Repository files navigation

This repository contains (will contain) several simple examples of static program analysis in Java usingSoot.

Anybody who knows Java programming and wants to do some static analysis in practice but does not know anything about Soot and static analysis in theory.

If you have some prior knowledge about static program analysis I suggest you learn Soot fromhere.

In short, use Java 8 and run./gradlew build. For more information and Docker setup, follow thislink.

In this chapter, you will visit a very simple code example to be familiar with Soot essential data structures andJimple, Soot's principle intermediate representation.

• ./gradlew run --args="HelloSoot": The Jimple representation of theprintFizzBuzz method alongside the branch statement.
• ./gradlew run --args="HelloSoot draw": The visualization of theprintFizzBuzz control-flow graph.

In this chapter, you get familiar with some basic but useful methods in Soot to help read, analyze, and even update java code.

• ./gradlew run --args="BasicAPI": Analyze the classCircle.
• ./gradlew run --args="BasicAPI draw": Analyze the classCircle and draws the call graph.

In this chapter, you learn how to insert code into Android apps (without having their source code) using Soot. To run the code, you need Android SDK (check thislink).

• ./gradlew run --args="AndroidLogger": Insert logging method calls at the beginning of APK methods ofNumix Calculator.
• ./gradlew run --args="AndroidClassInjector": Create a new class from scratch and inject it to theNumix Calculator.

The instrumented APK is located indemo/Android/Instrumented. You need to sign it in order to install on an Android device:

cd ./demo/Android# on Windows, replace 'sign.sh' by 'sign.ps1'./sign.sh Instrumented/calc.apk key"android"adb install -r -t Instrumented/calc.apk

To see the logs, runadb logcat | grep -e "<SOOT_TUTORIAL>"

This chapter gives you a brief overview o call graphs and PointsTo analysis in Android and you learn how to create calls graphs using FlowDroid. The source code of the example code ishere. To run the code, you need Android SDK (check thislink).

• ./gradlew run --args="AndroidCallGraph <CG_Algorithm> (draw)": Create the call graph ofSootTutorial Demo App using<CG_Algorithm> algorithm and print information such as reachable methods or the number of edges.
  • <CG_Algorithm> can beSPARK orCHA
  • draw argument is optional, if provided a visualization of call graph will shown.
  • For example,./gradlew run --args="AndroidCallGraph SPARK draw" visualizes the call graph generated by SPARK algorithm.
• ./gradlew run --args="AndroidPTA": Perform PointsTo and Alias Analysis onSootTutorial Demo App using FlowDroid.

• ./gradlew run --args="UsageFinder 'void println(java.lang.String)' 'java.io.PrintStream": Find usages of the method with the given subsignature in all methods ofUsageExample.java.
• ./gradlew run --args="UsageFinder 'void println(java.lang.String)' 'java.io.PrintStream": Find usages of the method with the given subsignature of the given class signature in all methods ofUsageExample.java.