Skip to content

Development tips


  • application classes (to be analyzed)
  • the main class (entry point)
  • points-to info
  • call-graphs


A Unit is a statement

  • Get values used in it: getUseBoxes
  • Get valued defined in it: getDefBoxes
  • Get units jumping to it: getBoxesPointingToThis
  • Get units it is jumping to: getUnitBoxes

Boxes is a reference:

  • UnitBoxes: code, branching
  • ValueBoxes


Four IR are parallel, having different characteristics:

  • Baf: bytecode similar
  • Jimple: 3-address, semi-like Java, applicable to most analysis
  • Shimple: SSA form, simplifies analysis
  • Grimp: more human-readable than Jimple

Inter-procedural analysis

Need -w flag for whole-program analysis.


  • cg phase
  • wjpp (Pre-processing pack)
  • wjtp (whole jimple transformation pack)
  • wjap
  • wjop
  • List help for a pack: java soot.Main -ph PACK

Other flags/configurations/args

  • -include-all All classes referred to by any argument classes will be treated as application classes.
  • -f J to produce a Jimple file

Choose data-flow framework

  • Backwards or forwards flow analysis?
  • Branching or not?
  • May or must analysis?
  • Soot data-flow framework is designed to handle any form of cfg implementing the interface soot.toolkits.graph.DirectedGraph
  • Soot provides four implementations of flow sets: ArraySparseSet, ArrayPackedSet, ToppedSet and DataFlowSet. We will describe only the first three.
    • ArraySparseSet is an unbounded flow set. The set is represented as an array of references
    • ArrayPackedSet is a bounded flow set. Requires that the programmer provides a FlowUniverse object
    • ToppedSet wraps another flow set (bounded or not) adding information regarding whether it is the top set (⊤) of the lattice.

Control flow graph


  • BriefUnitGraph is very simple in the sense that it doesn’t have edges representing control flow due to exceptions being thrown.
  • ExceptionalUnitGraph includes edges from throw clauses to their handler (catch block, referred to in Soot as Trap), that is if the trap is local to the method body.
  • TrapUnitGraph like ExceptionalUnitGraph, takes into account exceptions that might be thrown.

Points-to & Call-graph Anlaysis

Examples and tutorials

How to create dummyMain (by reusing code from FlowDroid)

entryPointCreator = createEntryPointCreator(null);
SootMethod dummyMainMethod = entryPointCreator.createDummyMain();
// Zhen: looks like for every intent receiver, a null intent is passed in
if (!dummyMainMethod.getDeclaringClass().isInScene())
// addClass() declares the given class as a library class. We need to
// fix this.



How to speed things up:

  • -no-bodies-for-excluded
  • -x pkg, -exclude pkg