All about Soot (draft)

There are three kinds of classes (these are classes analyzed by Soot, not the ones owned by Soot):

• argument class: specified explicitly in Soot cli as argument, also become application class
• application class: classes that Soot analyzes, transforms, and turns into output files
• library class: classes which are referred to, directly or indirectly, by the application classes, but which are not themselves application classes. Only used for type resolution.

Since argument classes automatically become application classes, there are inherently only two classes—application class & library class.

When you use the -app option, however, then Soot also processes all classes referenced by these classes. It will not, however, process any classes in the JDK, i.e. classes in one of the java.* and com.sun.* packages. If you wish to include those too you have to use the special –i option, e.g. -i java.

The execution of Soot is separated into several phases called packs.

The role of a pack

• b: body creation
• t: user-defined transformations. This is of special interest since it allows us to inject custom analysis.
• o: optimizations
• a: annotation (attribute generation)

Baf is

• a compact representation of bytecode
• stack-based

The common interface is soot.baf.Inst.

Available optimizations are in soot.baf.toolkits.base.

Jimple is

• typed: all local variables are typed
• stackless
• 3-address (statements reference at most 3 local variables or constants)
  • this requires linearization of some complex expressions, e.g. a*b + c*d is converted to multiple 3-address statements.

For a complete explanation of Jimple, see section Jimple.

Shimple is

• SSA-version (Static Single Assignment) of Jimple: each local variable has a single static point of definition.
  • this introduces a Phi node.

Grimp preserves new operator and complex expressions (no linearization).

Scene is a singleton class that keeps all classes which are represented by SootClass. Each SootClass may contain several methods (SootMethod) and each method may have a Body object that keeps the statements (Units).

Scene

There are two scenes:

• soot.Scene: which manages all the SootClasses being analyzed.
• soot.ModuleScene: a subclass of Scene used to analyze Java 9 modules.

Methods of soot.Scene:

• loadClassAndSupport(String className): loads the given class and all the required support classes.

• loadNecessaryClass(String name)

  protected void loadNecessaryClass(String name) {
      loadClassAndSupport(name).setApplicationClass();
  }
  

• loadNecessaryClasses(): loads the set of classes that soot needs, including those specified on the command-line. This is the standard way of initialising the list of classes soot should use.

  The classes specified in the command-line include:

  • individual classes specified in command-line. e.g. java soot.Main -cp . -pp A B, then opts.classes() returns the list {"A", "B"}.

    for (String name : opts.classes()) {
        loadNecessaryClass(name);
    }
    

  • -process-dir: all classes specified in directories

    for (String path : opts.process_dir()) {
        for (String cl : SourceLocator.v().getClassesUnder(path)) {
            SootClass theClass = loadClassAndSupport(cl);
            if (!theClass.isPhantom) {
                theClass.setApplicationClass();
            }
        }
    }
    

SootMethod

• getActiveBody() throws an exception when no active body is present. This cannot be called before PackManager.v().runPacks(); in Main.
• retrieveActiveBody() will construct an active body if none is present.

Different kinds of graphs (partial)

DirectedBodyGraph (I)
    ExceptionalGraph (I)
        CompleteUnitGraph (C)
        ExceptionalUnitGraph (C)
            CompleteUnitGraph (C)
        CompleteBlockGraph (C)
        ExceptionalBlockGraph (C)
            CompleteBlockGraph (C)
    CompleteUnitGraph (C)
    ExceptionalUnitGraph (C)
        CompleteUnitGraph (C)
    BriefUnitGraph (C)
    TrapUnitGraph (C)
    UnitGraph (C)
        ExceptionalUnitGraph (C)
            CompleteUnitGraph (C)
        BriefUnitGraph (C)
        TrapUnitGraph (C)

FieldRef 分为 InstanceFieldRef 和 StaticFieldRef

FieldRef (I)
|- InstanceFieldRef (I)
|  |- JInstanceFieldRef (C, for Jimple)
|  |- GInstanceFieldRef (C, for Grimp)
|  `- ...
|- StaticFieldRef (C)
`- ...

Labels are displayed using Printer.

A ValueBox is a pointer to some value. It can be visualized as a box containing some value.

• getValue(): dereferences the pointer
• setValue(): mutates value in the box
• A unit has both DefBox & UseBox
  • getUseBoxes() returns a list of ValueBoxes, corresponding to all Values used in the unit.
  • getDefBoxes() returns all Valuess defined in the unit.
  • For example, for unit x=y*z, there're 3 use boxes: [y*z] (an Expr), [y] (a Local), and [z] (another Local); and one def box: [x] (a Local). The brackets ([]) represent the box.

For example, the following Java code

int a = 12;
int b = 24;
int x = a * b;

is translated to

a = 12;
b = 24;
temp$0 = a * b;
x = temp$0;

The DefBox & UseBox of each statement is as follows

a = 12
  Def:
    LinkedVariableBox[JimpleLocal: a]
  Use:
    LinkedRValueBox[IntConstant: 12]

b = 24
  Def:
    LinkedVariableBox[JimpleLocal: b]
  Use:
    LinkedRValueBox[IntConstant: 24]

temp$0 = a * b
  Def:
    LinkedVariableBox[JimpleLocal: temp$0]
  Use:
    LinkedRValueBox[JMulExpr: a * b]
    ImmediateBox[JimpleLocal: a]
    ImmediateBox[JimpleLocal: b]

x = temp$0
  Def:
    LinkedVariableBox[JimpleLocal: x]
  Use:
    LinkedRValueBox[JimpleLocal: temp$0]

• Null Pointer Checker
  • jap.npc
  • jap.npcolorer
• Array Bound Checker
  • jap.abc
• Liveness Analysis
  • jap.lvtagger

Inject custom inter-procedural analyses into wjtp pack and intra-procedural analyses into jtp pack.

public class MySootMainExtension {
    public static void main(String[] args) {
        // Inject the analysis tagger into Soot
        PackManager.v().getPack("jtp")
            .add(new Transform("jpt.myanalysistagger",
                               MyAnalysisTagger.instance()));
        // Invoke soot.Main with arguments given
        Main.main(args);
    }
}