import soot.jimple.Constant; //导入依赖的package包/类
@Override
public void caseReturnStmt(ReturnStmt stmt) {
	//in case of return CONSTANT, we do nothing; unfortunately, this is part of FlowDroid's path
	if(stmt.getOp() instanceof Constant)
		return;
	int index = jimpleDataFlowStatements.indexOf(stmt);
	AccessPath ap = accessPathPath.get(index);
	Local local = ap.getPlainValue();
			
	SMTBinding lhs = createNewBindingForValue(local);
	addValueBindingToVariableDeclaration(local, lhs);
	
	if(!hasBindingForValue(stmt.getOp()))
		throw new RuntimeException("There has to be a tainted value");
	SMTBinding rhs = getLatestBindingForValue(stmt.getOp());
	
	SMTSimpleAssignment simpleAss = new SMTSimpleAssignment(lhs, new SMTBindingValue(rhs));
	SMTAssertStatement assertStmt = new SMTAssertStatement(simpleAss);
	addAssertStmtToAllPrograms(assertStmt);	
}
 

import soot.jimple.Constant; //导入依赖的package包/类
private Map<Unit, Body> getStmtsWithConstants() {
  Map<Unit, Body> retMap = new LinkedHashMap<Unit, Body>();
  for (SootClass sc : Scene.v().getClasses()) {
    for (SootMethod sm : sc.getMethods()) {
      if (!sm.hasActiveBody())
        continue;
      Body methodBody = sm.retrieveActiveBody();
      for (Unit u : methodBody.getUnits()) {
        if (u instanceof ReturnStmt) {
          if (((ReturnStmt) u).getOp() instanceof Constant) {
            retMap.put(u, methodBody);
          }
        } else if (((Stmt) u).containsInvokeExpr()) {
          InvokeExpr ie = ((Stmt) u).getInvokeExpr();
          for (Value arg : ie.getArgs()) {
            if (arg instanceof StringConstant || arg instanceof NumericConstant) {
              retMap.put(u, methodBody);
              break;
            }
          }
        }
      }
    }
  }
  return retMap;
}
 

import soot.jimple.Constant; //导入依赖的package包/类
/**
 * Gets whether two values may potentially point to the same runtime object
 * @param val1 The first value
 * @param val2 The second value
 * @return True if the two values may potentially point to the same runtime
 * object, otherwise false
 */
public boolean mayAlias(Value val1, Value val2) {
	// What cannot be represented in an access path cannot alias
	if (!AccessPath.canContainValue(val1) || !AccessPath.canContainValue(val2))
		return false;
	
	// Constants can never alias
	if (val1 instanceof Constant || val2 instanceof Constant)
		return false;
	
	// If the two values are equal, they alias by definition
	if (val1 == val2)
		return true;
	
	// If we have an interactive aliasing algorithm, we check that as well
	if (aliasingStrategy.isInteractive())
		return aliasingStrategy.mayAlias(new AccessPath(val1, false), new AccessPath(val2, false));
	
	return false;		
}
 

import soot.jimple.Constant; //导入依赖的package包/类
@Override
public boolean supportsCallee(Stmt callSite) {
	// We need an invocation expression
	if (!callSite.containsInvokeExpr())
		return false;

	SootMethod method = callSite.getInvokeExpr().getMethod();
	if (!supportsCallee(method))
		return false;
			
	// We need a method that can create a taint
	if (!aggressiveMode) {
		// Check for a cached wrap type
		final MethodWrapType wrapType = methodWrapCache.getUnchecked(method);
		if (wrapType != MethodWrapType.CreateTaint)
			return false;
	}
	
	// We need at least one non-constant argument or a tainted base
	if (callSite.getInvokeExpr() instanceof InstanceInvokeExpr)
		return true;
	for (Value val : callSite.getInvokeExpr().getArgs())
		if (!(val instanceof Constant))
			return true;
	return false;
}
 

import soot.jimple.Constant; //导入依赖的package包/类
public void toString(UnitPrinter up) {
    up.literal( "lookupswitch" );
    up.newline();
    up.literal("{");
    up.newline();
    
    for(int i = 0; i < lookupValues.size(); i++)
    {
        up.literal("    case ");
        up.constant( (Constant) lookupValues.get(i) );
        up.literal(": goto ");
        targetBoxes[i].toString(up);
        up.literal(";");
        up.newline();
    }

    up.literal("    default: goto ");
    defaultTargetBox.toString(up);
    up.literal(";");
    up.newline();
    up.literal("}");
}
 

import soot.jimple.Constant; //导入依赖的package包/类
public void jimplify (DexBody body) {
    int dest = ((OneRegisterInstruction) instruction).getRegisterA();

    Constant cst = getConstant(dest, body);
    assign = Jimple.v().newAssignStmt(body.getRegisterLocal(dest), cst);
    setUnit(assign);
    addTags(assign);
    body.add(assign);

    if (IDalvikTyper.ENABLE_DVKTYPER) {
        Debug.printDbg(IDalvikTyper.DEBUG, "constraint: "+ assign);
        int op = (int)instruction.getOpcode().value;
        if (cst instanceof UntypedConstant) {
            DalvikTyper.v().addConstraint(assign.getLeftOpBox(), assign.getRightOpBox());
        } else {
            DalvikTyper.v().setType(assign.getLeftOpBox(), cst.getType(), false);
        }
    }
}
 

import soot.jimple.Constant; //导入依赖的package包/类
public void jimplify (DexBody body) {
      if(!(instruction instanceof Instruction21c))
          throw new IllegalArgumentException("Expected Instruction21c but got: "+instruction.getClass());

      ReferenceInstruction constClass = (ReferenceInstruction) this.instruction;

      TypeReference tidi = (TypeReference)(constClass.getReference());
      String type = tidi.getType();
      if (type.startsWith("L") && type.endsWith(";"))
        type = type.replaceAll("^L", "").replaceAll(";$", "");

      int dest = ((OneRegisterInstruction) instruction).getRegisterA();
      Constant cst = ClassConstant.v(type);
      assign = Jimple.v().newAssignStmt(body.getRegisterLocal(dest), cst);
      setUnit(assign);
      addTags(assign);
      body.add(assign);

if (IDalvikTyper.ENABLE_DVKTYPER) {
	Debug.printDbg(IDalvikTyper.DEBUG, "constraint: "+ assign);
        int op = (int)instruction.getOpcode().value;
        //DalvikTyper.v().captureAssign((JAssignStmt)assign, op); //TODO: classtype could be null!
        DalvikTyper.v().setType(assign.getLeftOpBox(), cst.getType(), false);
      }
  }
 

import soot.jimple.Constant; //导入依赖的package包/类
@Override
public void isParamVulnAndStore(SootMethod originMethod, Stmt originStmt, Value reachedValue) { //avoid sideeffect
	//constant already guaranteed by caller
	System.out.println(originStmt);
	String funcSig = originStmt.getInvokeExpr().getMethod().getSignature();
	String valueString = reachedValue.toString();
	if (evaluateResult(funcSig, valueString)) {
		if(DEBUG) {
			System.out.println("result found");
			System.out.println("originstmt: " + originStmt + " reachedValue: " + reachedValue);
		}
		this.results.add(new Pair<>(originMethod, new Pair<>(originStmt, valueString)));
	}
	if(DEBUG) {
		if (reachedValue instanceof Constant || reachedValue instanceof StaticFieldRef) {
			System.out.println("originstmt: " + originStmt + " reachedValue: " + reachedValue);
		}
	}
}
 

import soot.jimple.Constant; //导入依赖的package包/类
@Override
public KillGenInfo processBackwardCallToReturn(Trackable taint, Stmt callSite, InvokeExpr ie) {
	SootMethod method = ie.getMethod();
	List<Taint> taints = Lists.newLinkedList();
	if (ie instanceof InstanceInvokeExpr) {
		Value receiver = ((InstanceInvokeExpr) ie).getBase();
		taints.add(new Taint(callSite, taint, receiver, receiver.getType()));
	}

	for (int i = 0; i < method.getParameterCount(); i++) {
		Type parameterType = method.getParameterType(i);
		if (!(parameterType instanceof PrimType) && !(ie.getArg(i) instanceof Constant)) {
			taints.add(new Taint(callSite, taint, ie.getArg(i), parameterType));
		}
	}

	if (taints.isEmpty())
		return kill();
	else
		return propagate(taints.toArray(new Taint[taints.size()]));
}
 

import soot.jimple.Constant; //导入依赖的package包/类
@Override
public KillGenInfo propagateNormalFlow(Trackable trackable, Unit curr, Unit succ) {
	if (curr instanceof ReturnStmt) {
		Value retValue = getBase(((ReturnStmt) curr).getOp());
		if (retValue instanceof Constant) {
			return kill();
		} else {
			ReturnValueTaint retValTaint = (ReturnValueTaint) trackable;
			if (AnalysisUtil.isAssignable(retValTaint.type, retValue.getType()))
				return propagate(new Taint(curr, trackable, retValue, retValTaint.type));
			else
				return kill();
		}
	} else if (curr instanceof ThrowStmt)
		return kill();

	throw new IllegalStateException();
}
 

import soot.jimple.Constant; //导入依赖的package包/类
@Override
public KillGenInfo propagateCallFlow(Trackable trackable, Unit callStmt, SootMethod destinationMethod) {
	Taint taint = (Taint) trackable;

	if (callStmt instanceof AssignStmt) {
		AssignStmt assignStmt = (AssignStmt) callStmt;
		if (taint.value.equals(assignStmt.getLeftOp())) {
			if (AnalysisUtil.isAssignable(taint.type, destinationMethod.getReturnType())) {
				for (Unit u : context.icfg.getStartPointsOf(destinationMethod)) {
					if (u instanceof ReturnStmt) {
						ReturnStmt returnStmt = (ReturnStmt) u;
						Value retValue = returnStmt.getOp();

						if (retValue instanceof Constant)
							continue;

						// There is at least one non constant return stmt
						return propagate(new ReturnValueTaint(callStmt, trackable, taint.type));
					}
				}
			}
		}
	}

	return kill();
}
 

import soot.jimple.Constant; //导入依赖的package包/类
private void assign(Local lhs, Value rhs, Map<Local, Constant> input, Map<Local, Constant> output) {
	// First remove casts, if any.
	if (rhs instanceof CastExpr) {
		rhs = ((CastExpr) rhs).getOp();
	}
	// Then check if the RHS operand is a constant or local
	if (rhs instanceof Constant) {
		// If RHS is a constant, it is a direct gen
		output.put(lhs, (Constant) rhs);
	} else if (rhs instanceof Local) {
		// Copy constant-status of RHS to LHS (indirect gen), if exists
		if(input.containsKey(rhs)) {
			output.put(lhs, input.get(rhs));
		}
	} else {
		// RHS is some compound expression, then LHS is non-constant (only kill)
		output.put(lhs, null);
	}			
}
 

import soot.jimple.Constant; //导入依赖的package包/类
@Override
public Map<Local, Constant> callEntryFlowFunction(Context<SootMethod, Unit, Map<Local, Constant>> context, SootMethod calledMethod, Unit unit, Map<Local, Constant> inValue) {
	// Initialise result to empty map
	Map<Local, Constant> entryValue = topValue();
	// Map arguments to parameters
	InvokeExpr ie = ((Stmt) unit).getInvokeExpr();
	for (int i = 0; i < ie.getArgCount(); i++) {
		Value arg = ie.getArg(i);
		Local param = calledMethod.getActiveBody().getParameterLocal(i);
		assign(param, arg, inValue, entryValue);
	}
	// And instance of the this local
	if (ie instanceof InstanceInvokeExpr) {
		Value instance = ((InstanceInvokeExpr) ie).getBase();
		Local thisLocal = calledMethod.getActiveBody().getThisLocal();
		assign(thisLocal, instance, inValue, entryValue);
	}
	// Return the entry value at the called method
	return entryValue;
}
 

import soot.jimple.Constant; //导入依赖的package包/类
@Override
public Map<Local, Constant> meet(Map<Local, Constant> op1, Map<Local, Constant> op2) {
	Map<Local, Constant> result;
	// First add everything in the first operand
	result = new HashMap<Local, Constant>(op1);
	// Then add everything in the second operand, bottoming out the common keys with different values
	for (Local x : op2.keySet()) {
		if (op1.containsKey(x)) {
			// Check the values in both operands
			Constant c1 = op1.get(x);
			Constant c2 = op2.get(x);
			if (c1 != null && c1.equals(c2) == false) {
				// Set to non-constant
				result.put(x, null);
			}
		} else {
			// Only in second operand, so add as-is
			result.put(x, op2.get(x));
		}
	}
	return result;
}
 

import soot.jimple.Constant; //导入依赖的package包/类
@Override
protected void internalTransform(String arg0, @SuppressWarnings("rawtypes") Map arg1) {
	analysis = new CopyConstantAnalysis();
	analysis.doAnalysis();
	DataFlowSolution<Unit,Map<Local,Constant>> solution = analysis.getMeetOverValidPathsSolution();
	System.out.println("----------------------------------------------------------------");
	for (SootMethod sootMethod : analysis.getMethods()) {
		System.out.println(sootMethod);
		for (Unit unit : sootMethod.getActiveBody().getUnits()) {
			System.out.println("----------------------------------------------------------------");
			System.out.println(unit);
			System.out.println("IN:  " + formatConstants(solution.getValueBefore(unit)));
			System.out.println("OUT: " + formatConstants(solution.getValueAfter(unit)));
		}
		System.out.println("----------------------------------------------------------------");
	}		
}
 

import soot.jimple.Constant; //导入依赖的package包/类
public boolean hasPrefix(Value v) { // if this has prefix v
	if (v instanceof Local) {
		if (local == null)
			return false;
		else
			return (local.equals(v));

	} else if (v instanceof InstanceFieldRef) {
		InstanceFieldRef ifr = (InstanceFieldRef) v;
		if (local == null) {
			if (ifr.getBase() != null)
				return false;
		} else if (!local.equals(ifr.getBase()))
			return false;
		if (fields.length > 0 && ifr.getField() == fields[0])
			return true;
		return false;

	} else if (v instanceof StaticFieldRef) {
		StaticFieldRef sfr = (StaticFieldRef) v;
		if (local != null)
			return false;
		if (fields.length > 0 && sfr.getField() == fields[0])
			return true;
		return false;

	} else if (v instanceof ArrayRef) {
		ArrayRef ar = (ArrayRef) v;
		if (local == null)
			return false;
		else
			return (local.equals(ar.getBase()));

	} else if (v instanceof Constant) {
		return false;
	} else
		throw new RuntimeException("Unexpected left side " + v.getClass());
}
 

import soot.jimple.Constant; //导入依赖的package包/类
/**
 * Gets the number of non-constant arguments to the given method call
 * @param s A call site
 * @return The number of non-constant arguments in the given call site
 */
private int getNonConstParamCount(Stmt s) {
	int cnt = 0;
	for (Value val : s.getInvokeExpr().getArgs())
		if (!(val instanceof Constant))
			cnt++;
	return cnt;
}
 

import soot.jimple.Constant; //导入依赖的package包/类
public Register asImmediate(Value v, ConstantVisitor constantV) {
	if (v instanceof Constant) {
		 return asConstant(v, constantV);
	} else if (v instanceof Local) {
		return asLocal(v);
	} else {
		throw new RuntimeException("expected Immediate (Constant or Local), but was: " + v.getClass());
	}
}
 

import soot.jimple.Constant; //导入依赖的package包/类
private void javafy(ValueBox vb) {
	Value v = vb.getValue();

	if (v instanceof Expr)
		javafy_expr(vb);
	else if (v instanceof Ref)
		javafy_ref(vb);
	else if (v instanceof Local)
		javafy_local(vb);
	else if (v instanceof Constant)
		javafy_constant(vb);
}
 

import soot.jimple.Constant; //导入依赖的package包/类
@Override
public void constant( Constant c ) {
  if (c instanceof ClassConstant) {
    handleIndent();
    String fullClassName =
      ((ClassConstant)c).value.replaceAll("/", ".");
    output.append(fullClassName + ".class");
  } else {
    super.constant(c);
  }
}