<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Consolas;
panose-1:2 11 6 9 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman",serif;
color:black;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
p
{mso-style-priority:99;
mso-margin-top-alt:auto;
margin-right:0in;
mso-margin-bottom-alt:auto;
margin-left:0in;
font-size:12.0pt;
font-family:"Times New Roman",serif;
color:black;}
pre
{mso-style-priority:99;
mso-style-link:"HTML Preformatted Char";
margin:0in;
margin-bottom:.0001pt;
font-size:10.0pt;
font-family:"Courier New";
color:black;}
p.msonormal0, li.msonormal0, div.msonormal0
{mso-style-name:msonormal;
mso-margin-top-alt:auto;
margin-right:0in;
mso-margin-bottom-alt:auto;
margin-left:0in;
font-size:12.0pt;
font-family:"Times New Roman",serif;
color:black;}
span.HTMLPreformattedChar
{mso-style-name:"HTML Preformatted Char";
mso-style-priority:99;
mso-style-link:"HTML Preformatted";
font-family:Consolas;
color:black;}
span.EmailStyle21
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:#1F497D;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body bgcolor="white" lang="EN-US" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">Hi Claudio,<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">That would be the most trivial approach that ignores aliasing. You can try that. If you find that you run into issues, you may want to query Soots PointsToSets
instead of simply comparing the locals.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">Best regards,<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"> Steven<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"><o:p> </o:p></span></p>
<div>
<div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:windowtext">From:</span></b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:windowtext"> Soot-list [mailto:soot-list-bounces@cs.mcgill.ca]
<b>On Behalf Of </b>claudio<br>
<b>Sent:</b> Friday, February 9, 2018 6:05 PM<br>
<b>To:</b> soot-list@cs.mcgill.ca<br>
<b>Subject:</b> Re: [Soot-list] [Flowdroid taint propagation]<o:p></o:p></span></p>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<p>Hi Steven,<o:p></o:p></p>
<p>Thank you for your reply.<o:p></o:p></p>
<p><o:p> </o:p></p>
<p>I thought about doing what you suggest. However, I also need to have a relation between the local assigned from method1 and the base object used to call method 2. So Ideally, assuming that method1 and 2 have the same source, I also need to be sure that
the assigned value form method1 is the same one I use to call method2 from. <o:p>
</o:p></p>
<p>In a post processing phase, would it be enough to do something like: <o:p></o:p></p>
<p><b>if</b> method1 has same source has method2; <b>then</b> <br>
stm1.getLeftOp().equals(stm2.getBase())<o:p></o:p></p>
<p>?<o:p></o:p></p>
<p><o:p> </o:p></p>
<p>Bests,<o:p></o:p></p>
<p>Claudio<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<p class="MsoNormal">On 09/02/18 16:30, Arzt, Steven wrote:<o:p></o:p></p>
</div>
<blockquote style="margin-top:5.0pt;margin-bottom:5.0pt">
<pre>Hi Claudio,<o:p></o:p></pre>
<pre><o:p> </o:p></pre>
<pre>FlowDroid does not propagate the sources along with the individual taints for scalability reasons. If one method is called multiple times with different sources, the method would have to be analyzed once per source, if we would propagate the source as part of the taint. That's a waste of time, because the behavior of the method doesn't change depending on the source. Therefore, we only propagate source-agnostic taints through the program. Each taint knows its predecessor(s). After the taint propagation is done, FlowDroid takes the list of taint abstractions that have reached a sink, and scans this tree backwards (i.e., the links from a given abstraction to its predecessor) to find the corresponding source. Consequently, you can't easily ask for the source during taint propagation.<o:p></o:p></pre>
<pre><o:p> </o:p></pre>
<pre>What you can do is the following: You can define method1() and method2() as sources and run the taint propagation as usual. After the results are available, you can check whether the sources are identical for the two methods. In that case, you would have a standard taint propagation problem with a post-processing and would circumvent the problem of not having access to sources _during_ propagation.<o:p></o:p></pre>
<pre><o:p> </o:p></pre>
<pre>Best regards,<o:p></o:p></pre>
<pre> Steven<o:p></o:p></pre>
<pre><o:p> </o:p></pre>
<pre>-----Original Message-----<o:p></o:p></pre>
<pre>From: Soot-list [<a href="mailto:soot-list-bounces@cs.mcgill.ca">mailto:soot-list-bounces@cs.mcgill.ca</a>] On Behalf Of claudio<o:p></o:p></pre>
<pre>Sent: Friday, February 9, 2018 5:21 PM<o:p></o:p></pre>
<pre>To: <a href="mailto:soot-list@cs.mcgill.ca">soot-list@cs.mcgill.ca</a><o:p></o:p></pre>
<pre>Subject: Re: [Soot-list] [Flowdroid taint propagation]<o:p></o:p></pre>
<pre><o:p> </o:p></pre>
<pre>of course it was y = method1(...);<o:p></o:p></pre>
<pre><o:p> </o:p></pre>
<pre><o:p> </o:p></pre>
<pre>Claudio<o:p></o:p></pre>
<pre><o:p> </o:p></pre>
<pre><o:p> </o:p></pre>
<pre>On 09/02/18 16:19, claudio wrote:<o:p></o:p></pre>
<blockquote style="margin-top:5.0pt;margin-bottom:5.0pt">
<pre>Dear all,<o:p></o:p></pre>
<pre><o:p> </o:p></pre>
<pre>I am currently using Flowdroid to analyze Android app. However, I need <o:p></o:p></pre>
<pre>to detect particular situations. For example consider this method<o:p></o:p></pre>
<pre>sequence:<o:p></o:p></pre>
<pre><o:p> </o:p></pre>
<pre><o:p> </o:p></pre>
<pre>x = method1(....);<o:p></o:p></pre>
<pre><o:p> </o:p></pre>
<pre>y.method2(...);<o:p></o:p></pre>
<pre><o:p> </o:p></pre>
<pre><o:p> </o:p></pre>
<pre>now assume that method 1 is called with tainted value from a known <o:p></o:p></pre>
<pre>source.<o:p></o:p></pre>
<pre><o:p> </o:p></pre>
<pre>If method2 is called as well with tainted value, then I want to check <o:p></o:p></pre>
<pre>whether the taint as input in method2 comes from the same source as <o:p></o:p></pre>
<pre>the one that is tainting its base object y.<o:p></o:p></pre>
<pre><o:p> </o:p></pre>
<pre>Is there a way to achieve it? I was looking for some sort of taint Map <o:p></o:p></pre>
<pre>where all the taints are stored, but I couldn't find it.<o:p></o:p></pre>
<pre><o:p> </o:p></pre>
<pre><o:p> </o:p></pre>
<pre>Thanks,<o:p></o:p></pre>
<pre><o:p> </o:p></pre>
<pre>Claudio<o:p></o:p></pre>
<pre><o:p> </o:p></pre>
<pre>_______________________________________________<o:p></o:p></pre>
<pre>Soot-list mailing list<o:p></o:p></pre>
<pre><a href="mailto:Soot-list@CS.McGill.CA">Soot-list@CS.McGill.CA</a><o:p></o:p></pre>
<pre><a href="https://mailman.CS.McGill.CA/mailman/listinfo/soot-list">https://mailman.CS.McGill.CA/mailman/listinfo/soot-list</a><o:p></o:p></pre>
</blockquote>
<pre><o:p> </o:p></pre>
<pre>_______________________________________________<o:p></o:p></pre>
<pre>Soot-list mailing list<o:p></o:p></pre>
<pre><a href="mailto:Soot-list@CS.McGill.CA">Soot-list@CS.McGill.CA</a><o:p></o:p></pre>
<pre><a href="https://mailman.CS.McGill.CA/mailman/listinfo/soot-list">https://mailman.CS.McGill.CA/mailman/listinfo/soot-list</a><o:p></o:p></pre>
</blockquote>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
</body>
</html>