[Soot-list] CallGraph.edgesInto(method) returns null for methods of Interfaces and abstract classes

[Michael Osho]

Hi Team,

Our team are working on trying to get call stack traces for soot methods. We are using the CallGraph.edgesInto(SootMethod) to get all callers for the specified soot method. We notice that calling the edgesInto on abstract classes and interfaces return null (ie no callers) whereas if we use the actual subclass, it then returns the callers. See example below:

public interface Iface A {
    public void play();

}


public class Class1 implements A {
    @Override

    public void play() {
        // do something.

    }
}


public class Class2 implements A {
    @Override

    public void play() {
        // do something. else

    }}

// the play method is being used in this class
public class MainClass  {
    
    public static void main(String[] args) {
        A a = new Class1(); // notice the interface A instantiates an instance of Class1
        a.play();
    }
}

Using CallGraph.edgesInto(Scene.v().getSootClass("Class1").getMethodByName("play")) returns MainClass.main() as a caller which is expected. However using CallGraph.edgesInto(Scene.v().getSootClass("A").getMethodByName("play")) returns null.
I would expect that using the interface to reference the method will return callers for all it's subclasses (ie. callers of Class1.play() and Class2.play()). The same problem also exists with Abstract classes.

Is there any setting that makes edgesInto on interface and abstract methods return callers for their implemented or overridden methods by subclasses. If not, is there any workaround for this problem?

Many thanks
Mike. 






On Monday, July 28, 2014 12:11 PM, Michael Osho <mikosh2005 at yahoo.com> wrote:
 


Hi Marc,

Thanks for the help. With the sample scala code you gave, I was able to come up with the code  below which seems to be working,

Iterator<Edge> ite = cg.edgesInto(callee);
               while (ite.hasNext()) {
                   SootMethod caller = ite.next().src();
                   System.out.println(callee + " may be called by " + caller);
               }

The 'new Target' stuff doesn't work. I was actually trying to use the callgraph example I found in the soot tutorial but that doesn't work for edgesInto().

Many Thanks
Mike




On Friday, July 25, 2014 4:39 PM, Marc-André Laverdière <marc-andre.laverdiere-papineau at polymtl.ca> wrote:
 


Hello,

I'm not sure what you're doing with this 'new Target' business, which
doesn't help me understand the issue. My guess is that you're not using
the 'source' end of the edge, bu the 'target'

Here is how I'm doing it (in Scala)
v.edgesInto(callee).asScala.map(_.getSrc.method())

The traversal to create those paths would be a simple tail-recursive method.

But keep in mind that Spark is context-insensitive by default, so that
means that you'll have spurious paths.

If that is a problem for you, then you can consider using the geometric
PTA variant of Spark, which will give you context-sensitive results.

Regards,

Marc-André Laverdière-Papineau
Doctorant - PhD Candidate


On 07/25/2014 07:52 AM, Michael Osho wrote:
> Dear Team,
> 
> 
> 
> Good day. First of all, we would like to commend you all for your
> efforts in creating and maintaining the Soot framework. We are a team of
> students and are trying to leverage on Soot's callgraph API. What we
> would like to achieve is to get all the execution trace that leads to a
> particular method. For example:
> org.package.Class1.method1()->org.package.Class2.anotherMethod()->org.package2.Class3.targetMethod()
>
 where targetMethod() of Class3 is the target method in question and the
> above execution trace shows method calls leading to it.
> 
> We have studied the CallGraphExample tutorial and figured we should be
> able to achieve our aim using backward flow via using the
> CallGraph.edgesInto(...) method. However, the list returned always give
> a reference to itself rather than the methods that call the target
> method. See sample code below:
> 
> PackManager.v().getPack("wjtp").add(new Transform("wjtp.myTrans", new
> SceneTransformer() {
> 
>         @Override
>         protected void internalTransform(String phaseName, Map options) {
>                CHATransformer.v().transform();
>                SootMethod tgtMethod =
> Scene.v().getSootClass("org.package2.Class3").getMethodByName("targetMethod");
>                      
>                CallGraph cg = Scene.v().getCallGraph();
>                Iterator<MethodOrMethodContext> targetCallers = new
> Targets(cg.edgesInto(tgtMethod));
>                while (targetCallers.hasNext()) {
>                    SootMethod tgtCaller = (SootMethod)targetCallers.next();
>                    System.out.println(tgtMethod + " may be called by " +
> tgtCaller);
>                }
> }
> 
> The output:
> <org.package2.Class3: void targetMethod()> may be called by
>
 <org.package2.Class3: void targetMethod()>
> rather than
> <org.package2.Class3: void targetMethod()> may be called by
> <org.package.Class2: void anotherMethod()> which is expected.
> *NOTE: targetMethod() is not recursive and it is only being called in
> .anotherMethod().
> 
> Any assistance given will be highly appreciated.
> 
> Many Thanks,
> Mike.
> 
> 
> 
> 
> 
> 
> _______________________________________________
> Soot-list mailing list
> Soot-list at CS.McGill.CA
> https://mailman.CS.McGill.CA/mailman/listinfo/soot-list
> 
_______________________________________________
Soot-list mailing list
Soot-list at CS.McGill.CA
https://mailman.CS.McGill.CA/mailman/listinfo/soot-list
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://mailman.CS.McGill.CA/pipermail/soot-list/attachments/20140731/243c5d7a/attachment.html