[prev in list] [next in list] [prev in thread] [next in thread]
List: soot-list
Subject: Re: [Soot-list] calls to objects instantiated through reflection not detected
From: "Steven Arzt" <Steven.Arzt () cased ! de>
Date: 2016-05-06 19:45:46
Message-ID: 005701d1a7cf$e34b5950$a9e20bf0$ () cased ! de
[Download RAW message or body]
This is a multipart message in MIME format.
[Attachment #2 (multipart/alternative)]
This is a multipart message in MIME format.
Hi Denis,
That is related to TamiFlex. You run the program and create a log of where the \
reflective calls go. Afterwards, you can use that log in your next static analysis.
Best regards,
Steven
Von: Denis Bogdanas [mailto:denis.bogdanas@gmail.com]
Gesendet: Mittwoch, 4. Mai 2016 19:46
An: Steven Arzt
Cc: soot-list@CS.McGill.CA
Betreff: Re: [Soot-list] calls to objects instantiated through reflection not \
detected
Strange,
I see there is Kind.REFL_CLASS_NEWINSTANCE
used in a few places to add edges to CG. What is it used for?
On 4 May 2016 at 09:02, Steven Arzt <Steven.Arzt@cased.de> wrote:
Hi Denis,
That is by design. Spark needs to propagate type information to the base object of a \
method call. If these base object comes from a reflective call or a factory method \
inside a phantom class, the type information is not available through the PAG \
propagation and there will not be any outgoing call edges. In that case, your best \
bet is to take the declared callee.
Best regards,
Steven
Von: soot-list-bounces@CS.McGill.CA [mailto:soot-list-bounces@CS.McGill.CA] Im \
Auftrag von Denis Bogdanas
Gesendet: Mittwoch, 4. Mai 2016 00:42
An: soot-list@CS.McGill.CA
Betreff: [Soot-list] calls to objects instantiated through reflection not detected
Hi,
Looks like Spark doesn't process the objects instantiated through reflection.
For the following code:
try {
locationManager = LocationManager.class.newInstance();
} catch (I...) { }
locationManager.addGpsStatusListener(null);
edge to addGpsStatusListener() is not in the call graph. I've looked into the support \
for reflection in soot source code, looks like at least this scenario should be \
supported.
Am I wrong somewhere?
thanks,
--
Denis
--
Denis
[Attachment #5 (text/html)]
<html xmlns:v="urn:schemas-microsoft-com:vml" \
xmlns:o="urn:schemas-microsoft-com:office:office" \
xmlns:w="urn:schemas-microsoft-com:office:word" \
xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" \
xmlns="http://www.w3.org/TR/REC-html40"><head><meta http-equiv=Content-Type \
content="text/html; charset=utf-8"><meta name=Generator content="Microsoft Word 14 \
(filtered medium)"><style><!-- /* Font Definitions */
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman","serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
p.MsoAcetate, li.MsoAcetate, div.MsoAcetate
{mso-style-priority:99;
mso-style-link:"Sprechblasentext Zchn";
margin:0cm;
margin-bottom:.0001pt;
font-size:8.0pt;
font-family:"Tahoma","sans-serif";}
span.E-MailFormatvorlage17
{mso-style-type:personal-reply;
font-family:"Calibri","sans-serif";
color:#1F497D;}
span.SprechblasentextZchn
{mso-style-name:"Sprechblasentext Zchn";
mso-style-priority:99;
mso-style-link:Sprechblasentext;
font-family:"Tahoma","sans-serif";
mso-fareast-language:DE;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri","sans-serif";
mso-fareast-language:EN-US;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:70.85pt 70.85pt 2.0cm 70.85pt;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]--></head><body lang=DE link=blue vlink=purple><div \
class=WordSection1><p class=MsoNormal><span \
style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>Hi \
Denis,<o:p></o:p></span></p><p class=MsoNormal><span \
style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'><o:p> </o:p></span></p><p \
class=MsoNormal><span lang=EN-US \
style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>That is \
related to TamiFlex. You run the program and create a log of where the reflective \
calls go. Afterwards, you can use that log in your next static \
analysis.<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US \
style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'><o:p> </o:p></span></p><p \
class=MsoNormal><span lang=EN-US \
style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>Best \
regards,<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US \
style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'> \
Steven<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US \
style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'><o:p> </o:p></span></p><p \
class=MsoNormal><b><span \
style='font-size:10.0pt;font-family:"Tahoma","sans-serif"'>Von:</span></b><span \
style='font-size:10.0pt;font-family:"Tahoma","sans-serif"'> Denis Bogdanas \
[mailto:denis.bogdanas@gmail.com] <br><b>Gesendet:</b> Mittwoch, 4. Mai 2016 \
19:46<br><b>An:</b> Steven Arzt<br><b>Cc:</b> \
soot-list@CS.McGill.CA<br><b>Betreff:</b> Re: [Soot-list] calls to objects \
instantiated through reflection not detected<o:p></o:p></span></p><p \
class=MsoNormal><o:p> </o:p></p><div><div><div><p \
class=MsoNormal>Strange,<o:p></o:p></p></div><p class=MsoNormal>I see there is <span \
style='background:#E4E4FF'>Kind</span>.<b><i><span \
style='color:#660E7A'>REFL_CLASS_NEWINSTANCE</span></i></b><o:p></o:p></p></div><p \
class=MsoNormal><br>used in a few places to add edges to CG. What is it used \
for?<o:p></o:p></p><div><p class=MsoNormal><o:p> </o:p></p><div><p \
class=MsoNormal>On 4 May 2016 at 09:02, Steven Arzt <<a \
href="mailto:Steven.Arzt@cased.de" target="_blank">Steven.Arzt@cased.de</a>> \
wrote:<o:p></o:p></p><div><div><p class=MsoNormal \
style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'><span \
style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>Hi \
Denis,</span><o:p></o:p></p><p class=MsoNormal \
style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'><span \
style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'> </span><o:p></o:p></p><p \
class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'><span \
lang=EN-US style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>That \
is by design. Spark needs to propagate type information to the base object of a \
method call. If these base object comes from a reflective call or a factory method \
inside a phantom class, the type information is not available through the PAG \
propagation and there will not be any outgoing call edges. In that case, your \
best bet is to take the declared callee.</span><o:p></o:p></p><p class=MsoNormal \
style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'><span lang=EN-US \
style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'> </span><o:p></o:p></p><p \
class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'><span \
lang=EN-US style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>Best \
regards,</span><o:p></o:p></p><p class=MsoNormal \
style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'><span lang=EN-US \
style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'> \
Steven</span><o:p></o:p></p><p class=MsoNormal \
style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'><span lang=EN-US \
style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'> </span><o:p></o:p></p><p \
class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'><b><span \
lang=EN-US style='font-size:10.0pt;font-family:"Tahoma","sans-serif"'>Von:</span></b><span \
lang=EN-US style='font-size:10.0pt;font-family:"Tahoma","sans-serif"'> <a \
href="mailto:soot-list-bounces@CS.McGill.CA" \
target="_blank">soot-list-bounces@CS.McGill.CA</a> [mailto:<a \
href="mailto:soot-list-bounces@CS.McGill.CA" \
target="_blank">soot-list-bounces@CS.McGill.CA</a>] <b>Im Auftrag von </b>Denis \
</span><span style='font-size:10.0pt;font-family:"Tahoma","sans-serif"'>Bogdanas<br><b>Gesendet:</b> \
Mittwoch, 4. Mai 2016 00:42<br><b>An:</b> <a href="mailto:soot-list@CS.McGill.CA" \
target="_blank">soot-list@CS.McGill.CA</a><br><b>Betreff:</b> [Soot-list] calls to \
objects instantiated through reflection not \
detected</span><o:p></o:p></p><div><div><p class=MsoNormal \
style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'> <o:p></o:p></p><div><div><p \
class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'>Hi,<o:p></o:p></p></div><p \
class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'>Looks like \
Spark doesn't process the objects instantiated through reflection.<br \
clear=all><o:p></o:p></p><div><div><p class=MsoNormal \
style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'> <o:p></o:p></p></div><div><p \
class=MsoNormal style='mso-margin-top-alt:auto;margin-bottom:12.0pt'>For the \
following code:<br><br>try {<br> locationManager = \
LocationManager.class.newInstance();<br>} catch (I...) { \
}<br>locationManager.addGpsStatusListener(null);<o:p></o:p></p></div><div><p \
class=MsoNormal style='mso-margin-top-alt:auto;margin-bottom:12.0pt'>edge to \
addGpsStatusListener() is not in the call graph. I've looked into the support for \
reflection in soot source code, looks like at least this scenario should be \
supported.<o:p></o:p></p></div><div><p class=MsoNormal \
style='mso-margin-top-alt:auto;margin-bottom:12.0pt'>Am I wrong \
somewhere?<o:p></o:p></p></div><div><p class=MsoNormal \
style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'>thanks,<o:p></o:p></p></div><div><p \
class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'>-- \
<o:p></o:p></p><div><div><p class=MsoNormal \
style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'>Denis<o:p></o:p></p></div></div></div></div></div></div></div></div></div></div><p \
class=MsoNormal><br><br clear=all><br>-- <o:p></o:p></p><div><div><p \
class=MsoNormal>Denis<o:p></o:p></p></div></div></div></div></div></body></html>
_______________________________________________
Soot-list mailing list
Soot-list@CS.McGill.CA
https://mailman.CS.McGill.CA/mailman/listinfo/soot-list
[prev in list] [next in list] [prev in thread] [next in thread]
Configure |
About |
News |
Add a list |
Sponsored by KoreLogic