[Soot-list] Backtracing local variable

[Eric Bodden]

Hi Jörg.

> I would like to use soot for tracing back a given Local inside a function.
> Meaning I would like to identify all Units which can effect a given local
> variable.
> I would assume this should be doable using the BackwardFlowAnalysis, but yet
> unsure how exactly.
>
> Are there any pointers or examples for such kind of (easy?) problem?

Essentially what you are looking for is called a "backwards slice".
The first question to ask here is generally whether you would like to
include in this slice only data dependencies or also control
dependencies such as:

if(p) //here myTrackedVariable is control dependent on p
  myTrackedVariable=1;

In general, if an intra-procedural analysis is good enough for you
then BackwardFlowAnalysis is the right choice. If you want to go
inter-procedural then you can either use a hand-crafted combination of
BackwardFlowAnalysis instances (one per method) or use Heros
(https://github.com/Sable/heros).

The thing you need to think about is then your abstract domain, i.e.,
what analysis information to propagate. That depends on whether you
just want to track local variables or also field and array
assignments. I am happy to give you further assistance here, but I'd
need to know more about the actual analysis problem you are trying to
solve.

Cheers,
Eric
-- 
Eric Bodden, Ph.D., http://sse.ec-spride.de/ http://bodden.de/
Head of Secure Software Engineering Group at EC SPRIDE
Tel: +49 6151 16-75422    Fax: +49 6151 16-72051
Room 3.2.14, Mornewegstr. 30, 64293 Darmstadt