Scene:Scene表示完整的分析环境,可以通过Scene.v()调用设置Options的API,也可以获取一些过程间分析的信息,如call graphs和points-to information(指向性分析)。如果分析的是Java工程,可以获取待分析的工程中存在哪些类。
SootClass:表示soot加载的待分析的类或者soot创建的类。如果分析的是Java源码,可以理解为SootClass对象代表Java源码中的某个类。
SootMethod:表示SootClass中的单个方法。Body:表示方法主体,由Locals链(body.getLoclas())、Units链(body.getUnits())、Traps链(body.getTraps())组成。Locals链存储方法中的变量定义、Units链存储方法中的句子、Traps链存储方法中发生异常的语句。如下代码片段:
public int bar(){ Foo r0; int i0,$i1; r0:=@this:Foo;//IdentityStmt i0:=@parameter():int;//IdentityStmt $i1=i0+21;//AssignStmt Return $i1;//ReturnStmt }
Body.getLocals()得到的链存储的内容就是:Foor0;int i0,$i1;
Body.getUnits()得到的链存储的内容就是:r0:=…;…Return$i1;
下面是Unit对象提供的一些关键API:
public List<ValueBox> getUseBoxes();//返回Unit中使用的Value的引用 public List<ValueBox> getDefBoxes();//返回Unit中定义的Value的引用 public List<ValueBox> getUseAndDefBox();//返回Unit中定义并使用的Value的引用 public List geUnitBoxes();//获得被这个unit跳转到的UnitxBox的List public List getBoxesPointingTothis();//获得该unit作为跳转对象时,所有跳转本身的UnitBox public boolean fallsThrough();//如果接下来执行后面挨着的unit,则为true public boolean branches();//如果执行时会跳转到其他别的unit,则返回true。如:IfStmt、GotoStmt public void rediectJumpsToThisTo(Unit newLocation);//该方法把跳转到该unit重定向到newLocation
注:一般Value指的是Local(变量)、Expr(表达式)、Constant(常量)。
过程内分析简单的说就是被分析的程序中不存在函数调用。
这些Pack的命名规则非常简单:第一个字母表示采用哪种中间语言,如:s表示shimple,j表示jimple,b表示baf,g表示grimp;第二个字母表示进行的pack的哪一步,如:b表示body creation,t表示transformation,o表示optimizations,a表示annotion。例如:jap表示jimple annotations pack。(注:命名规则在过程内分析、过程间分析都适用)
如上图所示:一般每种语言都有:transformation(转换)、optimizations(优化)、annotion(注释)三步。注意上图应该省略了jb(jimple bodycreation)这个阶段。
其中,在jtp和stp阶段是允许我们插入自定义的transformation(指的并不是添加jtp,而是jtp阶段中的某一步)。
PackManager.v().getPack("jtp").add(new Transform("jtp.myTransform", new BodyTransformer(){ @Override protected void internalTransform(Body b, String phaseName, Map options) { // TODO Auto-generated method stub ... } }上述代码就是在jtp pack中插入小步骤myTransform,但soot的执行流执行完自定义的myTransform后,将继续沿着执行流执行,自定义的小步骤就像soot的一个插件,并不影响其他的执行流顺序。
PackManager.v().getPack("wjtp").add( new Transform("wjtp.myTransform", new SceneTransformer() { @Override protected void internalTransform(String arg0, Map<String, String> arg1) { // TODO Auto-generated method stub ... } }));上述代码就是在wjtp pack中插入一个小步骤myTransform。 但soot的执行流执行完自定义的myTransform后,将继续沿着执行流执行,自定义的小步骤就像soot的一个插件,并不影响其他的执行流顺序。
java –cp soot-trunk.jar soot.Main -pl
java –cp soot-trunk.jar soot.Main -ph PACK
jb Creates a JimpleBody for each method jb.ls Local splitter: one local per DU-UD web jb.a Aggregator: removes some unnecessary copies jb.ule Unused local eliminator jb.tr Assigns types to locals jb.ulp Local packer: minimizes number of locals jb.lns Local name standardizer jb.cp Copy propagator jb.dae Dead assignment eliminator jb.cp-ule Post-copy propagation unused local eliminator jb.lp Local packer: minimizes number of locals jb.ne Nop eliminator jb.uce Unreachable code eliminator jb.tt Trap Tightener jj Creates a JimpleBody for each method directly from source jj.ls Local splitter: one local per DU-UD web jj.a Aggregator: removes some unnecessary copies jj.ule Unused local eliminator jj.tr Assigns types to locals jj.ulp Local packer: minimizes number of locals jj.lns Local name standardizer jj.cp Copy propagator jj.dae Dead assignment eliminator jj.cp-ule Post-copy propagation unused local eliminator jj.lp Local packer: minimizes number of locals jj.ne Nop eliminator jj.uce Unreachable code eliminator wjpp Whole Jimple Pre-processing Pack wspp Whole Shimple Pre-processing Pack cg Call graph constructor cg.cha Builds call graph using Class Hierarchy Analysis cg.spark Spark points-to analysis framework cg.paddle Paddle points-to analysis framework wstp Whole-shimple transformation pack wsop Whole-shimple optimization pack wjtp Whole-jimple transformation pack wjtp.mhp Determines what statements may be run concurrently wjtp.tn Finds critical sections, allocates locks wjtp.rdc Rename duplicated classes when the file system is not case sensitive wjop Whole-jimple optimization pack wjop.smb Static method binder: Devirtualizes monomorphic calls wjop.si Static inliner: inlines monomorphic calls wjap Whole-jimple annotation pack: adds interprocedural tags wjap.ra Rectangular array finder wjap.umt Tags all unreachable methods wjap.uft Tags all unreachable fields wjap.tqt Tags all qualifiers that could be tighter wjap.cgg Creates graphical call graph. wjap.purity Emit purity attributes shimple Sets parameters for Shimple SSA form stp Shimple transformation pack sop Shimple optimization pack sop.cpf Shimple constant propagator and folder jtp Jimple transformation pack: intraprocedural analyses added to Soot jop Jimple optimization pack (intraprocedural) jop.cse Common subexpression eliminator jop.bcm Busy code motion: unaggressive partial redundancy elimination jop.lcm Lazy code motion: aggressive partial redundancy elimination jop.cp Copy propagator jop.cpf Constant propagator and folder jop.cbf Conditional branch folder jop.dae Dead assignment eliminator jop.nce Null Check Eliminator jop.uce1 Unreachable code eliminator, pass 1 jop.ubf1 Unconditional branch folder, pass 1 jop.uce2 Unreachable code eliminator, pass 2 jop.ubf2 Unconditional branch folder, pass 2 jop.ule Unused local eliminator jap Jimple annotation pack: adds intraprocedural tags jap.npc Null pointer checker jap.npcolorer Null pointer colourer: tags references for eclipse jap.abc Array bound checker jap.profiling Instruments null pointer and array checks jap.sea Side effect tagger jap.fieldrw Field read/write tagger jap.cgtagger Call graph tagger jap.parity Parity tagger jap.pat Colour-codes method parameters that may be aliased jap.lvtagger Creates color tags for live variables jap.rdtagger Creates link tags for reaching defs jap.che Indicates whether cast checks can be eliminated jap.umt Inserts assertions into unreachable methods jap.lit Tags loop invariants jap.aet Tags statements with sets of available expressions jap.dmt Tags dominators of statement gb Creates a GrimpBody for each method gb.a1 Aggregator: removes some copies, pre-folding gb.cf Constructor folder gb.a2 Aggregator: removes some copies, post-folding gb.ule Unused local eliminator gop Grimp optimization pack bb Creates Baf bodies bb.lso Load store optimizer bb.pho Peephole optimizer bb.ule Unused local eliminator bb.lp Local packer: minimizes number of locals bop Baf optimization pack tag Tag aggregator: turns tags into attributes tag.ln Line number aggregator tag.an Array bounds and null pointer check aggregator tag.dep Dependence aggregator tag.fieldrw Field read/write aggregator db Dummy phase to store options for Dava db.transformations The Dava back-end with all its transformations db.renamer Apply heuristics based naming of local variables db.deobfuscate Apply de-obfuscation analyses db.force-recompile Try to get recompilable code.