<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"><head><meta http-equiv=Content-Type content="text/html; charset=utf-8"><meta name=Generator content="Microsoft Word 14 (filtered medium)"><style><!--
/* Font Definitions */
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}
@font-face
{font-family:Consolas;
panose-1:2 11 6 9 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman","serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
pre
{mso-style-priority:99;
mso-style-link:"HTML Vorformatiert Zchn";
margin:0cm;
margin-bottom:.0001pt;
font-size:10.0pt;
font-family:"Courier New";}
span.HTMLVorformatiertZchn
{mso-style-name:"HTML Vorformatiert Zchn";
mso-style-priority:99;
mso-style-link:"HTML Vorformatiert";
font-family:"Consolas","serif";
mso-fareast-language:DE;}
span.E-MailFormatvorlage19
{mso-style-type:personal-reply;
font-family:"Calibri","sans-serif";
color:#1F497D;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri","sans-serif";
mso-fareast-language:EN-US;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:70.85pt 70.85pt 2.0cm 70.85pt;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]--></head><body lang=DE link=blue vlink=purple><div class=WordSection1><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>Hi Denis,<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>You don’t actually need an implementation of java.* in your Android platform JAR file, because FlowDroid provides explicit models for threads. If you use FlowDroid’s default models, your callgraph should be able to distinguish the two calls, i.e., there should not be a path from emptyThread() to sensitive(). You have two different instances of the Thread class, two different implementations (and thus also instances thereof) of Runnable, and I don’t see any good reason for FlowDroid to combine the two paths.<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>Best regards,<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'> Steven<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><b><span style='font-size:10.0pt;font-family:"Tahoma","sans-serif"'>Von:</span></b><span style='font-size:10.0pt;font-family:"Tahoma","sans-serif"'> soot-list-bounces@CS.McGill.CA [mailto:soot-list-bounces@CS.McGill.CA] <b>Im Auftrag von </b>Denis Bogdanas<br><b>Gesendet:</b> Donnerstag, 3. März 2016 23:04<br><b>An:</b> soot-list@CS.McGill.CA<br><b>Betreff:</b> [Soot-list] FlowDroid: call graph doesn't look context sensitive<o:p></o:p></span></p><p class=MsoNormal><o:p> </o:p></p><div><div><p class=MsoNormal style='margin-bottom:12.0pt'>Suppose we have 2 threads called from 2 UI callbacks. One of them calls method sensitive(), another one is empty. In the call graph, both events will have a path to sensitive(), as if the two Thread instances were modeled as one:<o:p></o:p></p></div><div><pre style='background:white'><b><span style='font-size:9.5pt;color:navy'>protected void </span></b><span style='font-size:9.5pt;color:black'>onCreate(Bundle savedInstanceState) {</span><i><span style='font-size:9.5pt;color:gray'><br> </span></i><span style='font-size:9.5pt;color:black'>threadWithSensitive();<br>}<br><br></span><span style='font-size:9.5pt;color:olive'>@Override<br></span><b><span style='font-size:9.5pt;color:navy'>public boolean </span></b><span style='font-size:9.5pt;color:black'>onOptionsItemSelected(MenuItem item) {</span><i><span style='font-size:9.5pt;color:gray'><br> </span></i><span style='font-size:9.5pt;color:black'>emptyThread();<br> </span><b><span style='font-size:9.5pt;color:navy'>return false</span></b><span style='font-size:9.5pt;color:black'>;<br>}<o:p></o:p></span></pre><pre style='background:white'><b><span style='font-size:9.5pt;color:navy'>private void </span></b><span style='font-size:9.5pt;color:black'>threadWithSensitive() {<br> </span><b><span style='font-size:9.5pt;color:navy'>new </span></b><span style='font-size:9.5pt;color:black'>Thread(</span><b><span style='font-size:9.5pt;color:navy'>new </span></b><span style='font-size:9.5pt;color:black'>Runnable() {</span><span style='font-size:9.5pt;color:olive'><br> </span><b><span style='font-size:9.5pt;color:navy'>public void </span></b><span style='font-size:9.5pt;color:black'>run() {<br> sensitive();<br> }<br> }).start();<br>}<br><br></span><b><span style='font-size:9.5pt;color:navy'>private void </span></b><span style='font-size:9.5pt;color:black'>emptyThread() {<br> </span><b><span style='font-size:9.5pt;color:navy'>new </span></b><span style='font-size:9.5pt;color:black'>Thread(</span><b><span style='font-size:9.5pt;color:navy'>new </span></b><span style='font-size:9.5pt;color:black'>Runnable() {</span><span style='font-size:9.5pt;color:olive'><br> </span><b><span style='font-size:9.5pt;color:navy'>public void </span></b><span style='font-size:9.5pt;color:black'>run() { }<br> }).start();<br>}<o:p></o:p></span></pre><p class=MsoNormal style='margin-bottom:12.0pt'>Shouldn't only onCreate() lead to sensitive() ?<o:p></o:p></p></div><div><p class=MsoNormal>My setup: a crafted android.jar that has stubs for android classes but full implementation for java.* and javax.* packages.<o:p></o:p></p></div><div><p class=MsoNormal><o:p> </o:p></p></div><div><p class=MsoNormal style='margin-bottom:12.0pt'>I also noticed that class <span style='background:#E4E4FF'>MethodContext</span> which is supposed to model a method in its context, is never instantiated, regardless of what call graph algorithm I use.<o:p></o:p></p></div><div><p class=MsoNormal style='margin-bottom:12.0pt'>What am I missing?<o:p></o:p></p></div><div><p class=MsoNormal>thanks,<o:p></o:p></p></div><div><div><p class=MsoNormal>-- <o:p></o:p></p><div><div><p class=MsoNormal>Denis<o:p></o:p></p></div></div></div></div></div></div></body></html>