Java Stmt.containsInvokeExpr方法代码示例

import soot.jimple.Stmt; //导入方法依赖的package包/类
private String fixSMTSolverIntegerOutput(String loggingPoint, Stmt stmt) {
	if(stmt.containsInvokeExpr()) {
		InvokeExpr inv = stmt.getInvokeExpr();
		String metSig = inv.getMethod().getSignature();
		if(metSig.equals("<android.telephony.TelephonyManager: java.lang.String getSimOperator()>") 
				|| metSig.equals("<android.telephony.TelephonyManager: java.lang.String getNetworkOperator()>")
			) {
			String newLoggingPoint = "";
			for(char c : loggingPoint.toCharArray()) {
				if(c < '0' || c > '9') {
					Random rand = new Random();
					int num = rand.nextInt(10);
					newLoggingPoint += num;
				}
				else
					newLoggingPoint += c;
			}
			return newLoggingPoint;				
		}
	}
	return loggingPoint;
}
 

import soot.jimple.Stmt; //导入方法依赖的package包/类
private boolean isSemanticallyCorrect(String loggingPoint, Stmt stmt) {
	if(loggingPoint == null)
		return false;
	if(stmt.containsInvokeExpr()) {
		InvokeExpr inv = stmt.getInvokeExpr();
		String metSig = inv.getMethod().getSignature();
		if(metSig.equals("<android.telephony.TelephonyManager: java.lang.String getSimOperator()>") 
				|| metSig.equals("<android.telephony.TelephonyManager: java.lang.String getNetworkOperator()>")
			) {
			for(char c : loggingPoint.toCharArray()) {
				if(c < '0' || c > '9') 
					return false;
			}
		}
	}
	return true;
}
 

import soot.jimple.Stmt; //导入方法依赖的package包/类
private AnalysisDecision getFileFormatFromDataflow(int codePosID ) {
	Unit unit = codePositionManager.getUnitForCodePosition(codePosID);
	if(unit instanceof Stmt) {		
		Stmt stmt = (Stmt)unit;
		if(stmt.containsInvokeExpr()) {
			InvokeExpr inv = stmt.getInvokeExpr();
			SootMethod sm = inv.getMethod();
			Pair<Integer, Object> paramValue = retrieveCorrectFileInformation(sm);
							
			ServerResponse response = new ServerResponse();
			response.setAnalysisName(getAnalysisName());
	        response.setResponseExist(true);      
	        response.setParamValues(Collections.singleton(paramValue));
			AnalysisDecision finalDecision = new AnalysisDecision();
			finalDecision.setAnalysisName(getAnalysisName());
			finalDecision.setDecisionWeight(8);
		    finalDecision.setServerResponse(response);		    
		    return finalDecision;
		}
		else
			return noResults();
	}
	else {
		return noResults();
	}
}
 

import soot.jimple.Stmt; //导入方法依赖的package包/类
protected Collection<Pair<AccessGraph, EdgeFunction<TypestateDomainValue>>> generateAtConstructor(Unit unit,
		Collection<SootMethod> calledMethod, MatcherTransition initialTrans) {
	boolean matches = false;
	for (SootMethod method : calledMethod) {
		if (initialTrans.matches(method)) {
			matches = true;
		}
	}
	if (!matches)
		return Collections.emptySet();
	if (unit instanceof Stmt) {
		Stmt stmt = (Stmt) unit;
		if (stmt.containsInvokeExpr())
			if (stmt.getInvokeExpr() instanceof InstanceInvokeExpr) {
				InstanceInvokeExpr iie = (InstanceInvokeExpr) stmt.getInvokeExpr();
				if (iie.getBase() instanceof Local) {
					Local l = (Local) iie.getBase();
					Set<Pair<AccessGraph, EdgeFunction<TypestateDomainValue>>> out = new HashSet<>();
					out.add(new Pair<AccessGraph, EdgeFunction<TypestateDomainValue>>(
							new AccessGraph(l, l.getType()), new TransitionFunction(initialTrans)));
					return out;
				}
			}
	}
	return Collections.emptySet();
}
 

import soot.jimple.Stmt; //导入方法依赖的package包/类
private static void getUnitInBetween(UnitGraph ug, List<Unit>inBetween, Unit u) {

    for (Unit succ: ug.getSuccsOf(u)) {
      Stmt s = (Stmt)succ;
      if (inBetween.contains(succ)) {
        continue;
      }
      if (s.containsInvokeExpr()) {
        InvokeExpr ie = s.getInvokeExpr();
        if (ie.getMethodRef().name().contains("restoreCallingIdentity")) {
          return;
        } 
      }
      inBetween.add(succ);
      getUnitInBetween(ug, inBetween, succ);
    }
  }
 

import soot.jimple.Stmt; //导入方法依赖的package包/类
private SootMethod hasGetInstanceMethod(SootClass sc) {
    String cname = sc.getName();
    if (!(cname.startsWith("android") || cname.startsWith("com.android")))
        return null;
    for (SootMethod sm: sc.getMethods()) {
        if (sm.isConcrete() && sm.getName().equals(("getInstance"))) {
            Body b = sm.retrieveActiveBody();
            for (Unit u: b.getUnits()){
                Stmt s = (Stmt)u;
                if (s.containsInvokeExpr()) {
                    InvokeExpr ie = (InvokeExpr)s.getInvokeExpr();
                    String name = ie.getMethodRef().name();
                    if (name.equals("getService"))
                        return sm;
                    if (name.equals("getSystemService"))
                        return sm;
                }
            }
        }
    }
    return null;
}
 

import soot.jimple.Stmt; //导入方法依赖的package包/类
private String getNameFromGetInstance(SootMethod sm) {

        Body b = sm.retrieveActiveBody();
        for (Unit u: b.getUnits()){
            Stmt s = (Stmt)u;
            if (s.containsInvokeExpr()) {
                InvokeExpr ie = (InvokeExpr)s.getInvokeExpr();
                String name = ie.getMethodRef().name();
                if (name.equals("getService")|| name.equals("getSystemService")) {
                    List<Value> args = ie.getArgs();
                    int size = args.size();
                    Value v = args.get(size-1);
                    if (v instanceof StringConstant) {
                        StringConstant c = (StringConstant)v;
                        return c.value;
                    } else {
                        throw new RuntimeException("error: expected constant string: "+ b);
                    }

                }
            }
        }
        throw new RuntimeException("error: nothing found, expected constant string: "+ b);
    }
 

import soot.jimple.Stmt; //导入方法依赖的package包/类
/**
 * To get a service (not to be confused with getSystemService)
 * @param b
 * @return
 */
public List<Unit> hasCallToGetSystem(Body b) {
  List<Unit> calls = new ArrayList<Unit>();
  for (Unit u: b.getUnits()) {
    Stmt s = (Stmt)u;
    if (s.containsInvokeExpr()) {
      try {
      InvokeExpr ie = s.getInvokeExpr();
      String mName = ie.getMethodRef().name();
      //System.out.println("m    : "+ ie.getMethodRef());
      //System.out.println("mName: "+ mName);
                  if (mName.equals("getService") && ie.getArgs().size() > 0) {
        calls.add(u);
      }
      } catch (Throwable t) {
        continue;
      }
    }
  }
  return calls;
}
 

import soot.jimple.Stmt; //导入方法依赖的package包/类
/**
 * Checks whether the given method dynamically registers a new broadcast
 * receiver
 * 
 * @param method
 *            The method to check
 */
private void analyzeMethodForDynamicBroadcastReceiver(SootMethod method) {
	if (!method.isConcrete() || !method.hasActiveBody())
		return;
	// stmt.getInvokeExpr().getMethod().getDeclaringClass().getName().equals("android.content.Context")

	for (Unit u : method.getActiveBody().getUnits()) {
		Stmt stmt = (Stmt) u;
		if (stmt.containsInvokeExpr()) {
			if (stmt.getInvokeExpr().getMethod().getName().equals("registerReceiver")
					&& stmt.getInvokeExpr().getArgCount() > 0
					&& isInheritedMethod(stmt, "android.content.ContextWrapper", "android.content.Context")) {
				Value br = stmt.getInvokeExpr().getArg(0);
				if (br.getType() instanceof RefType) {
					RefType rt = (RefType) br.getType();
					dynamicManifestComponents.add(rt.getClassName());
				}
			}
		}
	}
}
 

import soot.jimple.Stmt; //导入方法依赖的package包/类
@Override
public boolean supportsCallee(Stmt callSite) {
	// We need an invocation expression
	if (!callSite.containsInvokeExpr())
		return false;

	SootMethod method = callSite.getInvokeExpr().getMethod();
	if (!supportsCallee(method))
		return false;
			
	// We need a method that can create a taint
	if (!aggressiveMode) {
		// Check for a cached wrap type
		final MethodWrapType wrapType = methodWrapCache.getUnchecked(method);
		if (wrapType != MethodWrapType.CreateTaint)
			return false;
	}
	
	// We need at least one non-constant argument or a tainted base
	if (callSite.getInvokeExpr() instanceof InstanceInvokeExpr)
		return true;
	for (Value val : callSite.getInvokeExpr().getArgs())
		if (!(val instanceof Constant))
			return true;
	return false;
}
 

import soot.jimple.Stmt; //导入方法依赖的package包/类
@Override
public boolean isSink(Stmt sCallSite, InterproceduralCFG<Unit, SootMethod> cfg,
		AccessPath ap) {
	// Check whether values returned by the current method are to be
	// considered as sinks
	if (this.returnTaintMethods != null
			&& sCallSite instanceof ReturnStmt
			&& this.returnTaintMethods.contains(cfg.getMethodOf(sCallSite).getSignature()))
		return true;
	
	// Check whether the callee is a sink
	if (this.sinks != null
			&& sCallSite.containsInvokeExpr()
			&& this.sinks.contains(sCallSite.getInvokeExpr().getMethod().getSignature()))
		return true;
	
	return false;
}
 

import soot.jimple.Stmt; //导入方法依赖的package包/类
public static int getOutWordCount(Collection<Unit> units) {
	int outWords = 0;
	for (Unit u : units) {
		Stmt stmt = (Stmt) u;
		if (stmt.containsInvokeExpr()) {
			int wordsForParameters = 0;
			InvokeExpr invocation = stmt.getInvokeExpr();
			List<Value> args = invocation.getArgs();
			for (Value arg : args) {
				wordsForParameters += getDexWords(arg.getType());
			}
			if (!invocation.getMethod().isStatic()) {
				wordsForParameters++; // extra word for "this"
			}
			if (wordsForParameters > outWords) {
				outWords = wordsForParameters;
			}
		}
	}
	return outWords;
}
 

import soot.jimple.Stmt; //导入方法依赖的package包/类
@Override
public Set<Object> computeArgumentValues(Argument argument, Unit callSite) {
  ArgumentValueAnalysis stringAnalysis =
      ArgumentValueManager.v().getArgumentValueAnalysis(
          Constants.DefaultArgumentTypes.Scalar.STRING);

  Stmt stmt = (Stmt) callSite;
  if (!stmt.containsInvokeExpr()) {
    throw new RuntimeException("Statement " + stmt + " does not contain an invoke expression");
  }
  InvokeExpr invokeExpr = stmt.getInvokeExpr();

  Set<Object> hosts =
      stringAnalysis.computeVariableValues(invokeExpr.getArg(argument.getArgnum()[0]), stmt);
  Set<Object> ports =
      stringAnalysis.computeVariableValues(invokeExpr.getArg(argument.getArgnum()[1]), stmt);

  Set<Object> result = new HashSet<>();
  for (Object host : hosts) {
    for (Object port : ports) {
      result.add(new DataAuthority((String) host, (String) port));
    }
  }

  return result;
}
 

import soot.jimple.Stmt; //导入方法依赖的package包/类
@Override
protected void internalTransform(Body b, String phaseName,
		Map<String, String> options) {
	// Do not instrument methods in framework classes
	if (!canInstrumentMethod(b.getMethod()))
		return;
	
	// Check for calls to DexFile.loadClass
	for (Iterator<Unit> unitIt = b.getUnits().snapshotIterator(); unitIt.hasNext(); ) {
		Stmt stmt = (Stmt) unitIt.next();
		if (stmt.hasTag(InstrumentedCodeTag.name))
			continue;
		if (!(stmt instanceof AssignStmt))
			continue;
		AssignStmt assignStmt = (AssignStmt) stmt;
		
		if (stmt.containsInvokeExpr()) {
			InvokeExpr iexpr = stmt.getInvokeExpr();
			if (iexpr.getMethod()  == methodDexFileLoadClass) {
				List<Value> args = new ArrayList<>();
				args.add(((InstanceInvokeExpr) iexpr).getBase());
				args.addAll(iexpr.getArgs());
				InvokeExpr newLoadExpr = Jimple.v().newStaticInvokeExpr(methodOwnLoader.makeRef(), args);
				b.getUnits().swapWith(stmt, Jimple.v().newAssignStmt(assignStmt.getLeftOp(), newLoadExpr));
			}
		}
	}
}
 

import soot.jimple.Stmt; //导入方法依赖的package包/类
private boolean fileFormatAvailable(int codePosID){
	Unit unit = codePositionManager.getUnitForCodePosition(codePosID);
	if(unit instanceof Stmt) {
		Stmt stmt = (Stmt)unit;
		if(stmt.containsInvokeExpr()) {
			InvokeExpr inv = stmt.getInvokeExpr();
			SootMethod sm = inv.getMethod();
			String methodSig = sm.getSignature();			

			switch(methodSig) {
				case "<android.content.Context: java.io.FileInputStream openFileInput(java.lang.String)>":  
				case "<java.io.File: void <init>(java.io.File,java.lang.String)>":
				case "<java.io.File: void <init>(java.lang.String,java.lang.String)>":
				case "<java.io.File: void <init>(java.lang.String)>":
				case "<java.io.File: void <init>(java.net.URI)>":
				case "<android.content.ContextWrapper: java.io.FileInputStream openFileInput(java.lang.String)>":
				case "<android.content.Context: java.io.File getFileStreamPath(java.lang.String)>":
				case "<android.content.Context: java.io.File getDir(java.lang.String,int)>":
				case "<android.content.Context: java.io.File getDatabasePath(java.lang.String)>":
				case "<android.content.ContextWrapper: java.io.File getFileStreamPath(java.lang.String)>":
				case "<android.content.ContextWrapper: java.io.File getDir(java.lang.String,int)>":
				case "<android.content.ContextWrapper: java.io.File getDatabasePath(java.lang.String)>":
				case "<android.database.sqlite.SQLiteDatabase: android.database.sqlite.SQLiteDatabase openOrCreateDatabase(java.io.File,android.database.sqlite.SQLiteDatabase$CursorFactory)>":
				case "<android.database.sqlite.SQLiteDatabase: android.database.sqlite.SQLiteDatabase openOrCreateDatabase(java.lang.String,android.database.sqlite.SQLiteDatabase$CursorFactory)>":
				case "<android.database.sqlite.SQLiteDatabase: android.database.sqlite.SQLiteDatabase openOrCreateDatabase(java.lang.String,android.database.sqlite.SQLiteDatabase$CursorFactory,android.database.DatabaseErrorHandler)>":
				case "<android.content.ContextWrapper: android.database.sqlite.SQLiteDatabase openOrCreateDatabase(java.lang.String,android.database.sqlite.SQLiteDatabase$CursorFactory)>":
				case "<android.content.ContextWrapper: android.database.sqlite.SQLiteDatabase openOrCreateDatabase(java.lang.String,android.database.sqlite.SQLiteDatabase$CursorFactory,android.database.DatabaseErrorHandler)>":
					return true;
				default:
					return false;
			}
		}
		else
			return false;
	}
	else
		return false;
}