org.scandroid.flow.FlowAnalysis Maven / Gradle / Ivy
Show all versions of com.ibm.wala.scandroid Show documentation
/*
* This program and the accompanying materials
* are made available under the terms of the Eclipse Public License v1.0
* which accompanies this distribution, and is available at
* http://www.eclipse.org/legal/epl-v10.html.
*
* This file is a derivative of code released under the terms listed below.
*
*/
/*
* Copyright (c) 2009-2012,
*
* Galois, Inc. (Aaron Tomb , Rogan Creswick , Adam
* Foltzer ) Adam Fuchs Avik Chaudhuri
* Steve Suh
*
* All rights reserved.
*
*
Redistribution and use in source and binary forms, with or without modification, are permitted
* provided that the following conditions are met:
*
*
1. Redistributions of source code must retain the above copyright notice, this list of
* conditions and the following disclaimer.
*
*
2. Redistributions in binary form must reproduce the above copyright notice, this list of
* conditions and the following disclaimer in the documentation and/or other materials provided with
* the distribution.
*
*
3. The names of the contributors may not be used to endorse or promote products derived from
* this software without specific prior written permission.
*
*
THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR
* IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND
* FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR
* CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
* DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
* WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY
* WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
*/
package org.scandroid.flow;
import com.ibm.wala.core.util.CancelRuntimeException;
import com.ibm.wala.dataflow.IFDS.IFlowFunctionMap;
import com.ibm.wala.dataflow.IFDS.IMergeFunction;
import com.ibm.wala.dataflow.IFDS.ISupergraph;
import com.ibm.wala.dataflow.IFDS.PathEdge;
import com.ibm.wala.dataflow.IFDS.TabulationDomain;
import com.ibm.wala.dataflow.IFDS.TabulationProblem;
import com.ibm.wala.dataflow.IFDS.TabulationResult;
import com.ibm.wala.dataflow.IFDS.TabulationSolver;
import com.ibm.wala.ipa.callgraph.CGNode;
import com.ibm.wala.ipa.callgraph.CallGraph;
import com.ibm.wala.ipa.callgraph.propagation.InstanceKey;
import com.ibm.wala.ipa.callgraph.propagation.PointerAnalysis;
import com.ibm.wala.ipa.cfg.BasicBlockInContext;
import com.ibm.wala.ssa.ISSABasicBlock;
import com.ibm.wala.util.CancelException;
import java.util.ArrayList;
import java.util.Collection;
import java.util.List;
import java.util.Map;
import java.util.Set;
import org.scandroid.domain.CodeElement;
import org.scandroid.domain.DomainElement;
import org.scandroid.domain.IFDSTaintDomain;
import org.scandroid.flow.functions.TaintTransferFunctions;
import org.scandroid.flow.types.FlowType;
import org.scandroid.util.CGAnalysisContext;
public class FlowAnalysis {
public static
TabulationResult, CGNode, DomainElement> analyze(
final CGAnalysisContext analysisContext,
Map, Map, Set>> initialTaints,
IFDSTaintDomain d)
throws CancelRuntimeException {
return analyze(analysisContext.graph, analysisContext.cg, analysisContext.pa, initialTaints, d);
}
public static
TabulationResult, CGNode, DomainElement> analyze(
final CGAnalysisContext analysisContext,
Map, Map, Set>> initialTaints,
IFDSTaintDomain d,
IFlowFunctionMap> flowFunctionMap)
throws CancelRuntimeException {
return analyze(analysisContext.graph, analysisContext.cg, initialTaints, d, flowFunctionMap);
}
public static
TabulationResult, CGNode, DomainElement> analyze(
final ISupergraph, CGNode> graph,
CallGraph cg,
PointerAnalysis pa,
Map, Map, Set>> initialTaints,
IFDSTaintDomain d) {
return analyze(graph, cg, initialTaints, d, new TaintTransferFunctions<>(d, pa));
// return analyze(graph, cg, pa, initialTaints, d,
// progressMonitor, new IDTransferFunctions(d, graph, pa));
// return analyze(graph, cg, pa, initialTaints, d,
// progressMonitor, new IFDSTaintFlowFunctionProvider(d, graph, pa));
}
public static
TabulationResult, CGNode, DomainElement> analyze(
final ISupergraph, CGNode> graph,
CallGraph cg,
Map, Map, Set>> initialTaints,
IFDSTaintDomain d,
final IFlowFunctionMap> flowFunctionMap) {
final IFDSTaintDomain domain = d;
final List>> initialEdges = new ArrayList<>();
// Add PathEdges to the taints
// Places that initial taints occur, and where they initially flow into
for (Map.Entry, Map, Set>> bbEntry :
initialTaints.entrySet()) {
Map, Set> bbTaints = bbEntry.getValue();
for (Map.Entry, Set> flowEntry : bbTaints.entrySet()) {
for (CodeElement taintElement : flowEntry.getValue()) {
final BasicBlockInContext taintBB = bbEntry.getKey();
BasicBlockInContext[] entryBlocks = graph.getEntriesForProcedure(taintBB.getNode());
for (BasicBlockInContext entryBlock : entryBlocks) {
// Add PathEdge ->
initialEdges.add(
PathEdge.createPathEdge(
entryBlock,
0,
taintBB,
domain.getMappedIndex(new DomainElement(taintElement, flowEntry.getKey()))));
}
// initialEdges.add(PathEdge.createPathEdge(e.getKey(), 0, e.getKey(),
// domain.getMappedIndex(new DomainElement(o,e2.getKey()))));
}
}
}
// Add PathEdges to the entry points of the supergraph ->
for (CGNode entry : cg.getEntrypointNodes()) {
BasicBlockInContext[] bbic = graph.getEntriesForProcedure(entry);
for (BasicBlockInContext element : bbic)
initialEdges.add(PathEdge.createPathEdge(element, 0, element, 0));
}
final TabulationProblem, CGNode, DomainElement> problem =
new TabulationProblem<>() {
@Override
public TabulationDomain> getDomain() {
return domain;
}
@Override
public IFlowFunctionMap> getFunctionMap() {
return flowFunctionMap;
}
@Override
public IMergeFunction getMergeFunction() {
return null;
}
@Override
public ISupergraph, CGNode> getSupergraph() {
return graph;
}
@Override
public Collection>> initialSeeds() {
return initialEdges;
// CGNode entryProc = cfg.getCallGraph().getEntrypointNodes()
// .iterator().next();
// BasicBlockInContext entryBlock = cfg
// .getEntry(entryProc);
// for (int i = 0; i < entryProc.getIR().getNumberOfParameters(); i++) {
// list.add(PathEdge.createPathEdge(entryBlock, 0, entryBlock,
// domain.getMappedIndex(new LocalElement(i + 1))));
// }
// return list;
}
};
TabulationSolver, CGNode, DomainElement> solver =
TabulationSolver.make(
problem
// , progressMonitor
);
try {
TabulationResult, CGNode, DomainElement> flowResult = solver.solve();
// if (options.ifdsExplorer()) {
// for (int i = 1; i < domain.getSize(); i++) {
//
// }
// GraphUtil.exploreIFDS(flowResult);
// }
return flowResult;
} catch (CancelException e) {
throw new CancelRuntimeException(e);
}
}
}