<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Consolas;
panose-1:2 11 6 9 2 2 4 3 2 4;}
@font-face
{font-family:Menlo;
panose-1:0 0 0 0 0 0 0 0 0 0;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman",serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
pre
{mso-style-priority:99;
mso-style-link:"HTML Preformatted Char";
margin:0in;
margin-bottom:.0001pt;
font-size:10.0pt;
font-family:"Courier New";}
p.msonormal0, li.msonormal0, div.msonormal0
{mso-style-name:msonormal;
mso-margin-top-alt:auto;
margin-right:0in;
mso-margin-bottom-alt:auto;
margin-left:0in;
font-size:12.0pt;
font-family:"Times New Roman",serif;}
span.HTMLPreformattedChar
{mso-style-name:"HTML Preformatted Char";
mso-style-priority:99;
mso-style-link:"HTML Preformatted";
font-family:Consolas;}
span.EmailStyle20
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:#1F497D;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">Hi Jonas,<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">The reason for the missing callgraph edge is that there is no allocation site for “powerManager”. Consequently, the SPARK callgraph algorithm cannot obtain type
information for that variable and without type information, there are no outgoing callgraph edges. You have already looked into some of the possibilities for dealing with such issues. You can try to add the underlying Android code to provide for the allocation
site. Unfortunately, that won’t work here, because the system service registry in Android is built on a plugin system, i.e., has an internal registry of services that is built dynamically. Such things are tough calls for any callgraph analysis algorithm.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">Therefore, I’d rather avoid the need for a callgraph edge. Instead, you can look at the invocation (without resolving it) to see where it goes. It won’t get much
more precise than that anyway, unless you really need to know the internal Android class that implements the service. If you’re fine with the PowerManager class that is part of the public API, the invocation signature is enough (which trivially points to PowerManager.newWakeLock).
In fact, that’s how we handle such cases in FlowDroid. You don’t need to know the exact type of the variable in that case, you just use the declared one. However, you need to do that on your own. Soot’s SPARK algorithm won’t build such approximated edges into
the callgraph for you.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">Best regards,<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"> Steven<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"><o:p> </o:p></span></p>
<div>
<div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">From:</span></b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif"> Soot-list [mailto:soot-list-bounces@cs.mcgill.ca]
<b>On Behalf Of </b>Jonas De Bleser<br>
<b>Sent:</b> Tuesday, June 20, 2017 2:09 PM<br>
<b>To:</b> soot-list@cs.mcgill.ca<br>
<b>Subject:</b> [Soot-list] Spark: Missing API call causes empty points-to set<o:p></o:p></span></p>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<div name="messageBodySection">
<p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Arial",sans-serif">Hi all,
<o:p></o:p></span></p>
<div>
<p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Arial",sans-serif"><o:p> </o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Arial",sans-serif">I’m currently using SOOT + FlowDroid to analyse Android applications which works fine, except for one API call:<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Arial",sans-serif"><o:p> </o:p></span></p>
</div>
<div>
<pre style="background:white"><span style="font-size:9.0pt;font-family:"Menlo",serif"><o:p> </o:p></span></pre>
<pre style="background:white"><span style="font-size:9.0pt;font-family:"Menlo",serif">PowerManager powerManager = (PowerManager) <b><span style="color:navy">this</span></b>.getSystemService(Context.<b><i><span style="color:#660E7A">POWER_SERVICE</span></i></b>);<br><b><span style="color:#660E7A">wakeLock </span></b>= powerManager.newWakeLock(<br> PowerManager.<b><i><span style="color:#660E7A">ACQUIRE_CAUSES_WAKEUP</span></i></b>,<br> <b><span style="color:green">"my wakelock"</span></b>);<o:p></o:p></span></pre>
</div>
<div>
<p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Arial",sans-serif">While the callgraph contains every other call, it does NOT contain </span><span style="font-size:9.0pt;font-family:"Menlo",serif;background:white">powerManager.newWakeLock</span><span style="font-size:10.5pt;font-family:"Arial",sans-serif">.
Because of this, SPARK determines that the points-to set of </span><b><span style="font-size:9.0pt;font-family:"Menlo",serif;color:#660E7A;background:white">wakeLock</span></b><span style="font-size:10.5pt;font-family:"Arial",sans-serif"> is empty, while it
shouldn’t!<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Arial",sans-serif"><o:p> </o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Arial",sans-serif">I’ve found two messages on the mailing list that have the same problem:<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Arial",sans-serif"><a href="https://mailman.cs.mcgill.ca/pipermail/soot-list/2016-April/008443.html">https://mailman.cs.mcgill.ca/pipermail/soot-list/2016-April/008443.html</a><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Arial",sans-serif"><a href="https://mailman.cs.mcgill.ca/pipermail/soot-list/2015-February/007734.html">https://mailman.cs.mcgill.ca/pipermail/soot-list/2015-February/007734.html</a><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Arial",sans-serif"><o:p> </o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Arial",sans-serif">I tried to analyse the application by using the source code of Android (android-all-5.0.0_r2-robolectric-0.jar, from <a href="http://central.maven.org/maven2/org/robolectric/android-all/5.0.0_r2-robolectric-0/">http://central.maven.org/maven2/org/robolectric/android-all/5.0.0_r2-robolectric-0/</a>)
instead of the default stub android.jar. I manually checked that the JAR contains the implementation of the </span><span style="font-size:9.0pt;font-family:"Menlo",serif;background:white">powerManager.newWakeLock.</span><span style="font-size:10.5pt;font-family:"Arial",sans-serif"><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Arial",sans-serif"><o:p> </o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Arial",sans-serif">Unfortunately, this gives the same results (i.e., empty points-to set for </span><b><span style="font-size:9.0pt;font-family:"Menlo",serif;color:#660E7A;background:white">wakeLock</span></b><span style="font-size:10.5pt;font-family:"Arial",sans-serif">)
and I’m clueless on how to solve this problem. I need to know the points-to sets of every WakeLock instance.<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Arial",sans-serif"><o:p> </o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Arial",sans-serif">Thanks!<o:p></o:p></span></p>
</div>
</div>
<div name="messageReplySection">
<p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Arial",sans-serif"><o:p> </o:p></span></p>
</div>
</div>
</body>
</html>