/** * the operations that are not relevant for analysis like "not" or casts * are removed - array refs are only removed if explicitly stated * @param val the value which should be pruned * @param keepArrayRef if false then array refs are pruned to the base array object * @return the value (possibly pruned to base object) */ //we want to keep ArrayRef for objects on the right side of the assignment public static Value selectBase(Value val, boolean keepArrayRef){ //we taint base of array instead of array elements if (val instanceof ArrayRef && !keepArrayRef) { return selectBase(((ArrayRef) val).getBase(), keepArrayRef); } if (val instanceof CastExpr) { return selectBase(((CastExpr) val).getOp(), keepArrayRef); } // Check for unary operators like "not" or "length" if (val instanceof UnopExpr) return selectBase(((UnopExpr) val).getOp(), keepArrayRef); return val; }
public void jimplify (DexBody body) { if(!(instruction instanceof Instruction12x)) throw new IllegalArgumentException("Expected Instruction12x but got: "+instruction.getClass()); Instruction12x cmpInstr = (Instruction12x)instruction; int dest = cmpInstr.getRegisterA(); Local source = body.getRegisterLocal(cmpInstr.getRegisterB()); Value expr = getExpression(source); assign = Jimple.v().newAssignStmt(body.getRegisterLocal(dest), expr); setUnit(assign); addTags(assign); body.add(assign); if (IDalvikTyper.ENABLE_DVKTYPER) { Debug.printDbg(IDalvikTyper.DEBUG, "constraint: "+ assign); int op = (int)instruction.getOpcode().value; //DalvikTyper.v().captureAssign((JAssignStmt)assign, op); JAssignStmt jass = (JAssignStmt)assign; DalvikTyper.v().setType((expr instanceof JCastExpr) ? ((JCastExpr) expr).getOpBox() : ((UnopExpr) expr).getOpBox(), opUnType[op - 0x7b], true); DalvikTyper.v().setType(jass.leftBox, resUnType[op - 0x7b], false); } }
private void javafy_expr(ValueBox vb) { Expr e = (Expr) vb.getValue(); if (e instanceof BinopExpr) javafy_binop_expr(vb); else if (e instanceof UnopExpr) javafy_unop_expr(vb); else if (e instanceof CastExpr) javafy_cast_expr(vb); else if (e instanceof NewArrayExpr) javafy_newarray_expr(vb); else if (e instanceof NewMultiArrayExpr) javafy_newmultiarray_expr(vb); else if (e instanceof InstanceOfExpr) javafy_instanceof_expr(vb); else if (e instanceof InvokeExpr) javafy_invoke_expr(vb); else if (e instanceof NewExpr) javafy_new_expr(vb); }
/** * the operations that are not relevant for analysis like "not" or casts * are removed - array refs are only removed if explicitly stated * @param val the value which should be pruned * @param keepArrayRef if false then array refs are pruned to the base array object * @return the value (possibly pruned to base object) */ //we want to keep ArrayRef for objects on the right side of the assignment public static Value selectBase(Value val, boolean keepArrayRef){ //we taint base of array instead of array elements if (val instanceof ArrayRef && !keepArrayRef) { return selectBase(((ArrayRef) val).getBase(), keepArrayRef); } if (val instanceof JCastExpr) { return selectBase(((JCastExpr) val).getOpBox().getValue(), keepArrayRef); } // Check for unary operators like "not" or "length" if (val instanceof UnopExpr) return selectBase(((UnopExpr) val).getOp(), keepArrayRef); return val; }
public void outAUnopExpr(AUnopExpr node) { Value v = (Value) mProductions.removeLast(); UnopExpr expr = (UnopExpr) mProductions.removeLast(); expr.setOp(v); mProductions.addLast(expr); }
private void javafy_unop_expr(ValueBox vb) { UnopExpr uoe = (UnopExpr) vb.getValue(); javafy(uoe.getOpBox()); if (uoe instanceof LengthExpr) vb.setValue(new DLengthExpr(((LengthExpr) uoe).getOp())); else if (uoe instanceof NegExpr) vb.setValue(new DNegExpr(((NegExpr) uoe).getOp())); }
private void convertUnopInsn(InsnNode insn) { int op = insn.getOpcode(); boolean dword = op == LNEG || op == DNEG; StackFrame frame = getFrame(insn); Operand[] out = frame.out(); Operand opr; if (out == null) { Operand op1 = dword ? popImmediateDual() : popImmediate(); Value v1 = op1.stackOrValue(); UnopExpr unop; if (op >= INEG && op <= DNEG) unop = Jimple.v().newNegExpr(v1); else if (op == ARRAYLENGTH) unop = Jimple.v().newLengthExpr(v1); else throw new AssertionError("Unknown unop: " + op); op1.addBox(unop.getOpBox()); opr = new Operand(insn, unop); frame.in(op1); frame.boxes(unop.getOpBox()); frame.out(opr); } else { opr = out[0]; frame.mergeIn(dword ? popDual() : pop()); } if (dword) pushDual(opr); else push(opr); }
private Sign signOf(Value value, Map<Local, Sign> dfv) { if (value instanceof Local) { // if the value is a local variable, then look-up the data-flow map Local local = (Local) value; if (dfv.containsKey(local)) { return dfv.get(local); } else { return Sign.TOP; } } else if (value instanceof NumericConstant) { // If the value is a constant, we can get a definite sign NumericConstant num = (NumericConstant) value; NumericConstant zero = IntConstant.v(0); NumericConstant one = IntConstant.v(1); if (num.lessThan(zero).equals(one)) { return NEGATIVE; } else if (num.greaterThan(zero).equals(one)) { return POSITIVE; } else { return ZERO; } } else if (value instanceof BinopExpr) { BinopExpr expr = (BinopExpr) value; Value op1 = expr.getOp1(); Value op2 = expr.getOp2(); Sign sign1 = signOf(op1, dfv); Sign sign2 = signOf(op2, dfv); if (value instanceof AddExpr) { // Handle arithmetic plus return sign1.plus(sign2); } else if (value instanceof MulExpr) { // Handle arithmetic multiplication return sign1.mult(sign2); } else { // We do not handle other types of binary expressions return BOTTOM; } } else if (value instanceof UnopExpr) { if (value instanceof AbstractNegExpr) { // Handle unary minus Value op = ((AbstractNegExpr) value).getOp(); Sign sign = signOf(op, dfv); return sign.negate(); } else { // We do not handle other types of binary expressions return BOTTOM; } } else { // We do not handle other types of compound expressions return BOTTOM; } }
/** * Looks up the <em>security level</em> for the given unary expression and * stores the level in {@link SecurityLevelValueReadSwitch#level}. * * @param expr * The unary expression for which the <em>security level</em> * should be looked up. * @see SecurityLevelValueReadSwitch#handleOneValue(Value, Value) */ private void handleUnaryOperation(UnopExpr expr) { Value value = expr.getOp(); handleOneValue(value, expr); }