import soot.toolkits.graph.BriefUnitGraph; //导入依赖的package包/类
protected void internalTransform(Body b, String phaseName, 
                                 java.util.Map options)
{
    NullnessAnalysis na = new NullnessAnalysis(new BriefUnitGraph(b));

    java.util.Iterator uIt = b.getUnits().iterator();
    while (uIt.hasNext())
    {
        Unit u = (Unit)uIt.next();

        StringBuffer n = new StringBuffer();
        u.addTag(new StringTag("IN: "+na.getFlowBefore(u).toString()));

        if (u.fallsThrough())
        { 
            ArraySparseSet s = (ArraySparseSet)na.getFallFlowAfter(u);
            u.addTag(new StringTag("FALL: "+s.toString())); 
        }
        if (u.branches())
        { 
            ArraySparseSet t = (ArraySparseSet)na.
                getBranchFlowAfter(u).get(0);
            u.addTag(new StringTag("BRANCH: "+t.toString())); 
        }
    }
}
 

import soot.toolkits.graph.BriefUnitGraph; //导入依赖的package包/类
private boolean checkCandidate(List<Unit> succs, BriefUnitGraph bug) {
  if (succs.size() < 2)
    return false;
  
  Object o = succs.get(0);
  for (int i = 1; i < succs.size(); i++) {
    if (succs.get(i).getClass() != o.getClass()) 
      return false;
  }
  
  if (o instanceof BLoadInst) {
    BLoadInst bl = (BLoadInst)o;
    Local l = bl.getLocal();
    for (int i = 1; i < succs.size(); i++) {
      BLoadInst bld = (BLoadInst)succs.get(i);
      if (bld.getLocal() != l || bug.getPredsOf(bld).size() > 1)
        return false;
    }
    return true;
  }
  
  return false;
}
 

import soot.toolkits.graph.BriefUnitGraph; //导入依赖的package包/类
@Override
protected void analyse(SootClass clazz, SootMethod method, Body body) {
	if (!clazz.implementsInterface(Types.HOSTNAME_VERIFIER.getClassName()))
		return;

	if (!Signatures.methodSignatureMatches(method, BooleanType.v(), "verify", Types.STRING, Types.SSL_SESSION))
		return;

	VulnerabilityState state = VulnerabilityState.UNKNOWN;

	UnitGraph graph = new BriefUnitGraph(body);
	if (FlowGraphUtils.allExitsReturnTrue(graph)) {
		state = VulnerabilityState.VULNERABLE;
	}

	clazz.addTag(new HostnameVerifierTag(state));
	vulnerabilities.add(new Vulnerability(clazz, VulnerabilityType.PERMISSIVE_HOSTNAME_VERIFIER, state));
}
 

import soot.toolkits.graph.BriefUnitGraph; //导入依赖的package包/类
/**
 * This method is called to perform the transformation itself. The method
 * executes the {@link SecurityLevelAnalysis} analysis and checks the
 * <em>write effects</em>, if the given body isn't from a
 * {@code SootSecurityLevel} method.
 * 
 * @param body
 *            The body on which to apply the transformation.
 * @param phaseName
 *            The phase name for this transform; not typically used by
 *            implementations.
 * @param options
 *            The actual computed options; a combination of default options
 *            and Scene specified options.
 * @see soot.BodyTransformer#internalTransform(soot.Body, java.lang.String,
 *      java.util.Map)
 */
@SuppressWarnings("rawtypes")
@Override
protected void internalTransform(Body body, String phaseName, Map options) {
    doInitialChecks();
    UnitGraph graph = new BriefUnitGraph(body);
    SootMethod sootMethod = graph.getBody().getMethod();
    SootClass sootClass = sootMethod.getDeclaringClass();
    if (!isInnerClassOfDefinitionClass(sootClass)) {
        if (!visitedClasses.contains(sootClass)) {
            if (!containsStaticInitializer(sootClass.getMethods())) {
                SootMethod clinit =
                    generatedEmptyStaticInitializer(sootClass);
                UnitGraph clinitGraph =
                    new BriefUnitGraph(clinit.getActiveBody());
                doAnalysis(clinit, clinitGraph);
            }
            visitedClasses.add(sootClass);
        }
        if ((!isMethodOfDefinitionClass(sootMethod))
            || isLevelFunction(sootMethod, mediator.getAvailableLevels())) {
            doAnalysis(sootMethod, graph);
        }
    }
}
 

import soot.toolkits.graph.BriefUnitGraph; //导入依赖的package包/类
public static Unit getPostDominatorOfUnit(IInfoflowCFG cfg, Unit dataFlowStatement) {		
	Map<Unit, Set<ControlFlowPath>> controlFlowPathsAtUnit = new HashMap<Unit, Set<ControlFlowPath>>();
	Set<ControlFlowPath> currentPaths = new HashSet<ControlFlowPath>();
	Stack<Unit> worklist = new Stack<Unit>();
	worklist.add(dataFlowStatement);	

	while(!worklist.isEmpty()) {
		Unit currentUnit = worklist.pop();
		
		if(currentUnit.hasTag(InstrumentedCodeTag.name)) {
			List<Unit> successors = cfg.getSuccsOf(currentUnit);
			
			for(Unit nextUnit : successors) {
				if(proceedWithNextUnit(currentUnit, nextUnit, currentPaths, controlFlowPathsAtUnit)) {
					worklist.push(nextUnit);				
				}
			}
			continue;
		}
		
		SootMethod currentMethod = cfg.getMethodOf(currentUnit);
		
		//this is a kind of hack: We excluded exception-edges here and also keep in mind that ALL dominator-algorithms are intra-procedural
		MHGPostDominatorsFinder<Unit> postdominatorFinder = new MHGPostDominatorsFinder<Unit>(new BriefUnitGraph(currentMethod.retrieveActiveBody()));
		Unit immediatePostDominator = postdominatorFinder.getImmediateDominator(currentUnit);
		while(immediatePostDominator.hasTag(InstrumentedCodeTag.name)) {
			immediatePostDominator = postdominatorFinder.getImmediateDominator(immediatePostDominator);
		}
		return immediatePostDominator;
	}	
	return null;
}
 

import soot.toolkits.graph.BriefUnitGraph; //导入依赖的package包/类
/**
 * DOC
 * 
 * @param sootClass
 */
private void doExtraction(SootClass sootClass) {
    if (!isInnerClassOfDefinitionClass(sootClass)) {
        addClassEnvironmentForClass(sootClass);
        if (!isDefinitionClass(sootClass)) {
            for (SootField sootField : sootClass.getFields()) {
                addFieldEvironmentForField(sootField);
            }
        }
        if (!containsStaticInitializer(sootClass.getMethods())) {
            generatedEmptyStaticInitializer(sootClass);
        }
        for (SootMethod sootMethod : sootClass.getMethods()) {
            if ((!isMethodOfDefinitionClass(sootMethod))
                || isLevelFunction(sootMethod,
                                   mediator.getAvailableLevels())) {
                UnitGraph graph =
                    new BriefUnitGraph(sootMethod.retrieveActiveBody());
                sootMethod = graph.getBody().getMethod();
                addMethodEnvironmentForMethod(sootMethod);
                if (sootMethod.hasActiveBody()) {
                    for (Unit unit : sootMethod.getActiveBody().getUnits()) {
                        try {
                            unit.apply(stmtSwitch);
                        } catch (SwitchException e) {
                            throw new ExtractorException(getMsg("exception.extractor.other.error_switch",
                                                                unit.toString(),
                                                                getSignatureOfMethod(sootMethod)),
                                                         e);
                        }
                    }
                }
            }
        }
    }
}
 

import soot.toolkits.graph.BriefUnitGraph; //导入依赖的package包/类
/**
 * Constructor. Has only to be called once in BodyAnalyzer.
 * @param body The body of the actual analyzed method.
 */
public static void init(Body body) {
	graph = new BriefUnitGraph(body);
	pdfinder = new MHGPostDominatorsFinder(graph);
	domList = new HashMap<Unit, String>();
	identity = 0;
}
 

import soot.toolkits.graph.BriefUnitGraph; //导入依赖的package包/类
/**
 * Creates a new WriteEffectCollector for the given body.
 * @param b The body that shall be analyzed for having write Effects.
 */
public WriteEffectCollector(Body b) {
    graph = new BriefUnitGraph(b);
    postDom = new MHGPostDominatorsFinder<>(graph);
    preDom = new MHGDominatorsFinder<>(graph);
    instanceCache = new HashMap<>();
    logger.setLevel(Level.FINE);
}
 

import soot.toolkits.graph.BriefUnitGraph; //导入依赖的package包/类
public DirectedGraph buildGraph(Body b) { 
return new BriefUnitGraph(b); 
     }
 

import soot.toolkits.graph.BriefUnitGraph; //导入依赖的package包/类
public MyCastChecker(BriefUnitGraph cfg) {
    super(cfg);
}
 

import soot.toolkits.graph.BriefUnitGraph; //导入依赖的package包/类
/**
 * @param args
 * @throws IOException 
 */
public FindClearRestoreUid(SootClass mclass) throws IOException {
	out = new BufferedWriter(new FileWriter(FILE));

   	List<SootMethod> methods = mclass.getMethods();
   	Iterator<SootMethod> iter = methods.iterator();
   	
   	while (iter.hasNext()) {
   		SootMethod m = iter.next();
   		if (! m.isConcrete()) continue;
   		try {
   			Body b = m.retrieveActiveBody();
   			boolean foundclear = false;
   			boolean foundrestore = false;
   			Iterator<Unit> units = b.getUnits().iterator();
   			List<Unit> clears = new ArrayList<Unit>();
   			List<Unit> restores = new ArrayList<Unit>();
   			while (units.hasNext()) {
   				Stmt s = (Stmt) units.next();
   				if (s.containsInvokeExpr()) {
   					String mstring = s.getInvokeExpr().getMethod().toString();
   					//if (m.toString().equals("<com.android.server.NotificationManagerService: void enqueueToast(java.lang.String,android.app.ITransientNotification,int)>")) {print (mstring);}
   					if (mstring.equals("<android.os.Binder: long clearCallingIdentity()>")) {
   						foundclear = true;
   						clears.add(s);
   					} else if (mstring.equals("<android.os.Binder: void restoreCallingIdentity(long)>")) {
   						foundrestore = true;
   						restores.add(s);
   					} 
   				}
   			}
   			
   			if (!foundclear || !foundrestore) continue;

   			BriefUnitGraph ug = new BriefUnitGraph(b);
   			Iterator<Unit> iter_c = clears.iterator();
   			while (iter_c.hasNext()) {
   				Unit from = iter_c.next();
   				Iterator<Unit> iter_r = restores.iterator();
   				while (iter_r.hasNext()) {
   					Unit to = iter_r.next();	    					
   					List<Unit> resultslist = ug.getExtendedBasicBlockPathBetween(from, to);
   					if (resultslist != null) {
   						Iterator<Unit> results = resultslist.iterator();
    					while (results.hasNext()) {
    						Stmt rs = (Stmt) results.next();
    						if (rs.containsInvokeExpr()) {
    							print (m.toString()+";"+rs.getInvokeExpr().getMethod().toString());
    						}
    					}
   					} else {
   						seen.clear();
   						findAllUnitsBeforeRestore(restores, from, ug, m.toString());
   					}
   					/*List<Unit> beforeto = ug.getPredsOf(to);
   					
   					Iterator<Unit> results = afterfrom.iterator();
   					while (results.hasNext()) {
   						Stmt rs = (Stmt) results.next();
   						print (rs.toString());
   						if (!beforeto.contains(rs)) continue;
   						if (rs.containsInvokeExpr()) {
   							print (m.toString()+";"+rs.toString());
   						}
   					}*/
   				}
   			}
   			
   		} catch (RuntimeException e) {	   
   			System.err.println("ERROR:"+m.toString()+" "+e.getMessage()); 			
   		}
   	}
   	out.close();
}