<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"><head><meta http-equiv=Content-Type content="text/html; charset=utf-8"><meta name=Generator content="Microsoft Word 14 (filtered medium)"><style><!--
/* Font Definitions */
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman","serif";
color:black;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
span.E-MailFormatvorlage17
{mso-style-type:personal-reply;
font-family:"Calibri","sans-serif";
color:#1F497D;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:70.85pt 70.85pt 2.0cm 70.85pt;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]--></head><body bgcolor=white lang=DE link=blue vlink=purple><div class=WordSection1><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>Hi Simone,<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>The reason why there is no outgoing edge from the isWifiEnabled() call is that Soot’s SPARK callgraph algorithm needs type information. SPARK must see the allocation site for the respective base object. It can then propagate the precise type onwards to the isWifiEnabled() call site. In this case, however, there is no call site in the code visible to SPARK. You call a factory method implemented in the Android SDK to get the object instance. This factory method then somehow internally calls the constructor, which is, however, invisible to SPARK, because in the stub JAR files shipped with the Android SDK, all those methods only throw NotImplementedExceptions. Without the constructor call (i.e., the inside of the factory method), there is no allocation site and thus no type information and thus no call edge.<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>There are several ways to deal with such problems. You can either include a fully-implemented version of the Android platform JAR file instead of stubbed version from the SDK. This will, however, drastically increase your computation time. The other possibility is to live with the missing call edges and handle them explicitly. That’s what FlowDroid does: When we see a call site with no outgoing call edges, the respective method implementation is unavailable and we consult a component called the TaintWrapper for an explicit model of that method. The TaintWrapper then implements rules for dealing with library methods.<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>Best regards,<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'> Steven<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'><o:p> </o:p></span></p><div><div style='border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0cm 0cm 0cm'><p class=MsoNormal><b><span lang=EN-US style='font-size:10.0pt;font-family:"Tahoma","sans-serif";color:windowtext'>Von:</span></b><span lang=EN-US style='font-size:10.0pt;font-family:"Tahoma","sans-serif";color:windowtext'> soot-list-bounces@CS.McGill.CA [mailto:soot-list-bounces@CS.McGill.CA] <b>Im Auftrag von </b>Simone Aonzo<br><b>Gesendet:</b> Donners</span><span style='font-size:10.0pt;font-family:"Tahoma","sans-serif";color:windowtext'>tag, 7. April 2016 18:03<br><b>An:</b> soot-list@CS.McGill.CA<br><b>Betreff:</b> [Soot-list] Missing API in callgraph<o:p></o:p></span></p></div></div><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Hi all,<br><br>I use soot/flowdroid and I've a doubt about the generated callgraph of this code:<br><br>private void requireapi() {<br> String msg = "WiFi-Disabled";<br> WifiManager wifi = (WifiManager) getSystemService(Context.WIFI_SERVICE);<br> if (wifi.isWifiEnabled())<br> msg = "WiFi-Enabled";<br> Toast toast = Toast.makeText(this, msg, Toast.LENGTH_LONG);<br> toast.show();<br> }<br><br><br>with soot, when I call the edgesOutOf(..)<br><br>Iterator<Edge> edgesOut = callGraph.edgesOutOf(sm);<br><br>the only edge that I found is:<br><br>STATIC edge: $r4 = staticinvoke <android.widget.Toast: android.widget.Toast makeText(android.content.Context,java.lang.CharSequence,int)>(r5, $r1, 1) in <com.example.testapp.MainActivity: void requireapi()> ==> <android.widget.Toast: android.widget.Toast makeText(android.content.Context,java.lang.CharSequence,int)><br><br>why miss the getSystemService and the isWifiEnabled method?<br>both android.widget.Toast and android.net.wifi.WifiManager are phantom classes!<br><br>Thanks for help,<br>Simone<o:p></o:p></p></div></body></html>