<div dir="ltr">Hi Wei,<div><br></div><div>Good to hear from you again and thanks for the suggestion!</div><div><br></div><div>Actually even if I add those signatures to EasyTaintWrapperConversion.txt(in both infoflow and infoflow-android), the edge is still missing in the call graph generated by Spark. Any idea?</div><div><div><android.content.Context: java.lang.Object getSystemService(java.lang.String)></div><div><android.content.ContextWrapper: java.lang.Object getSystemService(java.lang.String)></div><div><android.app.Activity: java.lang.Object getSystemService(java.lang.String)></div></div><div><br></div><div>Best,</div><div>Yu</div></div><div class="gmail_extra"><br><div class="gmail_quote">On Mon, Feb 9, 2015 at 12:27 PM, Wei Yang <span dir="ltr"><<a href="mailto:davidyoung8906@gmail.com" target="_blank">davidyoung8906@gmail.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr"><div>Hi! Yu,</div><div> I met the same issue before. I think it is because in "<span style="font-size:12.7272720336914px"> $r3 = virtualinvoke $r0.<com.GoldDream.zj.</span><span style="font-size:12.7272720336914px">zjService: java.lang.Object getSystemService(java.lang.</span><span style="font-size:12.7272720336914px">String)>($r2);</span>", <span style="font-size:12.7272720336914px">getSystemService is a factory method belonging to Android SDK, so</span> Spark cannot know where "r3" is constructed and the actual type of it. </div><div> One solution is to add a entry in the taint wrapper where flowdroid will perform a lookup when it encounters a library method.</div><div class="gmail_extra"><br clear="all"><div><div>Best wishes,<div>David </div></div></div>
<br><div class="gmail_quote">2015-02-09 12:04 GMT-06:00 Yu Feng <span dir="ltr"><<a href="mailto:fengyu8299@gmail.com" target="_blank">fengyu8299@gmail.com</a>></span>:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div><div class="h5"><div dir="ltr"><div style="font-size:12.727272033691406px">Hi,</div><div style="font-size:12.727272033691406px"><br></div><div style="font-size:12.727272033691406px">I have a quick question regarding FlowDroid:</div><div style="font-size:12.727272033691406px"><br></div><div style="font-size:12.727272033691406px">Suppose 'foo' is reachable from the "dummyMain" in FlowDroid,</div><br style="font-size:12.727272033691406px"><div style="font-size:12.727272033691406px">foo() { </div><div style="font-size:12.727272033691406px"><div> $r3 = virtualinvoke $r0.<com.GoldDream.zj.zjService: java.lang.Object getSystemService(java.lang.String)>($r2);</div><div> $r1 = $r3;</div><div> $r4 = (android.telephony.TelephonyManager) $r1;</div><div> $r5 = virtualinvoke $r4.<android.telephony.TelephonyManager: java.lang.String getDeviceId()>();</div></div><div style="font-size:12.727272033691406px"><br></div><div style="font-size:12.727272033691406px">}</div><div style="font-size:12.727272033691406px"><br></div><div style="font-size:12.727272033691406px">If I build the call graph for this code snippet, it should have at least two edges:</div><div style="font-size:12.727272033691406px">1. foo -> getSystemService</div><div style="font-size:12.727272033691406px">2. foo-> getDeviceId</div><div style="font-size:12.727272033691406px"><br></div><div style="font-size:12.727272033691406px">For CHA it looks correct, but for Spark, the second edge is missing because the points-to set of $r3 is empty. </div><div style="font-size:12.727272033691406px">I thought most of the Android APIs(like getSystemService) are handled properly in FlowDroid and why it still returns an empty set regarding this case.</div><div style="font-size:12.727272033691406px">What should I do if I need to get a sound call graph(based on Spark, not CHA) from FlowDroid?</div><div style="font-size:12.727272033691406px"><br></div><div style="font-size:12.727272033691406px">Thanks so much,</div><div style="font-size:12.727272033691406px">Yu </div><br clear="all"><div><br></div></div>
<br></div></div>_______________________________________________<br>
Soot-list mailing list<br>
<a href="mailto:Soot-list@CS.McGill.CA" target="_blank">Soot-list@CS.McGill.CA</a><br>
<a href="https://mailman.CS.McGill.CA/mailman/listinfo/soot-list" target="_blank">https://mailman.CS.McGill.CA/mailman/listinfo/soot-list</a><br>
<br></blockquote></div><br></div></div>
<br>_______________________________________________<br>
Soot-list mailing list<br>
<a href="mailto:Soot-list@CS.McGill.CA">Soot-list@CS.McGill.CA</a><br>
<a href="https://mailman.CS.McGill.CA/mailman/listinfo/soot-list" target="_blank">https://mailman.CS.McGill.CA/mailman/listinfo/soot-list</a><br>
<br></blockquote></div><br></div><br clear="all"><div><br></div>-- <br><div class="gmail_signature"><div dir="ltr">--Yu</div></div>