Package proguard.analysis.cpa.jvm.domain.taint

Class JvmTaintMemoryLocationBamCpaRun

java.lang.Object

proguard.analysis.cpa.defaults.CpaRun<CpaT,AbstractStateT>

proguard.analysis.cpa.defaults.SequentialCpaRun<JvmMemoryLocationCpa<AbstractStateT>,JvmMemoryLocationAbstractState<?>,BamCpaRun<CpaT,? extends ProgramLocationDependent<JvmCfaNode,JvmCfaEdge,MethodSignature>,JvmCfaNode,JvmCfaEdge,MethodSignature>>

proguard.analysis.cpa.jvm.domain.memory.JvmMemoryLocationBamCpaRun<SimpleCpa,SetAbstractState<JvmTaintSource>>

proguard.analysis.cpa.jvm.domain.taint.JvmTaintMemoryLocationBamCpaRun

All Implemented Interfaces:

TraceExtractor

public class JvmTaintMemoryLocationBamCpaRun
extends JvmMemoryLocationBamCpaRun<SimpleCpa,SetAbstractState<JvmTaintSource>>

This run wraps the execution of BAM JvmMemoryLocationCpa.

Nested Class Summary

Nested Classes

Modifier and Type	Class	Description
static class	JvmTaintMemoryLocationBamCpaRun.Builder	A builder for JvmTaintMemoryLocationBamCpaRun.

Nested classes/interfaces inherited from class proguard.analysis.cpa.defaults.SequentialCpaRun

SequentialCpaRun.PreviousRunDurationReceiver

Field Summary

Fields inherited from class proguard.analysis.cpa.jvm.domain.memory.JvmMemoryLocationBamCpaRun

threshold

Fields inherited from class proguard.analysis.cpa.defaults.SequentialCpaRun

inputCpaRun, inputReachedSet, outputReachedSet

Fields inherited from class proguard.analysis.cpa.defaults.CpaRun

abortOperator, cpa

Constructor Summary

Constructors

Modifier	Constructor	Description
protected	JvmTaintMemoryLocationBamCpaRun(JvmCfa cfa, java.util.Set<? extends JvmTaintSource> taintSources, MethodSignature mainSignature, int maxCallStackDepth, HeapModel heapModel, SetAbstractState<JvmTaintSource> threshold, java.util.Collection<? extends JvmTaintSink> taintSinks, AbortOperator abortOperator, AbortOperator memoryLocationAbortOperator, boolean reduceHeap, MapAbstractStateFactory<java.lang.String,SetAbstractState<JvmTaintSource>> staticFieldMapAbstractStateFactory, MapAbstractStateFactory<java.lang.String,SetAbstractState<Reference>> principalHeapNodeMapAbstractStateFactory, MapAbstractStateFactory<java.lang.String,SetAbstractState<JvmTaintSource>> followerHeapNodeMapAbstractStateFactory, java.util.Map<MethodSignature,JvmTaintTransformer> taintTransformers, java.util.Map<Call,java.util.Set<JvmMemoryLocation>> extraTaintPropagationLocations)	Create a traced taint CPA run.
protected	JvmTaintMemoryLocationBamCpaRun(JvmTaintBamCpaRun jvmTaintCpaRun, SetAbstractState<JvmTaintSource> threshold, java.util.Collection<? extends JvmTaintSink> taintSinks, AbortOperator memoryLocationAbortOperator, java.util.Map<Call,java.util.Set<JvmMemoryLocation>> extraTaintPropagationLocations)	Create a traced taint CPA run.

Method Summary

Modifier and Type	Method	Description
java.util.Collection<BamLocationDependentJvmMemoryLocation<?>>	getEndPoints()	Returns endpoints or the extracted traces.
java.util.Map<BamLocationDependentJvmMemoryLocation<?>,java.util.List<JvmTaintSink>>	getEndPointToSinks()
java.util.List<JvmMemoryLocationAbstractState<?>>	getInitialStates()	Returns a collection of initial AbstractStates.
java.util.Collection<? extends JvmTaintSink>	getTaintSinks()

Methods inherited from class proguard.analysis.cpa.jvm.domain.memory.JvmMemoryLocationBamCpaRun

createReachedSet, createWaitlist, getOutputReachedSet

Methods inherited from class proguard.analysis.cpa.defaults.SequentialCpaRun

execute, getInputCpaRun

Methods inherited from class proguard.analysis.cpa.defaults.CpaRun

getAbortOperator, getCpa

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Methods inherited from interface proguard.analysis.cpa.jvm.domain.memory.TraceExtractor

extractLinearTraces, removeDuplicateProgramLocations, traceExtractionIteration

Constructor Detail

JvmTaintMemoryLocationBamCpaRun

protected JvmTaintMemoryLocationBamCpaRun(JvmTaintBamCpaRun jvmTaintCpaRun,
                                          SetAbstractState<JvmTaintSource> threshold,
                                          java.util.Collection<? extends JvmTaintSink> taintSinks,
                                          AbortOperator memoryLocationAbortOperator,
                                          java.util.Map<Call,java.util.Set<JvmMemoryLocation>> extraTaintPropagationLocations)

Create a traced taint CPA run.

Parameters:

jvmTaintCpaRun - an intraprocedural taint CPA run

threshold - a cut-off threshold

taintSinks - a collection of taint sinks

memoryLocationAbortOperator - an abort operator for trace reconstruction

JvmTaintMemoryLocationBamCpaRun

protected JvmTaintMemoryLocationBamCpaRun(JvmCfa cfa,
                                          java.util.Set<? extends JvmTaintSource> taintSources,
                                          MethodSignature mainSignature,
                                          int maxCallStackDepth,
                                          HeapModel heapModel,
                                          SetAbstractState<JvmTaintSource> threshold,
                                          java.util.Collection<? extends JvmTaintSink> taintSinks,
                                          AbortOperator abortOperator,
                                          AbortOperator memoryLocationAbortOperator,
                                          boolean reduceHeap,
                                          MapAbstractStateFactory<java.lang.String,SetAbstractState<JvmTaintSource>> staticFieldMapAbstractStateFactory,
                                          MapAbstractStateFactory<java.lang.String,SetAbstractState<Reference>> principalHeapNodeMapAbstractStateFactory,
                                          MapAbstractStateFactory<java.lang.String,SetAbstractState<JvmTaintSource>> followerHeapNodeMapAbstractStateFactory,
                                          java.util.Map<MethodSignature,JvmTaintTransformer> taintTransformers,
                                          java.util.Map<Call,java.util.Set<JvmMemoryLocation>> extraTaintPropagationLocations)

Create a traced taint CPA run.

Parameters:

cfa - a CFA

taintSources - a set of taint sources

mainSignature - the main signature of the main method

maxCallStackDepth - the maximum depth of the call stack analyzed interprocedurally. 0 means intraprocedural analysis. < 0 means no maximum depth.

threshold - a cut-off threshold

taintSinks - a collection of taint sinks

abortOperator - an abort operator

memoryLocationAbortOperator - an abort operator for trace reconstruction

reduceHeap - whether reduction/expansion of the heap state is performed at call/return sites

principalHeapMapAbstractStateFactory - a map abstract state factory used for constructing the mapping from references to objects in the principal heap model

principalHeapNodeMapAbstractStateFactory - a map abstract state factory used for constructing the mapping from fields to values in the principal heap model

followerHeapMapAbstractStateFactory - a map abstract state factory used for constructing the mapping from references to objects in the follower heap model

followerHeapNodeMapAbstractStateFactory - a map abstract state factory used for constructing the mapping from fields to values in the follower heap model

extraTaintPropagationLocations - maps calls to jvm memory locations which needs to get tainted after the call

Method Detail

getTaintSinks

public java.util.Collection<? extends JvmTaintSink> getTaintSinks()

getEndPointToSinks

public java.util.Map<BamLocationDependentJvmMemoryLocation<?>,java.util.List<JvmTaintSink>> getEndPointToSinks()

getInitialStates

public java.util.List<JvmMemoryLocationAbstractState<?>> getInitialStates()

Description copied from class: CpaRun

Returns a collection of initial AbstractStates.

Specified by:

getInitialStates in class CpaRun<JvmMemoryLocationCpa<SetAbstractState<JvmTaintSource>>,JvmMemoryLocationAbstractState<?>>

getEndPoints

public java.util.Collection<BamLocationDependentJvmMemoryLocation<?>> getEndPoints()

Description copied from interface: TraceExtractor

Returns endpoints or the extracted traces. Its output should be used for constructing initial states for memory location CPAs.