(indexOfInterest == -1)
			return;
		
		
		for(Unit unit : body.getUnits()) {
			if(unit instanceof IdentityStmt) {
				IdentityStmt identity = (IdentityStmt)unit;
				Value rhs = identity.getRightOp();
				if(rhs instanceof ParameterRef) {
					ParameterRef param = (ParameterRef)rhs;
					if(param.getIndex() == indexOfInterest) {
						Value lhs = identity.getLeftOp();
						SMTBinding newLhs = createNewBindingForValue(lhs);
						addValueBindingToVariableDeclaration(lhs, newLhs);
						SMTSimpleAssignment simpleAssignment = new SMTSimpleAssignment(newLhs, new SMTBindingValue(newRhs));
						SMTAssertStatement assignmentAssert = new SMTAssertStatement(simpleAssignment);
						addAssertStmtToAllPrograms(assignmentAssert);
					}
				}					
			}
		}
	}		
	else {
		System.err.println(String.format("Double-Check if the following method contains useful information which can be extracted: \n%s", stmt));
	}
	
}
 

import soot.jimple.InvokeExpr; //导入方法依赖的package包/类
private static List<MethodCall> getStringParameterInCall(SootMethod targetM, SootMethod callToSearchM, int paramPos, Set<String> mpSet, boolean isCheckMethod) {
  List<MethodCall> methodCallsList = new ArrayList<MethodCall>();

  Body b = targetM.getActiveBody();
  for( Unit u: b.getUnits()) {
    MethodCall currMC = null;

    Stmt s = (Stmt)u;
    if (!s.containsInvokeExpr())
      continue;
    InvokeExpr invokeExpr = s.getInvokeExpr();

    boolean condition = false;
    if (isCheckMethod)
      condition = isCheckPermissionMethod(invokeExpr.getMethod());
    else
      condition = invokeExpr.getMethod().toString().split(":")[1].equals(callToSearchM.toString().split(":")[1]); // TODO: should check all out edges
    if (condition) {
      logger.info("Target method '"+ invokeExpr.getMethod() +"' found! Source method: "+ targetM);
      methodCallsList.add(new MethodCall(invokeExpr.getMethod(), u));
      currMC = methodCallsList.get(0);
    }

    if (currMC == null) {
      continue;
    }
    // at this point we know that we are dealing with a permission check method call unit

    // retrieve first argument which points to the permission string
    Value vParam = null;
    int count = invokeExpr.getArgCount();
    if (count <= 0)
      throw new RuntimeException("Method has 0 arguments! "+ s);
    vParam = invokeExpr.getArg(paramPos);

    // the first argument is a StringConstant whose value
    // is the permission string
    if (vParam instanceof StringConstant) { 
      AnalysisType.v().cur().case1_direct_string_passed_as_parameter();      
      currMC.paramConstantString = vParam.toString();
      logger.info("[F] "+ currMC.paramConstantString);
      mpSet.add (currMC.paramConstantString); // is String constant
      continue;
    } 

    if (vParam instanceof NullConstant) {
      logger.info("[F] NullConstant!");
      //mpSet.add("NULL_CONSTANT");
      continue;
    }
    
    // the first argument must be a local at this point
    if (!(vParam instanceof Local))
      throw new RuntimeException("vParam is not instance of Local! -> '"+ (vParam==null?"is null":vParam.getClass()) +"'"); 

    // store info about this local for step2 below
    currMC.paramName = ((Local)vParam).getName();
    currMC.paramLocal = (Local)vParam;
    currMC.paramNameUnit = u;
  }
  return methodCallsList;
}
 

import soot.jimple.InvokeExpr; //导入方法依赖的package包/类
@Override
public FlowFunction<AccessGraph> getCallToReturnFlowFunction(
    final IPathEdge<Unit, AccessGraph> edge, Unit returnSite, final SootMethod callee,
    final Unit calleeSp) {
  if (callee != null) {
    final Local[] paramLocals = new Local[callee.getParameterCount()];
    for (int i = 0; i < callee.getParameterCount(); i++)
      paramLocals[i] = callee.getActiveBody().getParameterLocal(i);
  }
  final Unit callSite = edge.getTarget();
  return new FlowFunction<AccessGraph>() {
    @Override
    public Set<AccessGraph> computeTargets(AccessGraph source) {
      boolean sourceIsKilled = false;

      if (context.trackStaticFields() && source.isStatic()) {
        if (callee == null
            || !context.icfg.isStaticFieldUsed(callee, source.getFirstField().getField())) {
          return Collections.singleton(source);
        } else {
          return Collections.emptySet();
        }
      }
      Set<AccessGraph> out = new HashSet<>();
      if (callSite instanceof Stmt) {
        Stmt is = (Stmt) callSite;
        if (is.containsInvokeExpr()) {
          final InvokeExpr ie = is.getInvokeExpr();

          final Value[] callArgs = new Value[ie.getArgCount()];
          for (int i = 0; i < ie.getArgCount(); i++)
            callArgs[i] = ie.getArg(i);
          if (context.backwardMockHandler.handles(callSite, ie, source, callArgs)) {
            return context.backwardMockHandler.computeTargetsOverCall(callSite, ie, source,
                callArgs, edge);
          }
          if (ie.getMethod().equals(AliasFinder.ARRAY_COPY)) {
            for (Value callVal : callArgs) {
              if (callVal == source.getBase()) {
                // java uses call by value, but fields of complex objects can be changed (and
                // tainted), so use this conservative approach:
                Set<AccessGraph> nativeAbs =
                    context.ncHandler.getBackwardValues(is, source, callArgs);
                out.addAll(nativeAbs);
              }
            }
          }
        }

      }

      if (callSite instanceof AssignStmt) {
        AssignStmt as = (AssignStmt) callSite;
        Value leftOp = as.getLeftOp();
        // mapping of return value
        if (leftOp instanceof Local && source.getBase().equals(leftOp)) {
          sourceIsKilled = true;
        }
      }
      if (!sourceIsKilled)
        out.add(source);

      return out;
    }
  };
}
 

import soot.jimple.InvokeExpr; //导入方法依赖的package包/类
/**
 * Checks whether the given call site indicates a UI source, e.g. a password
 * input
 * 
 * @param sCallSite
 *            The call site that may potentially read data from a sensitive
 *            UI control
 * @param cfg
 *            The bidirectional control flow graph
 * @return True if the given call site reads data from a UI source, false
 *         otherwise
 */
private boolean isUISource(Stmt sCallSite, InterproceduralCFG<Unit, SootMethod> cfg) {
	// If we match input controls, we need to check whether this is a call
	// to one of the well-known resource handling functions in Android
	if (this.layoutMatching != LayoutMatchingMode.NoMatch && sCallSite.containsInvokeExpr()) {
		InvokeExpr ie = sCallSite.getInvokeExpr();
		final String signature = methodToSignature.getUnchecked(ie.getMethod());
		if (signature.equals(Activity_FindViewById)
				|| signature.equals(View_FindViewById)) {
			// Perform a constant propagation inside this method exactly
			// once
			SootMethod uiMethod = cfg.getMethodOf(sCallSite);
			if (analyzedLayoutMethods.add(uiMethod))
				ConstantPropagatorAndFolder.v().transform(uiMethod.getActiveBody());

			// If we match all controls, we don't care about the specific
			// control we're dealing with
			if (this.layoutMatching == LayoutMatchingMode.MatchAll)
				return true;
			// If we don't have a layout control list, we cannot perform any
			// more specific checks
			if (this.layoutControls == null)
				return false;

			// If we match specific controls, we need to get the ID of
			// control and look up the respective data object
			if (ie.getArgCount() != 1) {
				System.err.println("Framework method call with unexpected " + "number of arguments");
				return false;
			}
			int id = 0;
			if (ie.getArg(0) instanceof IntConstant)
				id = ((IntConstant) ie.getArg(0)).value;
			else if (ie.getArg(0) instanceof Local) {
				Integer idVal = findLastResIDAssignment(sCallSite, (Local) ie.getArg(0), (BiDiInterproceduralCFG<Unit, SootMethod>) cfg, new HashSet<Stmt>(cfg.getMethodOf(sCallSite).getActiveBody().getUnits().size()));
				if (idVal == null) {
					System.err.println("Could not find assignment to local "
								+ ((Local) ie.getArg(0)).getName()
								+ " in method "
								+ cfg.getMethodOf(sCallSite).getSignature());
					return false;
				} else
					id = idVal.intValue();
			} else {
				System.err.println("Framework method call with unexpected " + "parameter type: " + ie.toString() + ", " + "first parameter is of type " + ie.getArg(0).getClass());
				return false;
			}

			LayoutControl control = this.layoutControls.get(id);
			if (control == null) {
				System.err.println("Layout control with ID " + id + " not found");
				return false;
			}
			if (this.layoutMatching == LayoutMatchingMode.MatchSensitiveOnly && control.isSensitive())
				return true;
		}
	}
	return false;
}