ViaLin/AndroidSource/TaintDroid.java at main · resess/ViaLin · GitHub

History

269 lines (234 loc) · 9.64 KB

Raw

100

101

102

103

104

105

106

107

108

109

110

111

112

113

114

115

116

117

118

119

120

121

122

123

124

125

126

127

128

129

130

131

132

133

134

135

136

137

138

139

140

141

142

143

144

145

146

147

148

149

150

151

152

153

154

155

156

157

158

159

160

161

162

163

164

165

166

167

168

169

170

171

172

173

174

175

176

177

178

179

180

181

182

183

184

185

186

187

188

189

190

191

192

193

194

195

196

197

198

199

200

201

202

203

204

205

206

207

208

209

210

211

212

213

214

215

216

217

218

219

220

221

222

223

224

225

226

227

228

229

230

231

232

233

234

235

236

237

238

239

240

241

242

243

244

245

246

247

248

249

250

251

252

253

254

255

256

257

258

259

260

261

262

263

264

265

266

267

268

269

package java.lang;

import java.util.Stack;

import java.util.concurrent.atomic.AtomicInteger;

import java.util.Set;

import java.util.HashMap;

import java.util.HashSet;

import java.util.Map;

import java.lang.reflect.Field;

import java.lang.IllegalAccessException;

import java.nio.file.Paths;

import java.nio.file.Files;

import java.io.FileWriter;

import java.io.IOException;

import java.io.File;

public class TaintDroid {

public static Map<String, Integer> statementIndexMap = new HashMap<>();

public static AtomicInteger topStatementIndex = new AtomicInteger(0);

public static void endTime(String str, long time) {

long endTime = System.nanoTime();

long timeDiff = endTime - time;

System.out.format("MethodTiming: %s: %s%n", str, timeDiff);

}

public static void printSourceFound(String src) {

StackTraceElement ste = Thread.currentThread().getStackTrace()[3];

System.out.format("TaintDroid: SourceFound: %s->%s(%s), %s%n", ste.getClassName(), ste.getMethodName(), ste.getLineNumber(), src);

}

public static void printMethodName(String name) {

System.out.println("MethodName: " + name);

}

public static void printFieldNameGet(String name) {

StackTraceElement ste = Thread.currentThread().getStackTrace()[4];

System.out.format("FieldGet: in method %s->%s(%s), FieldGet for %s%n", ste.getClassName(), ste.getMethodName(), ste.getLineNumber(), name);

}

public static void printFieldNameSet(String name) {

StackTraceElement ste = Thread.currentThread().getStackTrace()[4];

System.out.format("FieldSet: in method %s->%s(%s), FieldSet for %s%n", ste.getClassName(), ste.getMethodName(), ste.getLineNumber(), name);

}

public static void printSinkFound(String sink) {

StackTraceElement ste = Thread.currentThread().getStackTrace()[3];

System.out.format("TaintDroid: SinkFound: %s->%s(%s), %s%n", ste.getClassName(), ste.getMethodName(), ste.getLineNumber(), sink);

}

public static void dumpTaint(int taintDroid) {

if (taintDroid != 0) {

System.out.format("DumpTaint: %s%n", taintDroid);

}

public static void dumpTaint(int taintDroid, Object object) {

dumpTaint(taintDroid);

if (object != null) {

dumpObjectLoop(object);

}

private static void dumpObjectLoop(Object object) {

Set<Object> visited = new HashSet<>();

Stack<Object> stack = new Stack<>();

// Stack<String> accessPath = new Stack<>();

stack.push(object);

// accessPath.push(object.getClass().getName());

int counter = -1;

while(!stack.isEmpty()) {

Object next = stack.pop();

// String currentPath = accessPath.pop();

if (next == null) {

continue;

}

try {

if(visited.contains(next)) {

continue;

}

} catch (Exception e) {

continue;

}

counter++;

visited.add(next);

try {

// System.out.println("Class-" + counter + ": " + next.getClass().toString());

for (Field field : next.getClass().getDeclaredFields()) {

processField("DeclaredField", stack, counter, next, field);

}

} catch (Exception e) {

e.printStackTrace();

}

private static void processField(String type, Stack<Object> stack, int counter, Object next, Field field) throws Exception {

// System.out.println(" " + type + ": " + field.toString());

field.setAccessible(true);

if (field.getName().endsWith("_taintdroid")) {

int taintDroid = (Integer) field.get(next);

if (taintDroid != 0) {

// currentPath = currentPath + "/" + field.getName();

// System.out.println("DumpTaint: FieldAccessPath: " + currentPath);

dumpTaint(taintDroid);

}

} else {

// System.out.println("FieldInObject-" + counter +": " + field.toString());

Object value = field.get(next);

if (value != null) {

stack.push(value);

// currentPath = currentPath + "/" + value.getClass().getName();

// currentPath = value.getClass().getName();

// accessPath.push(currentPath);

}

public static int fileTaint(int taint) {

return taint;

}

public static int fileTaint(int taint, Object object) {

if (object != null) {

taint |= extractTaint(object);

}

return taint;

}

public static void addSerializedTaint(int[] container, int objectTaint, Object object) {

int taint = TaintDroid.fileTaint(objectTaint, object);

// StackTraceElement ste = Thread.currentThread().getStackTrace()[3];

// System.out.format("PathTaint: addSerializedTaint: in method %s->%s, taint is %s %n", ste.getClassName(), ste.getMethodName(), taint);

container[0] |= taint;

}

public static void addSerializedTaint(int[] container, int objectTaint) {

int taint = TaintDroid.fileTaint(objectTaint);

// StackTraceElement ste = Thread.currentThread().getStackTrace()[3];

// System.out.format("PathTaint: addSerializedTaint: in method %s->%s, taint is %s %n", ste.getClassName(), ste.getMethodName(), taint);

container[0] |= taint;

}

public static int getSerializedTaint(int[] container) {

return container[0];

}

public static void addFileTaint(File file, int fileTaint, Object object) {

String taintFileName = file.getAbsolutePath() + ".taint";

int extra = 0;

try {

extra = Integer.valueOf(new String(Files.readAllBytes(Paths.get(taintFileName))));

} catch (IOException e) {

e.printStackTrace();

}

int taint = extra | TaintDroid.fileTaint(fileTaint, object);

// StackTraceElement ste = Thread.currentThread().getStackTrace()[3];

// System.out.format("PathTaint: addFileTaint: in method %s->%s, taint is %s %n", ste.getClassName(), ste.getMethodName(), taint);

if (taint !=0) {

try {

FileWriter fw = new FileWriter(taintFileName, false);

fw.write(taint);

fw.close();

// System.out.format("PathTaint: addFileTaint: file writted %n");

} catch (IOException e) {

System.out.println(e.getMessage());

}

public static void addFileTaint(File file, int fileTaint) {

String taintFileName = file.getAbsolutePath() + ".taint";

int extra = 0;

try {

extra = Integer.valueOf(new String(Files.readAllBytes(Paths.get(taintFileName))));

} catch (IOException e) {

e.printStackTrace();

}

int taint = extra | fileTaint;

// StackTraceElement ste = Thread.currentThread().getStackTrace()[3];

// System.out.format("PathTaint: addFileTaint: in method %s->%s, taint is %s %n", ste.getClassName(), ste.getMethodName(), taint);

if (taint !=0) {

try {

FileWriter fw = new FileWriter(taintFileName, false);

fw.write(taint);

fw.close();

// System.out.format("PathTaint: addFileTaint: file writted %n");

} catch (IOException e) {

System.out.println(e.getMessage());

}

public static int getFileTaint(File file) {

String taintFileName = file.getAbsolutePath() + ".taint";

int taint = 0;

try {

taint = Integer.valueOf(new String(Files.readAllBytes(Paths.get(taintFileName))));

} catch (IOException e) {

e.printStackTrace();

}

return taint;

}

public static int extractTaint(Object object) {

Set<Object> visited = new HashSet<>();

Stack<Object> stack = new Stack<>();

// Stack<String> accessPath = new Stack<>();

stack.push(object);

// accessPath.push(object.getClass().getName());

int counter = -1;

int taint = 0;

while(!stack.isEmpty()) {

Object next = stack.pop();

// String currentPath = accessPath.pop();

if (next == null) {

continue;

}

try {

if(visited.contains(next)) {

continue;

}

} catch (Exception e) {

continue;

}

counter++;

visited.add(next);

try {

// System.out.println("Class-" + counter + ": " + next.getClass().toString());

for (Field field : next.getClass().getDeclaredFields()) {

taint |= extractTaintField("DeclaredField", stack, counter, next, field);

}

} catch (Exception e) {

e.printStackTrace();

}

return taint;

}

private static int extractTaintField(String type, Stack<Object> stack, int counter, Object next, Field field) throws Exception {

// System.out.println(" " + type + ": " + field.toString());

int taint = 0;

field.setAccessible(true);

if (field.getType().equals(PathTaint.class)) {

return taint;

} else if (field.getName().endsWith("_taintdroid")) {

taint |= (Integer) field.get(next);

} else {

Object value = field.get(next);

if (value != null) {

stack.push(value);

}

return taint;

}

ViaLin/AndroidSource/TaintDroid.java at main · resess/ViaLin · GitHub

Uh oh!

Expand file tree

Breadcrumbs

TaintDroid.java

Latest commit

History

Breadcrumbs

TaintDroid.java

File metadata and controls