import soot.jimple.infoflow.android.manifest.ProcessManifest; //导入依赖的package包/类
private void addTemporalManifestChanges(ProcessManifest androidManifest) {
	File manifestFile = null;
	try{
		//temporarily save the modified AndroidManifest
		manifestFile = File.createTempFile("AndroidManifest.xml", null);		
		FileOutputStream fos = new FileOutputStream(manifestFile.getPath());
		byte[] output = androidManifest.getOutput();
		fos.write(output);
		fos.close();
		
		ArrayList<File> files = new ArrayList<File>();
		files.add(manifestFile);
		HashMap<String, String> paths = new HashMap<String, String>();
		paths.put(manifestFile.getAbsolutePath(), "AndroidManifest.xml");
		//add the modified AndroidManifest into the original APK
		androidManifest.getApk().addFilesToApk(files, paths);
	}catch(Exception ex) {
		LoggerHelper.logEvent(MyLevel.EXCEPTION_ANALYSIS, ex.getMessage());
		ex.printStackTrace();
		System.exit(-1);
	}
	finally {
		if (manifestFile != null && manifestFile.exists())
			manifestFile.delete();
	}
}
 

import soot.jimple.infoflow.android.manifest.ProcessManifest; //导入依赖的package包/类
@SuppressWarnings("unchecked")
private static void addMaxPrioForSMSReceiver(ProcessManifest manifest) {
	for(AXmlNode receiver : manifest.getReceivers()) {
		for(AXmlNode receiverChild : receiver.getChildren()) {
			if(receiverChild.getTag().equals("intent-filter")) {
				//search for SMS receiver
				for(AXmlNode childChild : receiverChild.getChildren()) {
					if(childChild.getTag().equals("action")) {
						if(childChild.hasAttribute("name") && ((String)childChild.getAttribute("name").getValue()).equalsIgnoreCase("android.provider.Telephony.SMS_RECEIVED")){
							//prepare the priority filter
							if(receiverChild.hasAttribute("priority")) 
								((AXmlAttribute<Integer>)receiverChild.getAttribute("priority")).setValue(Integer.MAX_VALUE);
							else {
								AXmlAttribute<Integer> attr = new AXmlAttribute<Integer>("priority", Integer.MAX_VALUE, ANDROID_NAMESPACE);
								receiverChild.addAttribute(attr);
							}
						}
					}
				}
			}
		}
	}
}
 

import soot.jimple.infoflow.android.manifest.ProcessManifest; //导入依赖的package包/类
public static void extractApkInfo(String apkPath)
{
	GlobalRef.apkPath = apkPath;
	
	try 
	{
		ProcessManifest manifest = new ProcessManifest(apkPath);
		
		GlobalRef.pkgName = manifest.getPackageName();
		GlobalRef.apkVersionCode = manifest.getVersionCode();
		GlobalRef.apkVersionName = manifest.getVersionName();
		GlobalRef.apkMinSdkVersion = manifest.getMinSdkVersion();
		GlobalRef.apkPermissions = manifest.getPermissions();
	} 
	catch (Exception e) 
	{
		e.printStackTrace();
	}
}
 

import soot.jimple.infoflow.android.manifest.ProcessManifest; //导入依赖的package包/类
@Override
protected void internalTransform(String phaseName, Map<String, String> options) 
{
	try
	{	
		ProcessManifest processMan = new ProcessManifest(apkFileLocation);
		Set<String> entrypoints = processMan.getEntryPointClasses();
		
		SootMethod mainMethod = generateMain(entrypoints);
		
		System.out.println(mainMethod.retrieveActiveBody());
	}
	catch (Exception ex)
	{
		ex.printStackTrace();
	}
}
 

import soot.jimple.infoflow.android.manifest.ProcessManifest; //导入依赖的package包/类
public static SootMethod generateDummyMain(String apkFileLocation)
{
	SootMethod mainMethod = null;
	
	try
	{	
		ProcessManifest processMan = new ProcessManifest(apkFileLocation);
		Set<String> entrypoints = processMan.getEntryPointClasses();
		
		DummyMainGenerator dmGenerator = new DummyMainGenerator(apkFileLocation);
		
		mainMethod = dmGenerator.generateMain(entrypoints);
		
		System.out.println(mainMethod.retrieveActiveBody());
	}
	catch (Exception ex)
	{
		ex.printStackTrace();
	}
	
	return mainMethod;
}
 

import soot.jimple.infoflow.android.manifest.ProcessManifest; //导入依赖的package包/类
public static void main(String[] args) 
{
	DB.setJdbcPath("res/jdbc.xml");

	String apkPath = args[0];
	
	try 
	{
		ProcessManifest processMan = new ProcessManifest(apkPath);
		String pkgName = processMan.getPackageName();
		
		buildLinks(pkgName);
	} 
	catch (Exception e) 
	{
		e.printStackTrace();
	}
	
}
 

import soot.jimple.infoflow.android.manifest.ProcessManifest; //导入依赖的package包/类
/**
 * This is a kind of hack and includes much more instrumentation which is necessary;
 * But it is still sound ;-).
 * @param apkFileLocation: apk file path
 */
public static void initializePePInAllPossibleClasses(String apkFileLocation){
	try {
		ProcessManifest manifest = new ProcessManifest(apkFileLocation);		
		Set<String> entryClasses = manifest.getEntryPointClasses();
		 
		for(String entryClass : entryClasses){
			SootClass sc = Scene.v().getSootClass(entryClass);
			
			List<SootClass> allSuperClasses = Scene.v().getActiveHierarchy().getSuperclassesOf(sc);
		 	for(SootClass subclass : allSuperClasses)
		 		if(subclass.getName().equals("android.content.Context")){
		 			initializePeP(sc);
		 			break;
		 		}
		}
	}
	catch (IOException | XmlPullParserException ex) {
		System.err.println("Could not read Android manifest file: " + ex.getMessage());
		throw new RuntimeException(ex);
	}
}
 

import soot.jimple.infoflow.android.manifest.ProcessManifest; //导入依赖的package包/类
private boolean isLaunchableAcitivity(SootClass sc, ProcessManifest manifest) {
	Set<AXmlNode> launchableActivities = manifest.getLaunchableActivities();
	for(AXmlNode node : launchableActivities) {
		if(node.hasAttribute("name")) {
			String activityName = (String)node.getAttribute("name").getValue();
			activityName = getFullyQualifiedName(manifest, activityName);
			
			if(activityName.equals(sc.getName()))
				return true;
		}
	}
	return false;
}
 

import soot.jimple.infoflow.android.manifest.ProcessManifest; //导入依赖的package包/类
public static void manipulateAndroidManifest(ProcessManifest androidManifest) {
	// process old manifest
	addHookinHelperAsApplicationIfNecessary(androidManifest);
	addInternetPermissionIfNecessary(androidManifest);
	addTracingService(androidManifest);
	addComponentCallerService(androidManifest);
	addMaxPrioForSMSReceiver(androidManifest);
	addPermissionIfNecessary("android.permission.READ_EXTERNAL_STORAGE", androidManifest);
	addPermissionIfNecessary("android.permission.WRITE_EXTERNAL_STORAGE", androidManifest);
	addPermissionIfNecessary("android.permission.WRITE_CONTACT", androidManifest);
}
 

import soot.jimple.infoflow.android.manifest.ProcessManifest; //导入依赖的package包/类
private static void addPermissionIfNecessary(String permission, ProcessManifest androidManifest) {
	Set<String> allPermissions = androidManifest.getPermissions();
	for(String perm : allPermissions) {
		if(perm.equals(permission))
			//do nothing in case the sdcard-permission already exists
			return;
	}
	
	androidManifest.addPermission(permission);
}
 

import soot.jimple.infoflow.android.manifest.ProcessManifest; //导入依赖的package包/类
private static void addComponentCallerService(ProcessManifest androidManifest) {
	AXmlNode componentCallerService = new AXmlNode("service", null, androidManifest.getApplication());
	AXmlAttribute<String> nameAttribute = new AXmlAttribute<String>("name", UtilInstrumenter.COMPONENT_CALLER_SERVICE_HELPER,  ANDROID_NAMESPACE);
	AXmlAttribute<String> exportedAttribute = new AXmlAttribute<String>("exported", "false",  ANDROID_NAMESPACE);
	componentCallerService.addAttribute(nameAttribute);
	componentCallerService.addAttribute(exportedAttribute);
	
	androidManifest.addService(componentCallerService);
}
 

import soot.jimple.infoflow.android.manifest.ProcessManifest; //导入依赖的package包/类
private static void addHookinHelperAsApplicationIfNecessary(ProcessManifest androidManifest){
	AXmlNode application = androidManifest.getApplication();
	if(!application.hasAttribute("name")) {
		AXmlAttribute<String> nameAttribute = new AXmlAttribute<String>("name", UtilInstrumenter.HELPER_APPLICATION_FOR_HOOKING,  ANDROID_NAMESPACE);
		application.addAttribute(nameAttribute);
	}
}
 

import soot.jimple.infoflow.android.manifest.ProcessManifest; //导入依赖的package包/类
private static void addInternetPermissionIfNecessary(ProcessManifest androidManifest) {
	String internetPerm = "android.permission.INTERNET";
	Set<String> allPermissions = androidManifest.getPermissions();
	for(String perm : allPermissions) {
		if(perm.equals(internetPerm))
			//do nothing in case the internet-permission already exists
			return;
	}
	
	androidManifest.addPermission(internetPerm);
}
 

import soot.jimple.infoflow.android.manifest.ProcessManifest; //导入依赖的package包/类
private static void addTracingService(ProcessManifest androidManifest) {
	AXmlNode tracingService = new AXmlNode("service", null, androidManifest.getApplication());
	AXmlAttribute<String> nameAttribute = new AXmlAttribute<String>("name", UtilInstrumenter.HELPER_SERVICE_FOR_PATH_TRACKING,  ANDROID_NAMESPACE);
	AXmlAttribute<String> exportedAttribute = new AXmlAttribute<String>("exported", "false",  ANDROID_NAMESPACE);
	tracingService.addAttribute(nameAttribute);
	tracingService.addAttribute(exportedAttribute);
	
	androidManifest.addService(tracingService);
}
 

import soot.jimple.infoflow.android.manifest.ProcessManifest; //导入依赖的package包/类
public SetupApplicationJIT(String apkFileLocation, String sootCP,
		ISourceSinkDefinitionProvider sourceSinkProvider) {
	this.apkFileLocation = apkFileLocation;
	this.sootCP = sootCP;
	try {
		// Load Android callbacks
		this.androidCallbacks = Activator.getDefault().getAndroidCallbacks();

		// Process manifest
		ProcessManifest processMan = new ProcessManifest(apkFileLocation);
		this.appPackageName = processMan.getPackageName();
		this.entrypoints = processMan.getEntryPointClasses();

		// Parse the resource file
		ARSCFileParser resParser = new ARSCFileParser();
		resParser.parse(apkFileLocation);
		this.resourcePackages = resParser.getPackages();

		// LayoutFileParser
		LayoutFileParser lfp = new LayoutFileParser(this.appPackageName, resParser);
		lfp.parseLayoutFile(apkFileLocation, entrypoints);

		// Create the SourceSinkManager
		Set<SootMethodAndClass> callbacks = new HashSet<>();
		for (Set<SootMethodAndClass> methods : this.callbackMethods.values())
			callbacks.addAll(methods);
		sourceSinkManager = new AccessPathBasedSourceSinkManager(sourceSinkProvider.getSources(),
				sourceSinkProvider.getSinks(), callbacks, LayoutMatchingMode.MatchSensitiveOnly,
				lfp == null ? null : lfp.getUserControlsByID());
		sourceSinkManager.setAppPackageName(this.appPackageName);
		sourceSinkManager.setResourcePackages(this.resourcePackages);
		sourceSinkManager.setEnableCallbackSources(true);
	} catch (IOException | XmlPullParserException e) {
		LOGGER.error("Error initializing " + apkFileLocation);
	}
}
 

import soot.jimple.infoflow.android.manifest.ProcessManifest; //导入依赖的package包/类
public static Set<String> getComponents(String apkFileLocation)
{
	Set<String> entrypoints = null;
	try
	{	
		ProcessManifest processMan = new ProcessManifest(apkFileLocation);
		entrypoints = processMan.getEntryPointClasses();
	}
	catch (Exception ex)
	{
		ex.printStackTrace();
	}
	
	return entrypoints;
}
 

import soot.jimple.infoflow.android.manifest.ProcessManifest; //导入依赖的package包/类
/**
 * Get the package name of the application
 * @param apkFileLocation
 * @return
 */
public static String getApplicationPackageName(String apkFileLocation) {
	String packageName = null;
	try {
		ProcessManifest pm = new ProcessManifest(apkFileLocation);
		AXmlHandler axmlh = pm.getAXml(); 
		
		// Find main activity and remove main intent-filter
		List<AXmlNode> anodes = axmlh.getNodesWithTag("manifest");
		for (AXmlNode an: anodes) {
			boolean hasMain = false;
			boolean hasLauncher = false;
			AXmlNode filter = null;
			
			AXmlAttribute aname = an.getAttribute("package");
			String aval = (String)aname.getValue();
			packageName = aval;
			System.out.println("package: "+ packageName);
			break;
			
		}
	} catch (IOException | XmlPullParserException ex) {
		System.err.println("Could not read Android manifest file: " + ex.getMessage());
		throw new RuntimeException(ex);
	}

	return packageName;
}
 

import soot.jimple.infoflow.android.manifest.ProcessManifest; //导入依赖的package包/类
private void executeTransformers(ProcessManifest manifest) {
		// We first need to retrieve some information from the manifest
		Set<String> constructors = new HashSet<>();
		for (String className : manifest.getEntryPointClasses())
			constructors.add("<" + className + ": void <init>()>");
				
		ConditionTracking conditionTracking = new ConditionTracking();
		CodePositionTracking codePositionTracking = new CodePositionTracking(codePositionManager);
		DynamicCallGraphTracking dynamicCallGraphTracking = new DynamicCallGraphTracking(codePositionManager);
		PathExecutionTransformer pathExecutionTransformer = new PathExecutionTransformer();
		GoalReachedTracking goalReachedTracking = new GoalReachedTracking(config.getAllTargetLocations());
		TimingBombTransformer timingBombs = new TimingBombTransformer();
		DummyMethodHookTransformer dummyMethods = new DummyMethodHookTransformer();
		DynamicValueTransformer dynamicValues = new DynamicValueTransformer(true);
		ClassLoaderTransformer classLoaders = new ClassLoaderTransformer();
		
		for (SootClass sc : Scene.v().getApplicationClasses())
			for (SootMethod sm : sc.getMethods())
				if (sm.isConcrete()) {
					Body body = sm.getActiveBody();
					//todo PAPER-EVAL ONLY
					codePositionTracking.transform(body);					
					if(!FrameworkOptions.evaluationOnly){
//						conditionTracking.transform(body);
//						dynamicCallGraphTracking.transform(body);
					}
//					if (FrameworkOptions.recordPathExecution)
//						pathExecutionTransformer.transform(body);
					goalReachedTracking.transform(body);
					//todo PAPER-EVAL ONLY
					if(!FrameworkOptions.evaluationOnly){
						timingBombs.transform(body);
						dummyMethods.transform(body);
						dynamicValues.transform(body);
					}
					classLoaders.transform(body);
				}
		//todo PAPER-EVAL ONLY
		if(!FrameworkOptions.evaluationOnly)
			new CrashReporterInjection(constructors).transform();
		new GlobalInstanceTransformer().transform();
	}
 

import soot.jimple.infoflow.android.manifest.ProcessManifest; //导入依赖的package包/类
private void initializeHooking(ProcessManifest manifest) {						
	String applicationName = manifest.getApplicationName();
	//case 1
	if(applicationName != null) {
		if(applicationName.startsWith(".")) {
			String packageName = manifest.getPackageName();
			if(packageName == null)
				throw new RuntimeException("There is a problem with the package name");
			applicationName = packageName + applicationName;
		}
		SootClass applicationSootClass = Scene.v().getSootClass(applicationName);
		if(applicationSootClass != null) {				
			String attachMethodName = String.format("<%s: void attachBaseContext(android.content.Context)>", applicationName);
			SootMethod attachMethod = Scene.v().grabMethod(attachMethodName);	
			//case 1
			if(attachMethod != null) {
				Body body = attachMethod.getActiveBody();
				Local contextParam = body.getParameterLocal(0);
				
				List<Unit> unitsToInstrument = new ArrayList<Unit>();										
				String hookingHelperApplicationClassAttachMethodName = String.format("<%s: void initializeHooking(android.content.Context)>", UtilInstrumenter.HOOKER_CLASS);
				SootMethod hookingHelperApplicationClassAttachMethod = Scene.v().getMethod(hookingHelperApplicationClassAttachMethodName);
				if(hookingHelperApplicationClassAttachMethod == null)
					throw new RuntimeException("this should not happen");					
				SootMethodRef ref = hookingHelperApplicationClassAttachMethod.makeRef();					
				InvokeExpr invExpr = Jimple.v().newStaticInvokeExpr(ref, contextParam);
				unitsToInstrument.add(Jimple.v().newInvokeStmt(invExpr));
				
				
				Unit instrumentAfterUnit = null;
				for(Unit unit : body.getUnits()) {
					if(unit instanceof InvokeStmt) {
						InvokeStmt invStmt = (InvokeStmt)unit;
						if(invStmt.getInvokeExpr().getMethod().getSubSignature().equals("void attachBaseContext(android.content.Context)")) {
							instrumentAfterUnit = unit;
							break;
						}
					}
				}
				
				if(instrumentAfterUnit == null)
					throw new RuntimeException("this should not happen");
				body.getUnits().insertAfter(unitsToInstrument, instrumentAfterUnit);								
			}
			//case 2
			else {
				attachMethodName = String.format("<%s: void attachBaseContext(android.content.Context)>", UtilInstrumenter.HELPER_APPLICATION_FOR_HOOKING);	
				attachMethod = Scene.v().grabMethod(attachMethodName);
				if(attachMethod == null)
					throw new RuntimeException("this should not happen");
				
				List<Type> params = new ArrayList<Type>();
				SootClass contextClass = Scene.v().getSootClass("android.content.Context");
				params.add(contextClass.getType());
				SootMethod newAttachMethod = new SootMethod("attachBaseContext", params, VoidType.v());
				newAttachMethod.setModifiers(soot.Modifier.PROTECTED);
				newAttachMethod.setActiveBody(attachMethod.getActiveBody());
				applicationSootClass.addMethod(newAttachMethod);
			}
			
			//there is no need for our Application class
			Scene.v().getSootClass(UtilInstrumenter.HELPER_APPLICATION_FOR_HOOKING).setLibraryClass();
		}
		else {
			throw new RuntimeException("There is a problem with the Application class!");
		}
	}
	//case 3
	else{
		//there is no need for any instrumentation since the Application class is set to application-class.
	}
}
 

import soot.jimple.infoflow.android.manifest.ProcessManifest; //导入依赖的package包/类
private Set<FrameworkEvent> getFrameworkEvents(Unit targetLocation, BackwardsInfoflowCFG cfg) {
	FrameworkEventManager eventManager =  FrameworkEventManager.getEventManager();
	ProcessManifest manifest = UtilApk.getManifest();									
	Set<FrameworkEvent> targetAndroidEvents = eventManager.extractInitalEventsForReachingTarget(targetLocation, cfg, manifest);			
	return targetAndroidEvents;
}