import soot.toolkits.graph.UnitGraph; //导入依赖的package包/类
public StringValues(UnitGraph graph, Stack<SootMethod> stack)
 {

     StringAnalysis analysis = new StringAnalysis(graph, stack);

     // build map
     {
         unitToStringAnalysis = new HashMap<Unit, List>(graph.size() * 2 + 1, 0.7f);
         Iterator unitIt = graph.iterator();

while (unitIt.hasNext()) {
	Unit s = (Unit) unitIt.next();
	FlowSet setB = (FlowSet) analysis.getFlowBefore(s);
	FlowSet setA = (FlowSet) analysis.getFlowAfter(s);
	List listB = setB.toList();
	List listA = setA.toList();
	List unionList = new ArrayList();
	unionList.addAll(listA);
	unionList.addAll(listB);
	unitToStringAnalysis.put(s,Collections.unmodifiableList((unionList)));
}
     }
 }
 

import soot.toolkits.graph.UnitGraph; //导入依赖的package包/类
private static void getUnitInBetween(UnitGraph ug, List<Unit>inBetween, Unit u) {

    for (Unit succ: ug.getSuccsOf(u)) {
      Stmt s = (Stmt)succ;
      if (inBetween.contains(succ)) {
        continue;
      }
      if (s.containsInvokeExpr()) {
        InvokeExpr ie = s.getInvokeExpr();
        if (ie.getMethodRef().name().contains("restoreCallingIdentity")) {
          return;
        } 
      }
      inBetween.add(succ);
      getUnitInBetween(ug, inBetween, succ);
    }
  }
 

import soot.toolkits.graph.UnitGraph; //导入依赖的package包/类
/**
 * Creates a new loop. Expects that the last statement in the list is the loop head
 * and the second-last statement is the back-jump to the head. {@link LoopFinder} will
 * normally guarantee this.
 * @param head the loop header
 * @param loopStatements an ordered list of loop statements, ending with the header
 * @param g the unit graph according to which the loop exists
 */
Loop(Stmt head, List<Stmt> loopStatements, UnitGraph g) {
    this.header = head;
    this.g = g;

    //put header to the top
    loopStatements.remove(head);
    loopStatements.add(0, head);
    
    //last statement
    this.backJump = loopStatements.get(loopStatements.size()-1);
    
    assert g.getSuccsOf(this.backJump).contains(head); //must branch back to the head

    this.loopStatements = loopStatements;
}
 

import soot.toolkits.graph.UnitGraph; //导入依赖的package包/类
/**
    * Creates a new {@link LocalMustAliasAnalysis}. If tryTrackFieldAssignments,
    * we run an interprocedural side-effects analysis to determine which fields
    * are (transitively) written to by this method. All fields which that are not written
    * to are tracked just as local variables. This semantics is sound for single-threaded programs.  
    */
public LocalMustAliasAnalysis(UnitGraph g, boolean tryTrackFieldAssignments) {
       super(g);
       this.container = g.getBody().getMethod();
       this.localsAndFieldRefs = new HashSet<Value>(); 
       
       //add all locals
       for (Local l : (Collection<Local>) g.getBody().getLocals()) {
           if (l.getType() instanceof RefLikeType)
               this.localsAndFieldRefs.add(l);
       }
	
       if(tryTrackFieldAssignments) {
       	this.localsAndFieldRefs.addAll(trackableFields());
       }

      	this.rhsToNumber = new HashMap<Value, Integer>();
       this.mergePointToValueToNumber = new HashMap<Unit,Map<Value,Integer>>();
       
       doAnalysis();
       
       //not needed any more
       this.rhsToNumber = null;
       this.mergePointToValueToNumber = null;
   }
 

import soot.toolkits.graph.UnitGraph; //导入依赖的package包/类
protected void internalTransform(Body b, String phaseName, Map<String, String> options) {
	if (!b.getMethod().isSynchronized() || b.getMethod().isStatic())
		return;
	
	Iterator<Unit> it = b.getUnits().snapshotIterator();
	while (it.hasNext()) {
		Unit u = it.next();
		if (u instanceof IdentityStmt)
			continue;
		
		// This the first real statement. If it is not a MonitorEnter
		// instruction, we generate one
		if (!(u instanceof EnterMonitorStmt)) {
			b.getUnits().insertBeforeNoRedirect(Jimple.v().newEnterMonitorStmt(b.getThisLocal()), u);
			
			// We also need to leave the monitor when the method terminates
			UnitGraph graph = new ExceptionalUnitGraph(b);
			for (Unit tail : graph.getTails())
    			b.getUnits().insertBefore(Jimple.v().newExitMonitorStmt(b.getThisLocal()), tail);
		}
		break;
	}
}
 

import soot.toolkits.graph.UnitGraph; //导入依赖的package包/类
/**
 * Computes the analysis given a UnitGraph computed from a method body. It
 * is recommended that a ExceptionalUnitGraph (or similar) be provided for
 * correct results in the case of exceptional control flow.
 *
 * @param graph a graph on which to compute the analysis.
 * 
 * @see ExceptionalUnitGraph
 */
public SimpleLiveLocals(UnitGraph graph) {
	if (Options.v().time())
		Timers.v().liveTimer.start();

	if (Options.v().verbose())
		G.v().out.println("[" + graph.getBody().getMethod().getName()
				+ "]     Constructing SimpleLiveLocals...");

	analysis = new Analysis(graph);

	if (Options.v().time())
		Timers.v().liveAnalysisTimer.start();

	analysis.doAnalysis();

	if (Options.v().time())
		Timers.v().liveAnalysisTimer.end();

	if (Options.v().time())
		Timers.v().liveTimer.end();
}
 

import soot.toolkits.graph.UnitGraph; //导入依赖的package包/类
void findAllUnitsBeforeRestore(List<Unit> restores, Unit from, UnitGraph ug, String mname) throws IOException {
	seen.add(from);
	Iterator<Unit> succ = ug.getSuccsOf(from).iterator();
	while(succ.hasNext()) {
		Stmt s = (Stmt) succ.next();
		if (restores.contains(s)) {
			//done
		} else {
			if (s.containsInvokeExpr()) {
				print (mname+";"+s.getInvokeExpr().getMethod().toString());
			}
			if (!seen.contains(s))
				findAllUnitsBeforeRestore(restores, s, ug, mname);
		}
	}
}
 

import soot.toolkits.graph.UnitGraph; //导入依赖的package包/类
@Override
protected void analyse(SootClass clazz, SootMethod method, Body body) {
	if (!clazz.implementsInterface(Types.X509_TRUST_MANAGER.getClassName()))
		return;

	if (!Signatures.methodSignatureMatches(method, VoidType.v(), "checkServerTrusted", Types.X509_CERTIFICATE_ARRAY, Types.STRING))
		return;

	VulnerabilityState state = VulnerabilityState.UNKNOWN;

	UnitGraph graph = new ExceptionalUnitGraph(body);
	if (!FlowGraphUtils.anyExitThrowsException(graph, Types.CERTIFICATE_EXCEPTION)) {
		state = VulnerabilityState.VULNERABLE;
	}

	clazz.addTag(new TrustManagerTag(state));
	vulnerabilities.add(new Vulnerability(clazz, VulnerabilityType.PERMISSIVE_TRUST_MANAGER, state));
}
 

import soot.toolkits.graph.UnitGraph; //导入依赖的package包/类
@Override
protected void analyse(SootClass clazz, SootMethod method, Body body) {
	if (!clazz.getSuperclass().getType().equals(Types.ABSTRACT_VERIFIER))
		return;

	if (!Signatures.methodSignatureMatches(method, VoidType.v(), "verify", Types.STRING, Types.STRING_ARRAY, Types.STRING_ARRAY))
		return;

	VulnerabilityState state = VulnerabilityState.UNKNOWN;

	UnitGraph graph = new ExceptionalUnitGraph(body);
	if (!FlowGraphUtils.anyExitThrowsException(graph, Types.SSL_EXCEPTION)) {
		state = VulnerabilityState.VULNERABLE;
	}

	clazz.addTag(new HostnameVerifierTag(state));
	vulnerabilities.add(new Vulnerability(clazz, VulnerabilityType.PERMISSIVE_HOSTNAME_VERIFIER, state));
}
 

import soot.toolkits.graph.UnitGraph; //导入依赖的package包/类
@Override
protected void analyse(SootClass clazz, SootMethod method, Body body) {
	if (!clazz.implementsInterface(Types.HOSTNAME_VERIFIER.getClassName()))
		return;

	if (!Signatures.methodSignatureMatches(method, BooleanType.v(), "verify", Types.STRING, Types.SSL_SESSION))
		return;

	VulnerabilityState state = VulnerabilityState.UNKNOWN;

	UnitGraph graph = new BriefUnitGraph(body);
	if (FlowGraphUtils.allExitsReturnTrue(graph)) {
		state = VulnerabilityState.VULNERABLE;
	}

	clazz.addTag(new HostnameVerifierTag(state));
	vulnerabilities.add(new Vulnerability(clazz, VulnerabilityType.PERMISSIVE_HOSTNAME_VERIFIER, state));
}
 

import soot.toolkits.graph.UnitGraph; //导入依赖的package包/类
/**
 * This method is called to perform the transformation itself. The method
 * executes the {@link SecurityLevelAnalysis} analysis and checks the
 * <em>write effects</em>, if the given body isn't from a
 * {@code SootSecurityLevel} method.
 * 
 * @param body
 *            The body on which to apply the transformation.
 * @param phaseName
 *            The phase name for this transform; not typically used by
 *            implementations.
 * @param options
 *            The actual computed options; a combination of default options
 *            and Scene specified options.
 * @see soot.BodyTransformer#internalTransform(soot.Body, java.lang.String,
 *      java.util.Map)
 */
@SuppressWarnings("rawtypes")
@Override
protected void internalTransform(Body body, String phaseName, Map options) {
    doInitialChecks();
    UnitGraph graph = new BriefUnitGraph(body);
    SootMethod sootMethod = graph.getBody().getMethod();
    SootClass sootClass = sootMethod.getDeclaringClass();
    if (!isInnerClassOfDefinitionClass(sootClass)) {
        if (!visitedClasses.contains(sootClass)) {
            if (!containsStaticInitializer(sootClass.getMethods())) {
                SootMethod clinit =
                    generatedEmptyStaticInitializer(sootClass);
                UnitGraph clinitGraph =
                    new BriefUnitGraph(clinit.getActiveBody());
                doAnalysis(clinit, clinitGraph);
            }
            visitedClasses.add(sootClass);
        }
        if ((!isMethodOfDefinitionClass(sootMethod))
            || isLevelFunction(sootMethod, mediator.getAvailableLevels())) {
            doAnalysis(sootMethod, graph);
        }
    }
}
 

import soot.toolkits.graph.UnitGraph; //导入依赖的package包/类
private static IfStmt findConditionalStatementForBooleanUnit(IInfoflowCFG cfg, Unit booleanUnit) {
	Stack<Unit> worklist = new Stack<Unit>();
	Set<Unit> processedUnits = new HashSet<Unit>();
	worklist.add(booleanUnit);	
		
	while(!worklist.isEmpty()) {
		Unit currentUnit = worklist.pop();
		//in case of a loop or recursion
		if(processedUnits.contains(currentUnit))
			continue;
		processedUnits.add(currentUnit);
		
		//skip our own instrumented code
		if(currentUnit.hasTag(InstrumentedCodeTag.name))
			continue;
		
		
		//we reached the condition
		if(currentUnit instanceof IfStmt) {
			return (IfStmt)currentUnit;		 	
		}
		
		SootMethod methodOfBooleanUnit = cfg.getMethodOf(booleanUnit);		
		DirectedGraph<Unit> graph = cfg.getOrCreateUnitGraph(methodOfBooleanUnit);
		//Comment: Steven said it should always be a UnitGraph + he will implement a more convenient way in the near future :-)
		UnitGraph unitGraph = (UnitGraph)graph;

		SimpleLocalDefs defs = new SimpleLocalDefs(unitGraph);
        SimpleLocalUses uses = new SimpleLocalUses(unitGraph, defs);	        
        List<UnitValueBoxPair> usesOfCurrentUnit = uses.getUsesOf(booleanUnit);
        for(UnitValueBoxPair valueBoxPair : usesOfCurrentUnit)
        	worklist.add(valueBoxPair.getUnit());
		
	}
	return null;
}
 

import soot.toolkits.graph.UnitGraph; //导入依赖的package包/类
private String findUriDef(Body b, Unit u, Local l) {
    final UnitGraph g = new ExceptionalUnitGraph(b);
    final SmartLocalDefs localDefs = new SmartLocalDefs(g, new SimpleLiveLocals(g));
    final SimpleLocalUses localUses = new SimpleLocalUses(g, localDefs);

    List<Unit> defs = localDefs.getDefsOfAt((Local) l, u);
    if (defs.size() == 0) {
        System.out.println("warning: uri def empty!");
        return null;
    }
    Unit def = defs.get(0);
    logger.debug("uri def: " + def);
    if (def instanceof IdentityStmt) {
        System.out.println("warning: do not handle uri from identity stmt");
        return null;
    } else if (def instanceof AssignStmt) {
        AssignStmt ass = (AssignStmt) def;
        Value r = ass.getRightOp();
        if (r instanceof FieldRef) {
            FieldRef fr = (FieldRef) r;
            SootField sf = fr.getField();
            if (sf.getName().contains("URI")) {
                String auth = getFieldFromClass(sf);
                return auth;
            }
        } else {
            System.out.println("warning: uri: do not handle def '" + def + "'");
            return null;
        }
    }
    return null;
}
 

import soot.toolkits.graph.UnitGraph; //导入依赖的package包/类
StrayRWFinder(UnitGraph graph, Body b, List tns)
{
	super(graph);
	body = b;
	this.tns = tns;
	if( G.v().Union_factory == null ) {
	    G.v().Union_factory = new UnionFactory() {
		public Union newUnion() { return FullObjectSet.v(); }
	    };
	}
   	sea = Scene.v().getSideEffectAnalysis();
	sea.findNTRWSets( body.getMethod() );
       doAnalysis();
}
 

import soot.toolkits.graph.UnitGraph; //导入依赖的package包/类
public MultiRunStatementsFinder(UnitGraph g, SootMethod sm, Set<SootMethod> multiCalledMethods, CallGraph cg)
{
	super(g);
	
	nodeToIndex = new HashMap<Object, Integer>();
			
	//      System.out.println("===entering MultiObjectAllocSites==");	
	doAnalysis();
	
	//testMultiObjSites(sm);
	findMultiCalledMethodsIntra(multiCalledMethods, cg);
	
	// testMultiObjSites(sm);
}
 

import soot.toolkits.graph.UnitGraph; //导入依赖的package包/类
private void byMCalledS0(PegCallGraph pcg) {
	Iterator it = pcg.iterator();
	while (it.hasNext()){
		SootMethod sm = (SootMethod)it.next();
		UnitGraph graph = new CompleteUnitGraph(sm.getActiveBody());
		CallGraph callGraph = Scene.v().getCallGraph();
		MultiRunStatementsFinder finder = new MultiRunStatementsFinder(graph, sm, multiCalledMethods, callGraph);
		FlowSet fs = finder.getMultiRunStatements();
	}
	
}
 

import soot.toolkits.graph.UnitGraph; //导入依赖的package包/类
/**
 * Checks whether the given local has been redefined between the original
 * definition unitDef and the use unitUse.
 * @param l The local for which to check for redefinitions
 * @param unitUse The unit that uses the local
 * @param unitDef The unit that defines the local
 * @param graph The unit graph to use for the check
 * @return True if there is at least one path between unitDef and unitUse on
 * which local l gets redefined, otherwise false 
 */
   private boolean isRedefined(Local l, Unit unitUse, AssignStmt unitDef,
   		UnitGraph graph) {
   	List<Unit> workList = new ArrayList<Unit>();
   	workList.add(unitUse);
   	
   	Set<Unit> doneSet = new HashSet<Unit>();
   	
	// Check for redefinitions of the local between definition and use
   	while (!workList.isEmpty()) {
   		Unit curStmt = workList.remove(0);
   		if (!doneSet.add(curStmt))
   			continue;
   		
    	for (Unit u : graph.getPredsOf(curStmt)) {
    		if (u != unitDef) {
	    		if (u instanceof DefinitionStmt) {
	    			DefinitionStmt defStmt = (DefinitionStmt) u;
	    			if (defStmt.getLeftOp() == l)
	    				return true;
	    		}
	    		workList.add(u);
    		}
    	}
   	}
   	return false;
}
 

import soot.toolkits.graph.UnitGraph; //导入依赖的package包/类
public Set<Unit> getUnitsWithMonitor(UnitGraph ug) {
	Set<Unit> unitsWithMonitor = new HashSet<Unit>();
	
	for (Unit head : ug.getHeads()) {
		List<Unit> workList = new ArrayList<Unit>();
		workList.add(head);
		Set<Unit> doneSet = new HashSet<Unit>();
		
		while (!workList.isEmpty()) {
			Unit curUnit = workList.remove(0);
			if (!doneSet.add(curUnit))
				continue;
			
			workList.addAll(ug.getSuccsOf(curUnit));
			
			// If this is an "entermonitor" construct,
			// we're in a monitor from now on
			if (curUnit instanceof EnterMonitorStmt)
				unitsWithMonitor.add(curUnit);
			// If we leave a monitor, we're out now
			else if (curUnit instanceof ExitMonitorStmt)
				continue;
			else {
				for (Unit pred : ug.getPredsOf(curUnit))
					if (unitsWithMonitor.contains(pred))
						unitsWithMonitor.add(curUnit);
			}
		}
	}
	
	// Get rid of the entermonitor statements themselves
	for (Iterator<Unit> it = unitsWithMonitor.iterator(); it.hasNext(); )
		if (it.next() instanceof EnterMonitorStmt)
			it.remove();
	
	return unitsWithMonitor;
}
 

import soot.toolkits.graph.UnitGraph; //导入依赖的package包/类
public InitAnalysis(UnitGraph g) {
    super(g);
    allLocals = new ArraySparseSet<Local>();        
    for (Local loc : g.getBody().getLocals()) {
        allLocals.add(loc);
    }

    doAnalysis();
}
 

import soot.toolkits.graph.UnitGraph; //导入依赖的package包/类
public Region(int id, List<Block> blocks, SootMethod m, SootClass c, UnitGraph ug)
{
	
	this.m_blocks = blocks;
	this.m_id = id;
	this.m_method = m;
	this.m_class = c;
	this.m_unitGraph = ug;
	this.m_units = null;
	
	
}