[Soot-list] Cannot reach transitive methods in Call Graph

Eric Bodden bodden at st.informatik.tu-darmstadt.de
Wed Jul 27 10:18:35 EDT 2011 

Ondrej I am very sure that I have successfully used ReachableMethods
before to enumerate all methods reachable in a call graph even if the
ReachableMethods object was created after the fact. I just remember
that I had to call the update() method.

Eric

On 27 July 2011 15:57, Ondrej Lhotak <olhotak at uwaterloo.ca> wrote:
> ReachableMethods does not do what you think it does.
>
> It is a queue to which methods that are reachable in any way through the
> call graph are added as calls to them are encountered, provided that
> they have not been added before. If the call graph is already completely
> constructed, no additional methods will ever be added to a
> ReachableMethods object.
>
> I don't think there's a method that computes methods transitively
> reachable from a call site or method for you, but it should be
> quite easy to build such a search using the methods in
> soot.jimple.toolkits.callgraph.CallGraph.
>
> On Wed, Jul 27, 2011 at 02:10:59PM +0100, John Dee wrote:
>> Yep the edges are there.
>>
>> I updated the code in my class that is to be analysed to:
>>
>> public class CallGraphs
>> {
>> public static void main(String[] args) {
>> doStuff();
>> }
>> @Criteria(profile = "med")
>> public static void doStuff() {
>> StringBuilder b = new StringBuilder("Blah");
>> b.append(" Blah");
>> new A().foo();
>> }
>> }
>>
>> class A
>> {
>> int x;
>> public A() {
>> x = 19;
>> }
>>
>> public void foo() {
>> int a = bar();
>> }
>> public int bar() {
>> x++;
>> return x;
>> }
>> }
>>
>> And the output is:
>>
>> Soot started on Wed Jul 27 14:05:51 BST 2011
>> [Call Graph] For information on where the call graph may be incomplete, use the
>> verbose option to the cg phase.
>> [Call Graph] For information on where the call graph may be incomplete, use the
>> verbose option to the cg phase.
>> <testers.CallGraphs: void doStuff()> may call <java.lang.AbstractStringBuilder:
>> void <clinit>()>
>> <testers.CallGraphs: void doStuff()> may call <testers.A: void foo()>
>> <testers.CallGraphs: void doStuff()> may call <testers.A: void <init>()>
>> <testers.CallGraphs: void doStuff()> may call <java.lang.StringBuilder:
>> java.lang.StringBuilder append(java.lang.String)>
>> <testers.CallGraphs: void doStuff()> may call <java.lang.StringBuilder: void
>> <init>(java.lang.String)>
>> <testers.CallGraphs: void doStuff()> may call <java.lang.Object: void <clinit>
>> ()>
>> <testers.CallGraphs: void doStuff()> may call <java.lang.Object: void <clinit>
>> ()>
>> Num transitive methods 0
>> Transforming testers.CallGraphs...
>> Transforming testers.A...
>> Writing to sootOutput\testers\CallGraphs.class
>> Writing to sootOutput\testers\A.class
>> Soot finished on Wed Jul 27 14:06:41 BST 2011
>> Soot has run for 0 min. 49 sec.
>>
>> As you can see, the following piece of code is working ok:
>>
>> Iterator<MethodOrMethodContext> targets = new Targets(cg.edgesOutOf(src));
>> while (targets.hasNext()) {
>>     SootMethod tgt = (SootMethod)targets.next();
>>     System.out.println(src + " may call " + tgt);
>> }
>>
>> However, the following code isn't generating any results
>>
>>       ReachableMethods reachableMethods = new ReachableMethods(cg, targets);
>>       QueueReader<MethodOrMethodContext> transitiveMethods =
>>       reachableMethods.listener();
>>       reachableMethods.update();
>>       System.out.println("Num transitive methods " + reachableMethods.size());
>>       while (transitiveMethods.hasNext()) {
>>       System.out.println(src + " may reach " + ((SootMethod)
>> transitiveMethods.next()).getName());
>>       }
>>
>> Is there an option that I may be missing? Such as all-reachable?
>>
>> Thanks,
>> JD
>>
>> > From: bodden at st.informatik.tu-darmstadt.de
>> > Date: Wed, 27 Jul 2011 14:58:45 +0200
>> > Subject: Re: [Soot-list] Cannot reach transitive methods in Call Graph
>> > To: jdsoot at hotmail.com
>> > CC: soot-list at sable.mcgill.ca
>> >
>> > This looks ok to me.
>> >
>> > Are the edges present in the graph?
>> >
>> > Did you try adding code to bar()? Maybe it gets optimized away...
>> >
>> > Eric
>> >
>> > On 27 July 2011 14:50, John Dee <jdsoot at hotmail.com> wrote:
>> > > Hi there.
>> > > I the following 2 classes, which will be used for generating a call graph.
>> > > public class CallGraphs
>> > > {
>> > > public static void main(String[] args) {
>> > > doStuff();
>> > > }
>> > > @Criteria(profile = "med")
>> > > public static void doStuff() {
>> > > StringBuilder b = new StringBuilder("Blah");
>> > > b.append(" Blah");
>> > > new A().foo();
>> > > }
>> > > }
>> > > class A
>> > > {
>> > > public void foo() {
>> > > bar();
>> > > }
>> > > public void bar() {
>> > > }
>> > > }
>> > > My call graph code looks like
>> > > public class CallGraphExample
>> > > {
>> > > public static void main(String[] args) {
>> > > // create a list from args
>> > >   List<String> argsList = new ArrayList<String>(Arrays.asList(args));
>> > >
>> > >   // add on the following arguments
>> > >   argsList.addAll(Arrays.asList(new String[]{
>> > >   "-w",
>> > >   "-main-class",
>> > >   "testers.CallGraphs",
>> > >   "testers.CallGraphs",//argument classes
>> > >   "testers.A"
>> > >   }));
>> > >
>> > >   // PackManager manages the packs containing the various phases and their
>> > > options
>> > >   PackManager.v().getPack("wjtp").add(new Transform("wjtp.myTrans", new
>> > > SceneTransformer() {
>> > > @Override
>> > > protected void internalTransform(String phaseName, Map options) {
>> > >       CHATransformer.v().transform();
>> > >                SootClass a = Scene.v().getSootClass("testers.CallGraphs");
>> > >       SootMethod src = Scene.v().getMainClass().getMethodByName("doStuff");
>> > >       CallGraph cg = Scene.v().getCallGraph();
>> > >       Iterator<MethodOrMethodContext> targets = new
>> > > Targets(cg.edgesOutOf(src));
>> > >       while (targets.hasNext()) {
>> > >           SootMethod tgt = (SootMethod)targets.next();
>> > >           System.out.println(src + " may call " + tgt);
>> > >       }
>> > >       ReachableMethods reachableMethods = new ReachableMethods(cg,
>> targets);
>> > >       QueueReader<MethodOrMethodContext> transitiveMethods =
>> > >       reachableMethods.listener();
>> > >       reachableMethods.update();
>> > >       System.out.println("Num transitive methods " +
>> > > reachableMethods.size());
>> > >       while (transitiveMethods.hasNext()) {
>> > >       System.out.println(src + " may reach " +
>> > > ((SootMethod)transitiveMethods.next()).getName());
>> > >       }
>> > > }
>> > >   }));
>> > >            args = argsList.toArray(new String[0]);
>> > >            soot.Main.main(args);
>> > > }
>> > > }
>> > > The issue is that I can only see the reachable methods based on the edges
>> > > out of method 'doStuff' in class 'CallGraphs'.
>> > > I can't see the methods that are reachable transitively, which would be
>> > > method 'bar' in class A. I have added in a 'ReachableMethods'
>> > > instance based on the call graph and edges from method 'doStuff'. I then
>> > > create a QueueReader based on the reachable methods.
>> > > However, the queue is empty and also, when I print out
>> > > 'reachableMethods.size()', it is 0 for some reason. Any ideas why?
>> > > Thanks
>> > > JD
>> > >
>> > > _______________________________________________
>> > > Soot-list mailing list
>> > > Soot-list at sable.mcgill.ca
>> > > http://mailman.cs.mcgill.ca/mailman/listinfo/soot-list
>> > >
>> > >
>> >
>> >
>> >
>> > --
>> > Dr. Eric Bodden, http://bodden.de/
>> > Principal Investigator in Secure Services at CASED
>> > Coordinator of the CASED Advisory Board of Study Affairs
>> > PostDoc at Software Technology Group, Technische Universität Darmstadt
>> > Tel: +49 6151 16-5478    Fax: +49 6151 16-5410
>> > Mailing Address: S2|02 A209, Hochschulstraße 10, 64289 Darmstadt
>
>> _______________________________________________
>> Soot-list mailing list
>> Soot-list at sable.mcgill.ca
>> http://mailman.cs.mcgill.ca/mailman/listinfo/soot-list
>
>



-- 
Dr. Eric Bodden, http://bodden.de/
Principal Investigator in Secure Services at CASED
Coordinator of the CASED Advisory Board of Study Affairs
PostDoc at Software Technology Group, Technische Universität Darmstadt
Tel: +49 6151 16-5478    Fax: +49 6151 16-5410
Mailing Address: S2|02 A209, Hochschulstraße 10, 64289 Darmstadt

More information about the Soot-list mailing list