<html><head></head><body><div class="ydp7c4a58f7yahoo-style-wrap" style="font-family:Helvetica Neue, Helvetica, Arial, sans-serif;font-size:13px;"><div id="ydp7c4a58f7yiv9525925704"><div style="font-family:Helvetica Neue, Helvetica, Arial, sans-serif;font-size:13px;" class="ydp7c4a58f7yiv9525925704ydpe7bd89f2yahoo-style-wrap"><div></div>
<div dir="ltr">Hello Prof. Dr. Arzt, Prof.Dr.Bodden,</div><div dir="ltr"><br clear="none"></div><div dir="ltr">I reproduced the issue of edges missing for fragment lifecycles using Flowdroid 2.11-SNAPSHOT as well. </div><div dir="ltr" data-setdir="false">Looking into AndroidEntryPointCreator, as you recommended, it seems method active bodies (and thus outgoing edges), will only be resolved for added fragments (i.e for which transactions and the correct type were identified by the CallbackAnalyzer ) but not for any other fragment class i.e classes within the app's namespace which extend android.app.Fragment or Support Library fragments.</div><div dir="ltr" data-setdir="false"><span><span style="color: rgb(0, 0, 0); font-family: Helvetica Neue, Helvetica, Arial, sans-serif;"><br></span></span></div><div dir="ltr" data-setdir="false"><span><span style="color: rgb(0, 0, 0); font-family: Helvetica Neue, Helvetica, Arial, sans-serif;">Is this assumption correct? </span></span></div><div dir="ltr" data-setdir="false"><span><span style="color: rgb(0, 0, 0); font-family: Helvetica Neue, Helvetica, Arial, sans-serif;"><br></span></span></div><div dir="ltr" data-setdir="false">If that is the case, I guess one would either need to refine the fragment identifcation for those missing fragments or somehow modify the analysis to resolve active bodies for any fragment lifecycle as long as the fragment is within the app package.</div><div dir="ltr"><br clear="none"></div><div dir="ltr">Best regards,</div><div dir="ltr">Faridah Akinotcho<br></div>
</div></div></div><div id="yiv9525925704yqt16853" class="yiv9525925704yqt3503883972"><div id="yiv9525925704yahoo_quoted_3159944610" class="yiv9525925704yahoo_quoted">
<div style="font-family:'Helvetica Neue', Helvetica, Arial, sans-serif;font-size:13px;color:#26282a;">
<div>
Le mardi 10 mai 2022, 12:31:51 UTC−7, Arzt, Steven <steven.arzt@sit.fraunhofer.de> a écrit :
</div>
<div><br clear="none"></div>
<div><br clear="none"></div>
<div><div dir="ltr">Dear Faridah,<br clear="none"><br clear="none">FlowDroid applies a precise model for app components including fragments. You may want to look into the "AndroidEntryPointCreator" to identify any missing parts. Maybe there is a bug. Feel free to open merge request if you find something.<br clear="none"><br clear="none">Best regards,<br clear="none"> Steven<br clear="none"><br clear="none"><br clear="none">-----Original Message-----<br clear="none">From: Faridah Akinotcho <<a rel="nofollow noopener noreferrer" shape="rect" ymailto="mailto:faridath.akinotcho@yahoo.fr" target="_blank" href="mailto:faridath.akinotcho@yahoo.fr">faridath.akinotcho@yahoo.fr</a>> <br clear="none">Sent: Dienstag, 10. Mai 2022 21:28<br clear="none">To: Eric Bodden <<a rel="nofollow noopener noreferrer" shape="rect" ymailto="mailto:eric.bodden@uni-paderborn.de" target="_blank" href="mailto:eric.bodden@uni-paderborn.de">eric.bodden@uni-paderborn.de</a>>; Arzt, Steven <<a rel="nofollow noopener noreferrer" shape="rect" ymailto="mailto:steven.arzt@sit.fraunhofer.de" target="_blank" href="mailto:steven.arzt@sit.fraunhofer.de">steven.arzt@sit.fraunhofer.de</a>><br clear="none">Cc: Soot-list <<a rel="nofollow noopener noreferrer" shape="rect" ymailto="mailto:soot-list@cs.mcgill.ca" target="_blank" href="mailto:soot-list@cs.mcgill.ca">soot-list@cs.mcgill.ca</a>><br clear="none">Subject: Re: [Soot-list] Missing callgraph edges with Spark<br clear="none"><br clear="none">Hi Prof. Dr. Arzt, Prof. Dr. Bodden,<br clear="none"><br clear="none">I followed your recommendations of using Flowdroid and preprocessors, instead of Soot, for which I thank you once again.<br clear="none"><br clear="none">While it did provide me with a much more precise callgraph on the example I showed before, some of the edges that were found previously by Soot are now missing, and from a first look, it seems those are all within fragment lifecycles (e.g onViewCreated). Is there anything regarding how fragment classes are handled by Flowdroid which you believe could explain this behavior?<br clear="none"><br clear="none">Best regards,<br clear="none">Faridah Akinotcho <br clear="none"><br clear="none">Le lundi 9 mai 2022, 19:27:11 UTC−7, Faridah Akinotcho <<a rel="nofollow noopener noreferrer" shape="rect" ymailto="mailto:faridath.akinotcho@yahoo.fr" target="_blank" href="mailto:faridath.akinotcho@yahoo.fr">faridath.akinotcho@yahoo.fr</a>> a écrit : <br clear="none"><br clear="none"><br clear="none">Thank you for clarifying this! I'll try setting up my analysis within this Flowdroid callback instead.<br clear="none"><br clear="none"><br clear="none">Best regards,<br clear="none">Faridah Akinotcho<br clear="none"><br clear="none"><br clear="none">Le lundi 9 mai 2022, 12:12:00 UTC−7, Arzt, Steven <<a rel="nofollow noopener noreferrer" shape="rect" ymailto="mailto:steven.arzt@sit.fraunhofer.de" target="_blank" href="mailto:steven.arzt@sit.fraunhofer.de">steven.arzt@sit.fraunhofer.de</a>> a écrit : <br clear="none"><br clear="none"><br clear="none">Dear Faridah,<br clear="none"><br clear="none">You can call SetupApplication.addPreprocessor() to add a callback that gets invoked once the callgraph construction is done in FlowDroid. The interface has two methods, one before and one after callgraph construction. You just need to use the FlowDroid API, i.e., the SetupApplication class. That should be fairly simple.<br clear="none"><br clear="none">Best regards,<br clear="none"> Steven<br clear="none"><br clear="none">-----Original Message-----<br clear="none">From: Soot-list <<a rel="nofollow noopener noreferrer" shape="rect" ymailto="mailto:soot-list-bounces@CS.McGill.CA" target="_blank" href="mailto:soot-list-bounces@CS.McGill.CA">soot-list-bounces@CS.McGill.CA</a> <mailto:<a rel="nofollow noopener noreferrer" shape="rect" ymailto="mailto:soot-list-bounces@CS.McGill.CA" target="_blank" href="mailto:soot-list-bounces@CS.McGill.CA">soot-list-bounces@CS.McGill.CA</a>> > On Behalf Of Faridah Akinotcho<br clear="none">Sent: Montag, 9. Mai 2022 21:11<br clear="none">To: Eric Bodden <<a rel="nofollow noopener noreferrer" shape="rect" ymailto="mailto:eric.bodden@uni-paderborn.de" target="_blank" href="mailto:eric.bodden@uni-paderborn.de">eric.bodden@uni-paderborn.de</a> <mailto:<a rel="nofollow noopener noreferrer" shape="rect" ymailto="mailto:eric.bodden@uni-paderborn.de" target="_blank" href="mailto:eric.bodden@uni-paderborn.de">eric.bodden@uni-paderborn.de</a>> ><br clear="none">Cc: Soot-list <<a rel="nofollow noopener noreferrer" shape="rect" ymailto="mailto:soot-list@cs.mcgill.ca" target="_blank" href="mailto:soot-list@cs.mcgill.ca">soot-list@cs.mcgill.ca</a> <mailto:<a rel="nofollow noopener noreferrer" shape="rect" ymailto="mailto:soot-list@cs.mcgill.ca" target="_blank" href="mailto:soot-list@cs.mcgill.ca">soot-list@cs.mcgill.ca</a>> ><br clear="none">Subject: Re: [Soot-list] Missing callgraph edges with Spark<br clear="none"><br clear="none">Hi Prof. Dr. Bodden,<br clear="none"><br clear="none">Thank you for the reply! I am using bare Soot because I am trying to add a wjtp subphase and I couldn't figure out how to do with Flowdroid without having to extend it and override constructCallgraph. Would there be a way for me to this with Flowdroid?<br clear="none"><br clear="none">Best regards,<br clear="none">Faridah Akinotcho<br clear="none"><br clear="none">Le lundi 9 mai 2022, 05:20:22 UTC−7, Eric Bodden <<a rel="nofollow noopener noreferrer" shape="rect" ymailto="mailto:eric.bodden@uni-paderborn.de" target="_blank" href="mailto:eric.bodden@uni-paderborn.de">eric.bodden@uni-paderborn.de</a> <mailto:<a rel="nofollow noopener noreferrer" shape="rect" ymailto="mailto:eric.bodden@uni-paderborn.de" target="_blank" href="mailto:eric.bodden@uni-paderborn.de">eric.bodden@uni-paderborn.de</a>> > a écrit : <br clear="none"><br clear="none"><br clear="none">Hi Faridah. <br clear="none"><br clear="none"><br clear="none">When creating callgraphs for Android you should be using our Soot-extension FlowDroid because it models Android’s lifecycle. When you use bare Soot then the callgraph will be very incomplete. Are you using FlowDroid already?<br clear="none"><br clear="none"><br clear="none">Cheers<br clear="none">Eric<br clear="none"><br clear="none"><br clear="none"><br clear="none"> On 9. May 2022, at 00:11, Faridah Akinotcho <<a rel="nofollow noopener noreferrer" shape="rect" ymailto="mailto:faridath.akinotcho@yahoo.fr" target="_blank" href="mailto:faridath.akinotcho@yahoo.fr">faridath.akinotcho@yahoo.fr</a> <mailto:<a rel="nofollow noopener noreferrer" shape="rect" ymailto="mailto:faridath.akinotcho@yahoo.fr" target="_blank" href="mailto:faridath.akinotcho@yahoo.fr">faridath.akinotcho@yahoo.fr</a>> <mailto:<a rel="nofollow noopener noreferrer" shape="rect" ymailto="mailto:faridath.akinotcho@yahoo.fr" target="_blank" href="mailto:faridath.akinotcho@yahoo.fr">faridath.akinotcho@yahoo.fr</a> <mailto:<a rel="nofollow noopener noreferrer" shape="rect" ymailto="mailto:faridath.akinotcho@yahoo.fr" target="_blank" href="mailto:faridath.akinotcho@yahoo.fr">faridath.akinotcho@yahoo.fr</a>> > > wrote:<br clear="none"><br clear="none"> Hi,<br clear="none"><br clear="none"> I am using Soot (org.soot.oss 4.2.1) to perform an interprocedural analysis on Android methods (in the wjtp phase). To this end, I am extracting reachable methods from Android lifecycles using Scene.v().getCallgraph().edgesOutOf(method). However, I noticed that some virtual and special edges seem to always be missing from the returned set. For e.g, given:<br clear="none"><br clear="none"> class B extends A{<br clear="none"> void onCreate(...){<br clear="none"> setContentView(C0027R.layout.merge);<br clear="none"> super.onCreate(bundle);<br clear="none"> setNextActivity(C.class);<br clear="none"> }<br clear="none"> }<br clear="none"> <br clear="none"> class A{<br clear="none"> public void setNextActivity(){<br clear="none"> ...<br clear="none"> }<br clear="none"> }<br clear="none"><br clear="none"> When computing the reachable methods for B.onCreate(), neither setContentView, super.onCreate or setNextActivity are included as targets for the outgoing edges (only clinit is returned). However, when using CHA instead of Spark, these are part of the returned set (along other overapproximations), so I am assuming there might be some issue when performing the points-to analysis. Here are the options I am using:<br clear="none"><br clear="none"> Options.v().set_src_prec(Options.src_prec_apk);<br clear="none"> Options.v().set_output_format(Options.output_format_none);<br clear="none"><br clear="none"> Options.v().set_no_bodies_for_excluded(true);<br clear="none"> Options.v().set_allow_phantom_refs(true);<br clear="none"> Options.v().set_android_jars(androidJar);<br clear="none"><br clear="none"> Options.v().set_process_dir(Collections.singletonList(apkPath));<br clear="none"> Options.v().set_soot_classpath(androidJar);<br clear="none"> Options.v().set_process_multiple_dex(true);<br clear="none"><br clear="none"> Options.v().set_whole_program(true);<br clear="none"> Options.v().setPhaseOption("cg", "all-reachable:true");<br clear="none"> Options.v().setPhaseOption("cg.spark", "on");<br clear="none"> Options.v().setPhaseOption("cg.spark", "verbose:true");<br clear="none"> Options.v().setPhaseOption("cg.spark", "string-constants:true");<br clear="none"><br clear="none"> Options.v().setPhaseOption("jb.ulp", "off");<br clear="none"> <br clear="none"> Main.v().autoSetOptions();<br clear="none"> Scene.v().loadNecessaryClasses();<br clear="none"><br clear="none"><br clear="none"><br clear="none"> I would greatly appreciate any pointers about what I might be missing (maybe an option that wasn't set properly) or what the problem could be.<br clear="none"><br clear="none"> Best regards,<br clear="none"> Faridah Akinotcho<br clear="none"><br clear="none"> _______________________________________________<br clear="none"> Soot-list mailing list<br clear="none"> <a rel="nofollow noopener noreferrer" shape="rect" ymailto="mailto:Soot-list@CS.McGill.CA" target="_blank" href="mailto:Soot-list@CS.McGill.CA">Soot-list@CS.McGill.CA</a> <mailto:<a rel="nofollow noopener noreferrer" shape="rect" ymailto="mailto:Soot-list@CS.McGill.CA" target="_blank" href="mailto:Soot-list@CS.McGill.CA">Soot-list@CS.McGill.CA</a>> <mailto:<a rel="nofollow noopener noreferrer" shape="rect" ymailto="mailto:Soot-list@CS.McGill.CA" target="_blank" href="mailto:Soot-list@CS.McGill.CA">Soot-list@CS.McGill.CA</a> <mailto:<a rel="nofollow noopener noreferrer" shape="rect" ymailto="mailto:Soot-list@CS.McGill.CA" target="_blank" href="mailto:Soot-list@CS.McGill.CA">Soot-list@CS.McGill.CA</a>> > <div id="yiv9525925704yqtfd62724" class="yiv9525925704yqt3721814420"><br clear="none"><br clear="none"> <a rel="nofollow noopener noreferrer" shape="rect" target="_blank" href="https://mailman.CS.McGill.CA/mailman/listinfo/soot-list">https://mailman.CS.McGill.CA/mailman/listinfo/soot-list</a><br clear="none"> <br clear="none"><br clear="none"><br clear="none"><br clear="none"></div></div></div>
</div>
</div></div></body></html>