import soot.jimple.CastExpr; //导入依赖的package包/类
/**
 * the operations that are not relevant for analysis like "not" or casts
 * are removed - array refs are only removed if explicitly stated
 * @param val the value which should be pruned
 * @param keepArrayRef if false then array refs are pruned to the base array object
 * @return the value (possibly pruned to base object)
 */ //we want to keep ArrayRef for objects on the right side of the assignment
public static Value selectBase(Value val, boolean keepArrayRef){
	//we taint base of array instead of array elements
	if (val instanceof ArrayRef && !keepArrayRef) {
		return selectBase(((ArrayRef) val).getBase(), keepArrayRef);
	}
	
	if (val instanceof CastExpr) {
		return selectBase(((CastExpr) val).getOp(), keepArrayRef);
	}
	
	// Check for unary operators like "not" or "length"
	if (val instanceof UnopExpr)
		return selectBase(((UnopExpr) val).getOp(), keepArrayRef);
	
	return val;
}
 

import soot.jimple.CastExpr; //导入依赖的package包/类
public void jimplify (DexBody body) {
     TwoRegisterInstruction i = (TwoRegisterInstruction)instruction;
     int dest = i.getRegisterA();
     int source = i.getRegisterB();
     Type targetType = getTargetType();
     CastExpr cast = Jimple.v().newCastExpr(body.getRegisterLocal(source), targetType);
     assign = Jimple.v().newAssignStmt(body.getRegisterLocal(dest), cast);
     assign.addTag (getTag());
     setUnit(assign);
     addTags(assign);
     body.add(assign);
     
     if (IDalvikTyper.ENABLE_DVKTYPER) {
Debug.printDbg(IDalvikTyper.DEBUG, "constraint cast: "+ assign +" castexpr type: "+ cast.getType()+" cast type: "+ cast.getCastType());
       int op = (int)instruction.getOpcode().value;
       DalvikTyper.v().setType(assign.getLeftOpBox(), cast.getType(), false);
       //DalvikTyper.v().captureAssign((JAssignStmt)assign, op);
     }
 }
 

import soot.jimple.CastExpr; //导入依赖的package包/类
public void jimplify (DexBody body) {
      if(!(instruction instanceof Instruction21c))
          throw new IllegalArgumentException("Expected Instruction21c but got: "+instruction.getClass());

      Instruction21c checkCastInstr = (Instruction21c)instruction;

      Local castValue = body.getRegisterLocal(checkCastInstr.getRegisterA());
      Type checkCastType = DexType.toSoot((TypeReference) checkCastInstr.getReference());

      CastExpr castExpr =  Jimple.v().newCastExpr(castValue, checkCastType);

      //generate "x = (Type) x"
      //splitter will take care of the rest
      assign = Jimple.v().newAssignStmt(castValue, castExpr);

      setUnit(assign);
      addTags(assign);
      body.add(assign);
      

      if (IDalvikTyper.ENABLE_DVKTYPER) {
	Debug.printDbg(IDalvikTyper.DEBUG, "constraint: "+ assign);
          DalvikTyper.v().setType(assign.getLeftOpBox(), checkCastType, false);
}

  }
 

import soot.jimple.CastExpr; //导入依赖的package包/类
private void javafy_expr(ValueBox vb) {
	Expr e = (Expr) vb.getValue();

	if (e instanceof BinopExpr)
		javafy_binop_expr(vb);
	else if (e instanceof UnopExpr)
		javafy_unop_expr(vb);
	else if (e instanceof CastExpr)
		javafy_cast_expr(vb);
	else if (e instanceof NewArrayExpr)
		javafy_newarray_expr(vb);
	else if (e instanceof NewMultiArrayExpr)
		javafy_newmultiarray_expr(vb);
	else if (e instanceof InstanceOfExpr)
		javafy_instanceof_expr(vb);
	else if (e instanceof InvokeExpr)
		javafy_invoke_expr(vb);
	else if (e instanceof NewExpr)
		javafy_new_expr(vb);
}
 

import soot.jimple.CastExpr; //导入依赖的package包/类
public void caseCastExpr(CastExpr expr) {
    result = result.add(mgr.RESOLVE_CLASS_ERRORS);
    Type fromType = expr.getOp().getType();
    Type toType = expr.getCastType();
    if (toType instanceof RefLikeType) {
	// fromType might still be unknown when we are called,
	// but toType will have a value.
	FastHierarchy h = Scene.v().getOrMakeFastHierarchy();
	if (fromType == null || fromType instanceof UnknownType ||
	    ((! (fromType instanceof NullType)) &&
	     (! h.canStoreType(fromType, toType)))) {
	    result = result.add(mgr.CLASS_CAST_EXCEPTION);
	}
    }
    result = result.add(mightThrow(expr.getOp()));
}
 

import soot.jimple.CastExpr; //导入依赖的package包/类
/**
 * 
 * @param value
 * @param currUnit currUnit must be after the TaintValue's activation
 * @return ==
 */
public TaintValue isTainted(Value value, Unit currUnit){
	TaintValue result = null;
	Value handledValue = null;
	//[start] array additional, CastExpt
	if(value instanceof ArrayRef){
		handledValue = ((ArrayRef) value).getBase();
	}else if(value instanceof CastExpr){
		handledValue = ((CastExpr) value).getOp();
	}else{
		handledValue = value;
	}
	//[end]
	for(TaintValue tv : taintsSet){
		Unit activation = tv.getActivation();
		Value tmp = tv.getTaintValue();
		if(tmp.toString().equals(handledValue.toString()) && allUnits.indexOf(activation) < allUnits.indexOf(currUnit)){
			result = tv;
			break;
		}
	}
	return result;
}
 

import soot.jimple.CastExpr; //导入依赖的package包/类
private void assign(Local lhs, Value rhs, Map<Local, Constant> input, Map<Local, Constant> output) {
	// First remove casts, if any.
	if (rhs instanceof CastExpr) {
		rhs = ((CastExpr) rhs).getOp();
	}
	// Then check if the RHS operand is a constant or local
	if (rhs instanceof Constant) {
		// If RHS is a constant, it is a direct gen
		output.put(lhs, (Constant) rhs);
	} else if (rhs instanceof Local) {
		// Copy constant-status of RHS to LHS (indirect gen), if exists
		if(input.containsKey(rhs)) {
			output.put(lhs, input.get(rhs));
		}
	} else {
		// RHS is some compound expression, then LHS is non-constant (only kill)
		output.put(lhs, null);
	}			
}
 

import soot.jimple.CastExpr; //导入依赖的package包/类
@Override
public void caseCastExpr(CastExpr v) {
	//just propagate the taint value of previous statement
	Stmt prevStmt = stmtVisitor.getPreviousDataFlowPathElement(currentStatement);
	if(prevStmt == null)
		throw new RuntimeException("there is no previous statement");
	else{			
		this.result = stmtVisitor.getBindingForTaintedValue(prevStmt);
		if(this.result == null)
			throw new RuntimeException("double check this here");
	}
}
 

import soot.jimple.CastExpr; //导入依赖的package包/类
/***** Taints *****/

	private FlowAbstraction getTaint(Value right, Value left, FlowAbstraction source, Unit src) {
		FlowAbstraction fa = null;

		if (right instanceof CastExpr)
			right = ((CastExpr) right).getOp();

		if (right instanceof Local && source.getLocal() == right) {
			fa = FlowAbstraction.v(source.getSource(), left, src, icfg.getMethodOf(src), source);
			fa = fa.append(source.getFields());
		} else if (right instanceof InstanceFieldRef) {
			InstanceFieldRef ifr = (InstanceFieldRef) right;
			if (source.hasPrefix(ifr)) {
				fa = FlowAbstraction.v(source.getSource(), left, src, icfg.getMethodOf(src), source);
				fa = fa.append(source.getPostfix(ifr));
			}
		} else if (right instanceof StaticFieldRef) {
			StaticFieldRef sfr = (StaticFieldRef) right;
			if (source.hasPrefix(sfr)) {
				fa = FlowAbstraction.v(source.getSource(), left, src, icfg.getMethodOf(src), source);
				fa = fa.append(source.getPostfix(sfr));
			}
		} else if (right instanceof ArrayRef) {
			ArrayRef ar = (ArrayRef) right;
			if (ar.getBase() == source.getLocal())
				fa = FlowAbstraction.v(source.getSource(), left, src, icfg.getMethodOf(src), source);
		}
		return fa;
	}
 

import soot.jimple.CastExpr; //导入依赖的package包/类
public void caseCastExpr(CastExpr v) {
	String oldName = varName;
	
	suggestVariableName("type");
	String lhsName = varName;
	ttp.setVariableName(varName);
	v.getType().apply(ttp);
	
	String rhsName = printValueAssignment(v.getOp(), "op");
	
	p.println("Value "+oldName+" = Jimple.v().newCastExpr("+lhsName+","+rhsName+");");
	
	varName = oldName;		
}
 

import soot.jimple.CastExpr; //导入依赖的package包/类
@Override
public void caseCastExpr(CastExpr ce) {
	Type castType = ce.getCastType();
	Value source = ce.getOp();
	constantV.setOrigStmt(origStmt);
	Register sourceReg = regAlloc.asImmediate(source, constantV);
	if (SootToDexUtils.isObject(castType)) {
		castObject(sourceReg, castType);
	} else {
		castPrimitive(sourceReg, source, castType);
	}
}
 

import soot.jimple.CastExpr; //导入依赖的package包/类
@Override
protected void internalTransform(Body body, String phaseName,
		Map<String, String> options) {
	Iterator<Unit> it = body.getUnits().snapshotIterator();
	while (it.hasNext()) {
		Unit u = it.next();
		if (u instanceof GotoStmt) {
			GotoStmt gtStmt = (GotoStmt) u;
			if (gtStmt.getTarget() instanceof AssignStmt) {
				AssignStmt assign = (AssignStmt) gtStmt.getTarget();
				if (assign.getRightOp() instanceof CastExpr) {
					CastExpr ce = (CastExpr) assign.getRightOp();
					// We have goto that ends up at a cast statement
					Unit nextStmt = body.getUnits().getSuccOf(assign);
					if (nextStmt instanceof ReturnStmt) {
						ReturnStmt retStmt = (ReturnStmt) nextStmt;
						if (retStmt.getOp() == assign.getLeftOp()) {
							// We need to replace the GOTO with the return
							ReturnStmt newStmt = (ReturnStmt) retStmt.clone();
							newStmt.setOp(ce.getOp());

							for (Trap t : body.getTraps())
								for (UnitBox ubox : t.getUnitBoxes())
									if (ubox.getUnit() == gtStmt)
										ubox.setUnit(newStmt);
							
							while (!gtStmt.getBoxesPointingToThis().isEmpty())
								gtStmt.getBoxesPointingToThis().get(0).setUnit(newStmt);
							body.getUnits().swapWith(gtStmt, newStmt);
						}
					}
				}
			}
		}
	}
}
 

import soot.jimple.CastExpr; //导入依赖的package包/类
/**
 * Stub for static method "void set(Object array, int index, Object value)
 * in class java.lang.reflect.Array.
 * Stub code is as follows:
 * t0 = (Object[])param0
 * t0[0] = param2
 * return
 */
private static SootMethod getArraySetEquiv(SootMethod m) {
	SootMethod s = genericMethod(m, false);
	JimpleBody body =(JimpleBody) s.retrieveActiveBody();
	SootClass c = s.getDeclaringClass();
	Chain<Unit> units = body.getUnits();
	Chain<Local> locals = body.getLocals();
	
	//t0 = (Object[])param0
	Local l0 = body.getParameterLocal(0);
	CastExpr ce0 = Jimple.v().newCastExpr(l0, ArrayType.v(RefType.v("java.lang.Object"), 1));
	Local t0 = Jimple.v().newLocal("t0", c.getType());
       locals.add(t0);
       units.add(Jimple.v().newAssignStmt(t0, ce0));
        
       //t0[0] = param2
       Local l2 = body.getParameterLocal(2);
       ArrayRef ar2 = Jimple.v().newArrayRef((Value)t0, (Value)IntConstant.v(0));
       units.add(Jimple.v().newAssignStmt(ar2, l2));
       
       //return
	units.add(Jimple.v().newReturnVoidStmt());
	
	methodToStub.put(m, s);
	methodToStub.put(s, s);
	if (Config.verbose >= 2)
		System.out.println("Custom stub (getArraySetEquiv) for method: " + s.getName() + ":" + s.getDeclaringClass());
	return s;
}
 

import soot.jimple.CastExpr; //导入依赖的package包/类
/**
 * Analyze an expression (a value) and computes an abstract value representing its contents.
 * @param r the expression to analyse.
 * @param u The unit that encapsulate the value.
 * @param seen What has already be seen (avoid loops).
 * @return
 */
public AbsValue analyze_expr(Value r, Unit u,  Set<Unit> seen) {
	AbsValue result;
	if (r instanceof Local) {
		result = analyzeLocal((Local) r, u, seen);
	} else if (r instanceof StringConstant)
		result = new StringValue(((StringConstant) r).value);
	else if (r instanceof Constant) 
		result = new ConstantValue((Constant) r,((Constant) r).getType());
	else if (r instanceof InvokeExpr) {
		result = analyzeInvoke((InvokeExpr) r,u,seen);
	} else if (r instanceof CastExpr) {
		result = analyze_expr(((CastExpr) r).getOp(),u,seen);
	} else if (r instanceof ParameterRef) {
		result = analyzeParameterRef((ParameterRef) r, u, seen);
	} else if (r instanceof ConditionExpr) {
		result = analyzeConditionExpr((ConditionExpr) r, u, seen);
	} else if (r instanceof InstanceOfExpr) {
		result = analyzeInstanceOfExpr((InstanceOfExpr) r, u, seen);
	} else if (r instanceof StaticFieldRef) {
		result = analyzeStaticFieldRef((StaticFieldRef) r,u,seen);
	} else if (r instanceof InstanceFieldRef) {
		result = analyzeInstanceFieldRef((InstanceFieldRef) r,u,seen);
	} else if (r instanceof ArrayRef) {
		result = analyzeArrayRef((ArrayRef) r,u,seen);
	} else if (r instanceof NewExpr) {
		result = analyzeNewExpr((NewExpr) r, u, seen);
	} else {
		result = new UnknownValue(r.toString());
	}
	return solve_init(result,u,seen);
}
 

import soot.jimple.CastExpr; //导入依赖的package包/类
/**
 * extracts array base values from array refs and values from cast
 * expressions
 */
public static Value getBackwardsBase(Value val) {
	if (val instanceof ArrayRef) {
		ArrayRef arrayRef = (ArrayRef) val;
		return arrayRef.getBase();
	}
	if (val instanceof CastExpr) {
		CastExpr castExpr = (CastExpr) val;
		return castExpr.getOp();
	}
	return val;
}
 

import soot.jimple.CastExpr; //导入依赖的package包/类
/**
 * extracts array base values from array refs and values from cast
 * expressions
 */
private Value getBase(Value val) {
	if (val instanceof ArrayRef) {
		ArrayRef arrayRef = (ArrayRef) val;
		return arrayRef.getBase();
	}
	if (val instanceof CastExpr) {
		CastExpr castExpr = (CastExpr) val;
		return castExpr.getOp();
	}
	return val;
}
 

import soot.jimple.CastExpr; //导入依赖的package包/类
@Override
public KillGenInfo propagateNormalFlow(Trackable trackable, Unit curr, Unit succ) {
	Taint taint = (Taint) trackable;
	if (curr instanceof DefinitionStmt) {
		DefinitionStmt defStmt = (DefinitionStmt) curr;

		Value rightBase = AnalysisUtil.getForwardsBase(defStmt.getRightOp());
		Value leftBase = AnalysisUtil.getForwardsBase(defStmt.getLeftOp());

		if (leftBase.equals(rightBase)) // x = x; or x[i] = x[j]; -> do
										// nothing
			return identity();

		// kill the LHS if it is assigned another value
		Value left = defStmt.getLeftOp();
		if (left instanceof Local && taint.value.equals(left)) {
			return kill();
		}

		if (rightBase instanceof CastExpr) {
			CastExpr castExpr = (CastExpr) rightBase;
			if (AnalysisUtil.maybeSameLocation(taint.value, castExpr.getOp())) {
				if (AnalysisUtil.isAssignable(taint.type, leftBase.getType())) {
					return gen(taint.createAlias(leftBase, curr));
				} else {
					return identity();
				}
			}
		}

		// at assignments, propagate taint from right to left
		if (taint.value.equivTo(rightBase) || AnalysisUtil.maybeSameLocation(taint.value, rightBase)) {
			return gen(taint.createAlias(leftBase, curr));
		}
	}
	return identity();
}
 

import soot.jimple.CastExpr; //导入依赖的package包/类
@Override
public void caseCastExpr(CastExpr v) {
    if (v.getCastType() instanceof ArrayType) {
        throw new CastInvalidException(getMsg("exception.analysis.other.cast",
                                              v.getOp().toString()));
    }
    handleUnaryExpr(v.getOp());
}
 

import soot.jimple.CastExpr; //导入依赖的package包/类
@Override
public void caseCastExpr(CastExpr v) {
	rightElement = RightElement.NOT;
		
	if (actualContext == StmtContext.ASSIGNRIGHT) {
		// new InternalAnalyzerException();
	}
}
 

import soot.jimple.CastExpr; //导入依赖的package包/类
private void assign(Local lhs, Value rhs, Map<Local, SignAnalysis.Sign> input, Map<Local, SignAnalysis.Sign> output) {
	// We only care about numeric locals
	if (lhs.getType() instanceof IntType) {			
		// First remove casts, if any.
		if (rhs instanceof CastExpr) {
			rhs = ((CastExpr) rhs).getOp();
		}	
		// Determine the sign of the RHS and add it to the map
		Sign sign = signOf(rhs, input);
		output.put(lhs, sign);
	}
}