Skip to content
On this page

工作原理

什么是Model

为每一个函数都建立一个model,包括库函数,描述:

  • 匹配到了哪些sink点
  • 匹配到了哪些source点
  • 污点怎么从变量传播到返回值,this,静态变量等 迭代求解: 比如foo调用了bar。 Iteration 1: 求foo的model,发生了变化,没有调用者 求bar的model,发生了变化,将bar的调用者foo加入下一轮求解集合中 Iteration 2: 在bar的model基础上继续求解foo的model

什么是Model 源码中的说法

c
/**
 * A `Model` is a summary of what we know about a method. A `Model` should
 * contain the properties we are interested in, such as *generations*,
 * *propagations* and *sinks*.
 *
 * A *mode* describes a specific behavior of a model. See `Model::Mode`.
 *
 * A *generation* describes the property that the method either
 * returns a tainted value or mutates (and hence taints) a reference type
 * argument, regardless of whether parameters are tainted.
 *
 * A *parameter source* of a method describes the property that the method
 * receives a tainted value on a given parameter.
 *
 * A *propagation* describes how taint may flow through a method. More
 * specifically, how taint may flow from a parameter to the method's return
 * value or another parameters. A *propagation* will only propagate the taint
 * if the parameter is tainted. See `Propagation`.
 *
 * A *global sanitizer* sanitizes all sources, sinks or propagations flowing
 * through the method that have a kind dictated by its kinds field
 *
 * *Attach to sources* automatically adds features to all sources flowing out of
 * the method.
 *
 * *Attach to sinks* automatically adds features to all sources flowing in
 * the method.
 *
 * *Attach to propagations* automatically adds features to all propagations from
 * or to a given argument or return value.
 *
 * *Add features to arguments* automatically adds features to all taint that
 * might flow in or out of a given argument. This is equivalent to *attach to
 * sources/sinks/propagations*, but also adds features even when there is no
 * inferred propagation. E.g,
 * ```
 * List<String> x;
 * f(x);
 * // Here x has the feature, regardless of the propagations of f.
 * ```
 *
 * *inline as* is either top, bottom or an argument access path that will be
 * used to inline the method at call sites.
 */

最简单的Model

json

{
    "method": "Lcom/security/bvaa/MainActivity;.f:()V",
    "position": {
        "line": 44,
        "path": "com/security/bvaa/MainActivity.java"
    }
}