[Soot-list] Question

[Marc-Andre Laverdiere-Papineau]

Hello,

I am replying to the mailing list, since I think it is going to be 
useful for many many people (and that the wiser folks can point out 
mistakes in what I said).

I am writing this as someone who hasn't implemented that (yet), so 
looking at it from the theory side.

Def-use chains are not strictly required to do what you want, although 
they do contain that information.
http://en.wikipedia.org/wiki/Use-define_chain

I am not too cognizant on the implementation details here - is soot 
generating those for 'free'?

But if you are trying to do a taint analysis, I am not sure that 
following the def-use chains is the best way to go about it. The problem 
is that you're more or less compensating for using a flow analysis that 
isn't specific to your needs by doing a tree search.


Marc-André Laverdière-Papineau
Doctorant - PhD Candidate

On 13-01-14 02:50 PM, Zeinab Lashkaripour wrote:
> Sorry Marc-Andre,
> I forgot to ask: I get from your reply that either def-use or use-def
> are needed. Am I right?
>
> Best Regards,
>
>
> ----- Original Message -----
> From: Marc-Andre Laverdiere-Papineau
> <marc-andre.laverdiere-papineau at polymtl.ca>
> To: soot-list at sable.mcgill.ca
> Cc:
> Sent: Monday, January 14, 2013 11:09 PM
> Subject: Re: [Soot-list] Question
>
> Hello Zeinab,
>
> I am not sure if I am understanding your question properly. My first
> impression is that you are looking for Reaching Definitions - a
> classical intraprocedural analysis.
>
> You can read more here:
> http://en.wikipedia.org/wiki/Reaching_definitions
> Note that the confluence operator is an union - meaning that the
> information from the different paths are added together.
>
> I did a quick git grep in the code, and it looks like that analysis is
> already there in Dava:
> src/soot/dava/toolkits/base/AST/structuredAnalysis/ReachingDefs.java
>
> I don't know if that implementation is suitable for your needs or too
> dava-specific - anybody knows?
>
> Regards,
>
>
> Marc-André Laverdière-Papineau
> Doctorant - PhD Candidate
>
> On 13-01-14 01:50 PM, Zeinab Lashkaripour wrote:
>  > Dear Reader,
>  >
>  > I am doing the following analysis:
>  > I am looking for special function calls to see what variable they have
>  > used in order to track the value that the variable has taken before the
>  > call which can be a simple assignment with out any branch or assignments
>  > inside different kinds of branch. Up to now with the information I have
>  > I think reaching definitions (def-use chain) is the suitable choice.
>  > Due to your experience I wanted to ask you. Is it right?
>  >
>  > Best Regards,
>  >
>  >
>  >
>  > _______________________________________________
>  > Soot-list mailing list
>  > Soot-list at sable.mcgill.ca <mailto:Soot-list at sable.mcgill.ca>
>  > http://mailman.cs.mcgill.ca/mailman/listinfo/soot-list
>  >
> _______________________________________________
> Soot-list mailing list
> Soot-list at sable.mcgill.ca <mailto:Soot-list at sable.mcgill.ca>
> http://mailman.cs.mcgill.ca/mailman/listinfo/soot-list