soot.jimple.infoflow

类 Infoflow

java.lang.Object

soot.jimple.infoflow.AbstractInfoflow

soot.jimple.infoflow.Infoflow

所有已实现的接口:

IInfoflow, ITaintWrapperDataFlowAnalysis

public class Infoflow
extends AbstractInfoflow

main infoflow class which triggers the analysis and offers method to customize it.

字段概要

字段

限定符和类型	字段和说明
protected Collection<soot.SootMethod>	additionalEntryPointMethods
protected TaintPropagationHandler	backwardsPropagationHandler
protected Set<soot.jimple.Stmt>	collectedSinks
protected Set<soot.jimple.Stmt>	collectedSources
protected soot.SootMethod	dummyMainMethod
protected IExecutorFactory	executorFactory
protected InfoflowManager	manager
protected IMemoryManagerFactory	memoryManagerFactory
protected FlowDroidMemoryWatcher	memoryWatcher
protected Set<ResultsAvailableHandler>	onResultsAvailable
protected InfoflowResults	results
protected IPropagationRuleManagerFactory	ruleManagerFactory
protected SolverPeerGroup	solverPeerGroup
protected TaintPropagationHandler	taintPropagationHandler

从类继承的字段 soot.jimple.infoflow.AbstractInfoflow

androidPath, config, forceAndroidJar, hierarchy, icfgFactory, ipcManager, nativeCallHandler, pathBuilderFactory, postProcessors, preProcessors, sootConfig, taintWrapper

构造器概要

构造器

构造器和说明
Infoflow() Creates a new instance of the InfoFlow class for analyzing plain Java code without any references to APKs or the Android SDK.
Infoflow(String androidPath, boolean forceAndroidJar) Creates a new instance of the Infoflow class for analyzing Android APK files.
Infoflow(String androidPath, boolean forceAndroidJar, BiDirICFGFactory icfgFactory) Creates a new instance of the Infoflow class for analyzing Android APK files.

方法概要

限定符和类型	方法和说明
void	abortAnalysis() Aborts the data flow analysis.
void	addResultsAvailableHandler(ResultsAvailableHandler handler) Adds a handler that is called when information flow results are available
void	computeInfoflow(String appPath, String libPath, IEntryPointCreator entryPointCreator, ISourceSinkManager sourcesSinks) Computes the information flow on a list of entry point methods.
void	computeInfoflow(String appPath, String libPath, String entryPoint, ISourceSinkManager sourcesSinks) Computes the information flow on a single method.
protected Aliasing	createAliasController(IAliasingStrategy aliasingStrategy) Creates the controller object that handles aliasing operations.
protected IInfoflowSolver	createDataFlowSolver(InterruptableExecutor executor, AbstractInfoflowProblem problem, InfoflowConfiguration.SolverConfiguration solverConfig) Creates the instance of the data flow solver
protected IAbstractionPathBuilder	createPathBuilder(InterruptableExecutor executor) Creates the path builder that shall be used for path reconstruction
protected InfoflowPerformanceData	createPerformanceDataClass() Factory method for creating the data object that will receive the data flow solver's performance data
protected void	eliminateDeadCode(ISourceSinkManager sourcesSinks) Runs all code optimizers
Set<soot.jimple.Stmt>	getCollectedSinks() Gets the concrete set of sinks that have been collected in preparation for the taint analysis.
Set<soot.jimple.Stmt>	getCollectedSources() Gets the concrete set of sources that have been collected in preparation for the taint analysis.
protected Collection<soot.SootMethod>	getMethodsForSeeds(IInfoflowCFG icfg)
InfoflowResults	getResults() getResults returns the results found by the analysis
protected InfoflowManager	initializeInfoflowManager(ISourceSinkManager sourcesSinks, IInfoflowCFG iCfg, GlobalTaintManager globalTaintManager) Initializes the data flow manager with which propagation rules can interact with the data flow engine
boolean	isResultAvailable() A result is available if the analysis has finished - so if this method returns false the analysis has not finished yet or was not started (e.g. no sources or sinks found)
protected boolean	isUserCodeClass(String className) Checks whether the given class is user code and should not be filtered out.
protected boolean	isValidSeedMethod(soot.SootMethod sm) Gets whether the given method is a valid seen when scanning for sources and sinks.
protected void	onBeforeTaintPropagation(IInfoflowSolver forwardSolver, IInfoflowSolver backwardSolver) Callback that is invoked when the main taint propagation is about to start
protected void	onTaintPropagationCompleted(IInfoflowSolver forwardSolver, IInfoflowSolver backwardSolver) Callback that is invoked when the main taint propagation has completed.
void	removeResultsAvailableHandler(ResultsAvailableHandler handler) Removes a handler that is called when information flow results are available
protected void	runAnalysis(ISourceSinkManager sourcesSinks) Conducts a taint analysis on an already initialized callgraph
void	setBackwardsPropagationHandler(TaintPropagationHandler handler) Sets a handler which is invoked whenever an alias is propagated backwards
void	setExecutorFactory(IExecutorFactory executorFactory) Sets the factory to be used for creating thread pool executors
void	setMemoryManagerFactory(IMemoryManagerFactory factory) Sets the factory to be used for creating memory managers
void	setPropagationRuleManagerFactory(IPropagationRuleManagerFactory ruleManagerFactory) Sets the factory to be used for creating the propagation rule manager, which can then add features to the core data flow engine
void	setTaintPropagationHandler(TaintPropagationHandler handler) Sets a handler which is invoked whenever a taint is propagated
void	setThrowExceptions(boolean b)

从类继承的方法 soot.jimple.infoflow.AbstractInfoflow

computeInfoflow, computeInfoflow, computeInfoflow, constructCallgraph, getConfig, getLibraryClassPatcher, getTaintWrapper, initializeSoot, initializeSoot, setConfig, setGeomPtaSpecificOptions, setIPCManager, setNativeCallHandler, setPathBuilderFactory, setPostProcessors, setPreProcessors, setSootConfig, setSourcePrec, setTaintWrapper

从类继承的方法 java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

字段详细资料

results

protected InfoflowResults results

manager

protected InfoflowManager manager

onResultsAvailable

protected Set<ResultsAvailableHandler> onResultsAvailable

taintPropagationHandler

protected TaintPropagationHandler taintPropagationHandler

backwardsPropagationHandler

protected TaintPropagationHandler backwardsPropagationHandler

memoryManagerFactory

protected IMemoryManagerFactory memoryManagerFactory

executorFactory

protected IExecutorFactory executorFactory

ruleManagerFactory

protected IPropagationRuleManagerFactory ruleManagerFactory

memoryWatcher

protected FlowDroidMemoryWatcher memoryWatcher

collectedSources

protected Set<soot.jimple.Stmt> collectedSources

collectedSinks

protected Set<soot.jimple.Stmt> collectedSinks

dummyMainMethod

protected soot.SootMethod dummyMainMethod

additionalEntryPointMethods

protected Collection<soot.SootMethod> additionalEntryPointMethods

solverPeerGroup

protected SolverPeerGroup solverPeerGroup

构造器详细资料

Infoflow

public Infoflow()

Creates a new instance of the InfoFlow class for analyzing plain Java code without any references to APKs or the Android SDK.

Infoflow

public Infoflow(String androidPath,
                boolean forceAndroidJar)

Creates a new instance of the Infoflow class for analyzing Android APK files.

参数:

androidPath - If forceAndroidJar is false, this is the base directory of the platform files in the Android SDK. If forceAndroidJar is true, this is the full path of a single android.jar file.

forceAndroidJar - True if a single platform JAR file shall be forced, false if Soot shall pick the appropriate platform version

Infoflow

public Infoflow(String androidPath,
                boolean forceAndroidJar,
                BiDirICFGFactory icfgFactory)

Creates a new instance of the Infoflow class for analyzing Android APK files.

参数:

androidPath - If forceAndroidJar is false, this is the base directory of the platform files in the Android SDK. If forceAndroidJar is true, this is the full path of a single android.jar file.

forceAndroidJar - True if a single platform JAR file shall be forced, false if Soot shall pick the appropriate platform version

icfgFactory - The interprocedural CFG to be used by the InfoFlowProblem

方法详细资料

computeInfoflow

public void computeInfoflow(String appPath,
                            String libPath,
                            IEntryPointCreator entryPointCreator,
                            ISourceSinkManager sourcesSinks)

从接口复制的说明: IInfoflow

Computes the information flow on a list of entry point methods. This list is used to construct an artificial main method following the Android life cycle for all methods that are detected to be part of Android's application infrastructure (e.g. android.app.Activity.onCreate)

参数:

appPath - The path containing the client program's files

libPath - the path to the main folder of the (unpacked) library class files

entryPointCreator - the entry point creator to use for generating the dummy main method

sourcesSinks - manager class for identifying sources and sinks in the source code

computeInfoflow

public void computeInfoflow(String appPath,
                            String libPath,
                            String entryPoint,
                            ISourceSinkManager sourcesSinks)

从接口复制的说明: IInfoflow

Computes the information flow on a single method. This method is directly taken as the entry point into the program, even if it is an instance method.

参数:

appPath - The path containing the client program's files

libPath - the path to the main folder of the (unpacked) library class files

entryPoint - the main method to analyze

sourcesSinks - manager class for identifying sources and sinks in the source code

runAnalysis

protected void runAnalysis(ISourceSinkManager sourcesSinks)

Conducts a taint analysis on an already initialized callgraph

参数:

sourcesSinks - The sources and sinks to be used

createPathBuilder

protected IAbstractionPathBuilder createPathBuilder(InterruptableExecutor executor)

Creates the path builder that shall be used for path reconstruction

参数:

executor - The execute in which to run the parallel path reconstruction tasks

返回:

The path builder implementation

createPerformanceDataClass

protected InfoflowPerformanceData createPerformanceDataClass()

Factory method for creating the data object that will receive the data flow solver's performance data

返回:

The data object for the performance data

createAliasController

protected Aliasing createAliasController(IAliasingStrategy aliasingStrategy)

Creates the controller object that handles aliasing operations. Derived classes can override this method to supply custom aliasing implementations.

参数:

aliasingStrategy - The aliasing strategy to use

返回:

The new alias controller object

onBeforeTaintPropagation

protected void onBeforeTaintPropagation(IInfoflowSolver forwardSolver,
                                        IInfoflowSolver backwardSolver)

Callback that is invoked when the main taint propagation is about to start

参数:

forwardSolver - The forward data flow solver

backwardSolver - The backward data flow solver

onTaintPropagationCompleted

protected void onTaintPropagationCompleted(IInfoflowSolver forwardSolver,
                                           IInfoflowSolver backwardSolver)

Callback that is invoked when the main taint propagation has completed. This method is called before memory cleanup happens.

参数:

forwardSolver - The forward data flow solver

backwardSolver - The backward data flow solver

initializeInfoflowManager

protected InfoflowManager initializeInfoflowManager(ISourceSinkManager sourcesSinks,
                                                    IInfoflowCFG iCfg,
                                                    GlobalTaintManager globalTaintManager)

Initializes the data flow manager with which propagation rules can interact with the data flow engine

参数:

sourcesSinks - The source/sink definitions

iCfg - The interprocedural control flow graph

globalTaintManager - The manager object for storing and processing global taints

返回:

The data flow manager

createDataFlowSolver

protected IInfoflowSolver createDataFlowSolver(InterruptableExecutor executor,
                                               AbstractInfoflowProblem problem,
                                               InfoflowConfiguration.SolverConfiguration solverConfig)

Creates the instance of the data flow solver

参数:

executor - The executor on which the solver shall run its tasks

problem - The problem to be solved by the new solver

solverConfig - The solver configuration

返回:

The new data flow solver

eliminateDeadCode

protected void eliminateDeadCode(ISourceSinkManager sourcesSinks)

Runs all code optimizers

参数:

sourcesSinks - The SourceSinkManager

getMethodsForSeeds

protected Collection<soot.SootMethod> getMethodsForSeeds(IInfoflowCFG icfg)

isValidSeedMethod

protected boolean isValidSeedMethod(soot.SootMethod sm)

Gets whether the given method is a valid seen when scanning for sources and sinks. A method is a valid seed it it (or one of its transitive callees) can contain calls to source or sink methods.

参数:

sm - The method to check

返回:

True if this method or one of its transitive callees can contain sources or sinks, otherwise false

isUserCodeClass

protected boolean isUserCodeClass(String className)

Checks whether the given class is user code and should not be filtered out. By default, this method assumes that all code is potentially user code.

参数:

className - The name of the class to check

返回:

True if the given class is user code, false otherwise

getResults

public InfoflowResults getResults()

从接口复制的说明: IInfoflow

getResults returns the results found by the analysis

返回:

the results

isResultAvailable

public boolean isResultAvailable()

从接口复制的说明: IInfoflow

A result is available if the analysis has finished - so if this method returns false the analysis has not finished yet or was not started (e.g. no sources or sinks found)

返回:

boolean that states if a result is available

addResultsAvailableHandler

public void addResultsAvailableHandler(ResultsAvailableHandler handler)

从接口复制的说明: IInfoflow

Adds a handler that is called when information flow results are available

参数:

handler - The handler to add

setTaintPropagationHandler

public void setTaintPropagationHandler(TaintPropagationHandler handler)

从接口复制的说明: IInfoflow

Sets a handler which is invoked whenever a taint is propagated

参数:

handler - The handler to be invoked when propagating taints

setBackwardsPropagationHandler

public void setBackwardsPropagationHandler(TaintPropagationHandler handler)

从接口复制的说明: IInfoflow

Sets a handler which is invoked whenever an alias is propagated backwards

参数:

handler - The handler to be invoked when propagating aliases

removeResultsAvailableHandler

public void removeResultsAvailableHandler(ResultsAvailableHandler handler)

从接口复制的说明: IInfoflow

Removes a handler that is called when information flow results are available

参数:

handler - The handler to remove

getCollectedSources

public Set<soot.jimple.Stmt> getCollectedSources()

从接口复制的说明: IInfoflow

Gets the concrete set of sources that have been collected in preparation for the taint analysis. This method will return null if source and sink logging has not been enabled (see InfoflowConfiguration. setLogSourcesAndSinks()),

返回:

The set of sources collected for taint analysis

getCollectedSinks

public Set<soot.jimple.Stmt> getCollectedSinks()

从接口复制的说明: IInfoflow

Gets the concrete set of sinks that have been collected in preparation for the taint analysis. This method will return null if source and sink logging has not been enabled (see InfoflowConfiguration. setLogSourcesAndSinks()),

返回:

The set of sinks collected for taint analysis

setMemoryManagerFactory

public void setMemoryManagerFactory(IMemoryManagerFactory factory)

从接口复制的说明: IInfoflow

Sets the factory to be used for creating memory managers

参数:

factory - The memory manager factory to use

setExecutorFactory

public void setExecutorFactory(IExecutorFactory executorFactory)

从接口复制的说明: IInfoflow

Sets the factory to be used for creating thread pool executors

参数:

executorFactory - The executor factory to use

setPropagationRuleManagerFactory

public void setPropagationRuleManagerFactory(IPropagationRuleManagerFactory ruleManagerFactory)

从接口复制的说明: IInfoflow

Sets the factory to be used for creating the propagation rule manager, which can then add features to the core data flow engine

参数:

ruleManagerFactory - The factory class for the propagation rule manager

abortAnalysis

public void abortAnalysis()

从接口复制的说明: IInfoflow

Aborts the data flow analysis. This is useful when the analysis controller is running in a different thread and the main thread (e.g., a GUI) wants to abort the analysis

setThrowExceptions

public void setThrowExceptions(boolean b)