[Soot-list] Soot not finding class without a main for call graph
Eric Ortega
eortega at pjrcorp.com
Tue Feb 2 11:26:00 EST 2021
Hi Fogo,
Yes, I meant the rest of the classes in the .jar.
It sounds like Dr. Bodden was driving to a better point, in that there likely needs to be some sort of hook into the library. If you didn’t want to create a sample app with a driver, you might have success programmatically setting a method that you’re curious about as an entrypoint through the soot API. You can likely just use setEntryPoint() as you’ve already done. It takes a list anyway so just pick some other methods in your libraries and tack them onto your main.
Regards,
Eric Ortega
From: Fogo Tunde-Onadele <oatundeo at ncsu.edu>
Date: Tuesday, February 2, 2021 at 5:15 AM
To: Eric Ortega <eortega at pjrcorp.com>
Cc: "soot-list at cs.mcgill.ca" <soot-list at cs.mcgill.ca>
Subject: Re: [Soot-list] Soot not finding class without a main for call graph
Hi Eric.
Thanks, you mean the rest of the classes contained in the jar? I also received a response from Dr. Bodden about having a driver class that instantiates my target class. I'll work on trying these out.
Thank you,
Fogo
On Mon, Feb 1, 2021 at 2:13 PM Eric Ortega <eortega at pjrcorp.com<mailto:eortega at pjrcorp.com>> wrote:
Hi Fogo,
You may want to try running through the rest of your classes and calling Scene.v().loadClass(…) for each one.
Regards,
Eric Ortega
From: Soot-list <soot-list-bounces at CS.McGill.CA<mailto:soot-list-bounces at CS.McGill.CA>> on behalf of Fogo Tunde-Onadele <oatundeo at ncsu.edu<mailto:oatundeo at ncsu.edu>>
Date: Monday, February 1, 2021 at 5:06 AM
To: "soot-list at cs.mcgill.ca<mailto:soot-list at cs.mcgill.ca>" <soot-list at cs.mcgill.ca<mailto:soot-list at cs.mcgill.ca>>
Subject: [Soot-list] Soot not finding class without a main for call graph
Good day,
I have been trying to get Soot working on analyzing the call graph of external libraries/apps. Specifically, I want to get the call graph of a class, ‘DefaultServlet’, within a Tomcat jar file, ‘catalina.jar’. First, I followed tutorials that analyze a simple class/file with a main method. However, the classes I want to analyze don’t typically have main methods. So I found and followed examples that utilize entrypoints but Soot is still unable to find the class. Please, I would appreciate some help. Here is the latest main piece of code I have tried.
```
public class IFDSDataFlowTransformer extends SceneTransformer {
static LinkedList<String> excludeList;
static String mainclass = "DefaultServlet";
static String mainmethod = "doGet"; // "doPut";
public static void main(String[] args) {
// Set Soot's internal classpath
String javapath = System.getProperty("java.class.path");
String jredir = System.getProperty("java.home")+"/lib/rt.jar";
String path = javapath+File.pathSeparator+jredir;
Options.v().set_soot_classpath(path);
// Enable whole-program mode
Options.v().set_whole_program(true);
Options.v().set_app(true);
// Call-graph options
Options.v().setPhaseOption("cg", "safe-newinstance:true");
Options.v().setPhaseOption("cg.cha","enabled:false");
// Enable SPARK call-graph construction
Options.v().setPhaseOption("cg.spark","enabled:true");
Options.v().setPhaseOption("cg.spark","verbose:true");
Options.v().setPhaseOption("cg.spark","on-fly-cg:true");
Options.v().set_allow_phantom_refs(true);
// Set the main class of the application to be analysed
Options.v().set_main_class(mainclass);
// Load the main class
SootClass c = Scene.v().loadClass(mainclass, SootClass.BODIES);
c.setApplicationClass();
// Load the "main" method of the main class and set it as a Soot entry point
// SootMethod entryPoint = c.getMethodByName("main");
SootMethod entryPoint = c.getMethodByName(mainmethod);
List<SootMethod> entryPoints = new ArrayList<SootMethod>();
entryPoints.add(entryPoint);
Scene.v().setEntryPoints(entryPoints);
PackManager.v().getPack("wjtp").add(new Transform("wjtp.herosifds", new IFDSDataFlowTransformer()));
// soot.Main.main();
//start working
PackManager.v().runPacks();
}
```
I am using Soot 3.3.1, Java 1.8 and I have exported my eclipse project in a zip below (project structure in photo). The files, IFDSDataFlowTransformer and TestSootCallGraph, start two separate trials.
Do I have to create a new class with a main that would start a request (e.g. http or curl request) to the Tomcat application? If so, that would require including more Tomcat jars/files in the project. However, I figured that Soot did not need specific inputs or all files in an application to statically analyze code.
Thank you,
Fogo
[Image removed by sender.]
--
Fogo Tunde-Onadele
PhD student
Computer Science
North Carolina State University
--
Fogo Tunde-Onadele
PhD student
Computer Science
North Carolina State University
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://mailman.CS.McGill.CA/pipermail/soot-list/attachments/20210202/de04aab4/attachment-0001.html>
More information about the Soot-list
mailing list