Verified Native Related Flows for FlowDroid

APK Source and Sink Source Code Native Parts Full Flow Dataflow Comment Jimple code Correct? Comment Dataflow Type
com.sgr_b2.compass_18.apk Sink: <com.sgr_b2.compass.a.a: void b(com.sgr_b2.compass.a.d)> virtualinvoke $r2.<android.content.ContentValues: void put(java.lang.String,java.lang.Float)>("lon", $r3) Source: <com.sgr_b2.compass.ui.d: float a(java.lang.String)> $r3 = virtualinvoke $r1.<java.text.DecimalFormat: java.lang.Number parse(java.lang.String)>($r0)
https://bitbucket.org/alekseyt/compass/src/92a4381be7a51efc4d1939851f17b5d513a1bc52/jni/libcompass/utils.c?at=master#lines-11:14 float cmps_sanitize_lon(float lon) { return (lon < -180 ? -180 : ( lon > 180 ? 180 : lon)); }
$f0 = staticinvoke <com.sgr_b2.compass.jni.CCJNI: float cmps_sanitize_lon(float)>($f0)
<Source Statement="$r3 = virtualinvoke $r1.&lt;java.text.DecimalFormat: java.lang.Number parse(java.lang.String)&gt;($r0)" Method="&lt;com.sgr_b2.compass.ui.d: float a(java.lang.String)&gt;"> <AccessPath Value="$r3" Type="java.lang.Number" TaintSubFields="true" /> <TaintPath> <PathElement Statement="$r3 = virtualinvoke $r1.&lt;java.text.DecimalFormat: java.lang.Number parse(java.lang.String)&gt;($r0)" Method="&lt;com.sgr_b2.compass.ui.d: float a(java.lang.String)&gt;"> <AccessPath Value="$r3" Type="java.lang.Number" TaintSubFields="true" /> </PathElement> <PathElement Statement="$f0 = virtualinvoke $r3.&lt;java.lang.Number: float floatValue()&gt;()" Method="&lt;com.sgr_b2.compass.ui.d: float a(java.lang.String)&gt;"> <AccessPath Value="$f0" Type="float" TaintSubFields="true" /> </PathElement> <PathElement Statement="return $f0" Method="&lt;com.sgr_b2.compass.ui.d: float a(java.lang.String)&gt;"> <AccessPath Value="$f1" Type="float" TaintSubFields="true" /> </PathElement> <PathElement Statement="$f1 = staticinvoke &lt;com.sgr_b2.compass.jni.k: float b(float)&gt;($f1)" Method="&lt;com.sgr_b2.compass.activities.AddEditActivity: void onClick(android.view.View)&gt;"> <AccessPath Value="$f0" Type="float" TaintSubFields="true" /> </PathElement> <PathElement Statement="$f0 = staticinvoke &lt;com.sgr_b2.compass.jni.CCJNI: float cmps_sanitize_lon(float)&gt;($f0)" Method="&lt;com.sgr_b2.compass.jni.k: float b(float)&gt;"> <AccessPath Value="$f0" Type="float" TaintSubFields="true" /> </PathElement> <PathElement Statement="return $f0" Method="&lt;com.sgr_b2.compass.jni.CCJNI: float cmps_sanitize_lon(float)&gt;"> <AccessPath Value="$f0" Type="float" TaintSubFields="true" /> </PathElement> <PathElement Statement="return $f0" Method="&lt;com.sgr_b2.compass.jni.k: float b(float)&gt;"> <AccessPath Value="$f1" Type="float" TaintSubFields="true" /> </PathElement> <PathElement Statement="specialinvoke r0.&lt;com.sgr_b2.compass.activities.AddEditActivity: void a(java.lang.String,float,float)&gt;($r4, $f0, $f1)" Method="&lt;com.sgr_b2.compass.activities.AddEditActivity: void onClick(android.view.View)&gt;"> <AccessPath Value="$f1" Type="float" TaintSubFields="true" /> </PathElement> <PathElement Statement="specialinvoke $r5.&lt;com.sgr_b2.compass.a.d: void &lt;init&gt;(float,float,java.lang.String,int)&gt;($f0, $f1, $r1, $i0)" Method="&lt;com.sgr_b2.compass.activities.AddEditActivity: void a(java.lang.String,float,float)&gt;"> <AccessPath Value="$f1" Type="float" TaintSubFields="true" /> </PathElement> <PathElement Statement="r0.&lt;com.sgr_b2.compass.a.d: float d&gt; = $f1" Method="&lt;com.sgr_b2.compass.a.d: void &lt;init&gt;(float,float,java.lang.String,int)&gt;"> <AccessPath Value="r0" Type="com.sgr_b2.compass.a.d" TaintSubFields="true"> <Fields> <Field Value="&lt;com.sgr_b2.compass.a.d: float d&gt;" Type="float" /> </Fields> </AccessPath> </PathElement> <PathElement Statement="return" Method="&lt;com.sgr_b2.compass.a.d: void &lt;init&gt;(float,float,java.lang.String,int)&gt;"> <AccessPath Value="$r5" Type="com.sgr_b2.compass.a.d" TaintSubFields="true"> <Fields> <Field Value="&lt;com.sgr_b2.compass.a.d: float d&gt;" Type="float" /> </Fields> </AccessPath> </PathElement> <PathElement Statement="virtualinvoke $r2.&lt;com.sgr_b2.compass.a.a: void b(com.sgr_b2.compass.a.d)&gt;($r5)" Method="&lt;com.sgr_b2.compass.activities.AddEditActivity: void a(java.lang.String,float,float)&gt;"> <AccessPath Value="$r1" Type="com.sgr_b2.compass.a.d" TaintSubFields="true"> <Fields> <Field Value="&lt;com.sgr_b2.compass.a.d: float d&gt;" Type="float" /> </Fields> </AccessPath> </PathElement> <PathElement Statement="$f0 = $r1.&lt;com.sgr_b2.compass.a.d: float d&gt;" Method="&lt;com.sgr_b2.compass.a.a: void b(com.sgr_b2.compass.a.d)&gt;"> <AccessPath Value="$f0" Type="float" TaintSubFields="true" /> </PathElement> <PathElement Statement="$r3 = staticinvoke &lt;java.lang.Float: java.lang.Float valueOf(float)&gt;($f0)" Method="&lt;com.sgr_b2.compass.a.a: void b(com.sgr_b2.compass.a.d)&gt;"> <AccessPath Value="$r3" Type="java.lang.Float" TaintSubFields="true" /> </PathElement> <PathElement Statement="virtualinvoke $r2.&lt;android.content.ContentValues: void put(java.lang.String,java.lang.Float)&gt;(&quot;lon&quot;, $r3)" Method="&lt;com.sgr_b2.compass.a.a: void b(com.sgr_b2.compass.a.d)&gt;"> <AccessPath Value="$r3" Type="java.lang.Float" TaintSubFields="true" /> </PathElement> </TaintPath> </Source>
param -> return value
public static float cmps_sanitize_lon(float) { float $p0; $p0 := @parameter0; return $p0; }
1 dataflow passes through the calculation propagate
org.echoline.drawterm_2.apk Sink: <org.echoline.drawterm.MainActivity: void keyUp(int)> staticinvoke <org.example.NativeSummaryFuncs: int write(long,java.lang.Object,int)>(1L, null, $i0) Source: <org.echoline.drawterm.MainActivity: boolean dispatchKeyEvent(android.view.KeyEvent)> $i0 = virtualinvoke $r1.<android.view.KeyEvent: int getUnicodeChar()>()
https://github.com/echoline/drawterm-android/blob/44a6233949f975bc04b4052650c818cf24247e1a/gui-android/cpp/native-lib.c#L50 JNIEXPORT void JNICALL Java_org_echoline_drawterm_MainActivity_keyUp( JNIEnv *env, jobject obj, jint c) { kbdkey(c, 0); } void kbdkey(Rune r, int down) { char buf[2+UTFmax]; if(r == 0) return; if(!kbdinuse || keyq == nil){ if(down) kbdputc(kbdq, r); /* /dev/cons */ return; } memset(buf, 0, sizeof buf); buf[0] = down ? 'r' : 'R'; qproduce(keyq, buf, 2+runetochar(buf+1, &r)); } /* _kbdputc, but with compose translation */ int kbdputc(Queue *q, int c) { int i; static int collecting, nk; static Rune kc[5]; if(c == Kalt){ collecting = 1; nk = 0; return 0; } if(!collecting){ _kbdputc(c); return 0; } kc[nk++] = c; c = latin1(kc, nk); if(c < -1) /* need more keystrokes */ return 0; if(c != -1) /* valid sequence */ _kbdputc(c); else for(i=0; i<nk; i++) _kbdputc(kc[i]); nk = 0; collecting = 0; return 0; } static void _kbdputc(int c) { Rune r; char buf[UTFmax]; int n; r = c; n = runetochar(buf, &r); if(n == 0) return; echo(buf, n); } static void echo(char *buf, int n) { qproduce(kbdq, buf, n); if(kbd.raw) return; if(screenputs != 0) echoscreen(buf, n); else write(1, buf, n); }
virtualinvoke r0.<org.echoline.drawterm.MainActivity: void keyUp(int)>($i1) staticinvoke <org.example.NativeSummaryFuncs: int write(long,java.lang.Object,int)>(1L, null, $i0)
<Source Statement="$i0 = virtualinvoke $r1.&lt;android.view.KeyEvent: int getUnicodeChar()&gt;()" Method="&lt;org.echoline.drawterm.MainActivity: boolean dispatchKeyEvent(android.view.KeyEvent)&gt;"> <AccessPath Value="$i0" Type="int" TaintSubFields="true" /> <TaintPath> <PathElement Statement="$i0 = virtualinvoke $r1.&lt;android.view.KeyEvent: int getUnicodeChar()&gt;()" Method="&lt;org.echoline.drawterm.MainActivity: boolean dispatchKeyEvent(android.view.KeyEvent)&gt;"> <AccessPath Value="$i0" Type="int" TaintSubFields="true" /> </PathElement> <PathElement Statement="$i1 = $i0" Method="&lt;org.echoline.drawterm.MainActivity: boolean dispatchKeyEvent(android.view.KeyEvent)&gt;"> <AccessPath Value="$i1" Type="int" TaintSubFields="true" /> </PathElement> <PathElement Statement="virtualinvoke r0.&lt;org.echoline.drawterm.MainActivity: void keyUp(int)&gt;($i1)" Method="&lt;org.echoline.drawterm.MainActivity: boolean dispatchKeyEvent(android.view.KeyEvent)&gt;"> <AccessPath Value="$i0" Type="int" TaintSubFields="true" /> </PathElement> <PathElement Statement="staticinvoke &lt;org.example.NativeSummaryFuncs: int write(long,java.lang.Object,int)&gt;(1L, null, $i0)" Method="&lt;org.echoline.drawterm.MainActivity: void keyUp(int)&gt;"> <AccessPath Value="$i0" Type="int" TaintSubFields="true" /> </PathElement> </TaintPath> </Source>
param0 -> write
public void keyUp(int) { int $p0, $opred; long $0_phi; org.echoline.drawterm.MainActivity $this; $this := @this; $p0 := @parameter0; $0_phi = 0; $opred = org.example.NativeSummaryAux.opaqueInt(); if $opred != 1 goto label1; $0_phi = 145L; goto label6; label1: if $opred != 2 goto label2; $0_phi = 146L; goto label6; label2: if $opred != 3 goto label3; $0_phi = 147L; goto label6; label3: if $opred != 4 goto label4; $0_phi = 148L; goto label6; label4: if $opred != 5 goto label5; $0_phi = 149L; goto label6; label5: if $opred != 6 goto label6; $0_phi = 150L; label6: org.example.NativeSummaryFuncs.malloc($0_phi); org.example.NativeSummaryFuncs.write(2L, null, null); org.example.NativeSummaryFuncs.write(1L, null, $p0); return; }
1 the argument0 is passed to write nsfunc_sink fopen
cc.echonet.coolmicapp_10300.apk Sink: <cc.echonet.coolmicdspjava.Wrapper: int setVuMeterInterval(int)> staticinvoke <android.util.Log: int d(java.lang.String,java.lang.String)>("wrapper.c", $r1) Source: <cc.echonet.coolmicapp.Configuration.VUMeter: int getInterval()> $i0 = staticinvoke <java.lang.Integer: int parseInt(java.lang.String)>($r1)
https://github.com/CoolMicApp/CoolMicApp-Android/blob/4810d260d8f405ecadb6eef92da701f20d8e3dff/app/src/main/jni/libcoolmic-dsp-java/wrapper.c#L460 JNIEXPORT int JNICALL Java_cc_echonet_coolmicdspjava_Wrapper_setVuMeterInterval(JNIEnv * env, jobject obj, jint interval) { wrapper_t * wrapper = get_wrapper_t(env, obj); LOGI("setVuMeterInterval start"); if(wrapper->coolmic_simple_obj == NULL) { LOGI("setVuMeterInterval bailing - no core obj"); return -999666; } LOGI("Setting VU-Meter Interval to %i", (int)interval); return coolmic_simple_set_vumeter_interval(wrapper->coolmic_simple_obj, (size_t) interval); }
virtualinvoke $r10.<cc.echonet.coolmicdspjava.Wrapper: int setVuMeterInterval(int)>($i0)
<Source Statement="$i0 = staticinvoke &lt;java.lang.Integer: int parseInt(java.lang.String)&gt;($r1)" Method="&lt;cc.echonet.coolmicapp.Configuration.VUMeter: int getInterval()&gt;"> <AccessPath Value="$i0" Type="int" TaintSubFields="true" /> <TaintPath> <PathElement Statement="$i0 = staticinvoke &lt;java.lang.Integer: int parseInt(java.lang.String)&gt;($r1)" Method="&lt;cc.echonet.coolmicapp.Configuration.VUMeter: int getInterval()&gt;"> <AccessPath Value="$i0" Type="int" TaintSubFields="true" /> </PathElement> <PathElement Statement="return $i0" Method="&lt;cc.echonet.coolmicapp.Configuration.VUMeter: int getInterval()&gt;"> <AccessPath Value="$i0" Type="int" TaintSubFields="true" /> </PathElement> <PathElement Statement="$i0 = $i0 * $i1" Method="&lt;cc.echonet.coolmicapp.BackgroundService.Server.Driver: void reloadParameters(boolean)&gt;"> <AccessPath Value="$i0" Type="int" TaintSubFields="true" /> </PathElement> <PathElement Statement="$i0 = $i0 / 48000" Method="&lt;cc.echonet.coolmicapp.BackgroundService.Server.Driver: void reloadParameters(boolean)&gt;"> <AccessPath Value="$i0" Type="int" TaintSubFields="true" /> </PathElement> <PathElement Statement="virtualinvoke $r10.&lt;cc.echonet.coolmicdspjava.Wrapper: int setVuMeterInterval(int)&gt;($i0)" Method="&lt;cc.echonet.coolmicapp.BackgroundService.Server.Driver: void reloadParameters(boolean)&gt;"> <AccessPath Value="$i0" Type="int" TaintSubFields="true" /> </PathElement> <PathElement Statement="$r3 = staticinvoke &lt;java.lang.Integer: java.lang.Integer valueOf(int)&gt;($i0)" Method="&lt;cc.echonet.coolmicdspjava.Wrapper: int setVuMeterInterval(int)&gt;"> <AccessPath Value="$r3" Type="java.lang.Integer" TaintSubFields="true" /> </PathElement> <PathElement Statement="$r1 = virtualinvoke $r3.&lt;java.lang.Integer: java.lang.String toString()&gt;()" Method="&lt;cc.echonet.coolmicdspjava.Wrapper: int setVuMeterInterval(int)&gt;"> <AccessPath Value="$r1" Type="java.lang.String" TaintSubFields="true" /> </PathElement> <PathElement Statement="staticinvoke &lt;android.util.Log: int d(java.lang.String,java.lang.String)&gt;(&quot;wrapper.c&quot;, $r1)" Method="&lt;cc.echonet.coolmicdspjava.Wrapper: int setVuMeterInterval(int)&gt;"> <AccessPath Value="$r1" Type="java.lang.String" TaintSubFields="true" /> </PathElement> </TaintPath> </Source>
param interval -> log
public synchronized int setVuMeterInterval(int) { long $2; java.lang.Integer boxed; java.lang.Long boxed, boxed, boxed; int $p0, $opred, $7; java.lang.String $3_phi, $casted, $13_phi, $casted, $17_phi, $casted, $21_phi, $casted; cc.echonet.coolmicdspjava.Wrapper $this; $this := @this; $p0 := @parameter0; $2 = $this.nativeObject; $3_phi = null; $opred = org.example.NativeSummaryAux.opaqueInt(); if $opred != 1 goto label1; boxed = java.lang.Long.valueOf($2); $casted = virtualinvoke boxed.toString(); $3_phi = $casted; goto label2; label1: if $opred != 2 goto label2; $3_phi = "wrapper=%p"; label2: android.util.Log.d("wrapper.c", $3_phi); $7 = org.example.NativeSummaryFuncs.calloc(1L, 56L); $this.nativeObject = $7; $13_phi = null; if $opred != 3 goto label3; $13_phi = "setVuMeterInterval start"; goto label4; label3: if $opred != 4 goto label4; boxed = java.lang.Long.valueOf($2); $casted = virtualinvoke boxed.toString(); $13_phi = $casted; label4: android.util.Log.d("wrapper.c", $13_phi); $17_phi = null; if $opred != 5 goto label5; boxed = java.lang.Long.valueOf($2); $casted = virtualinvoke boxed.toString(); $17_phi = $casted; goto label6; label5: if $opred != 6 goto label6; $17_phi = "setVuMeterInterval bailing - no core obj"; label6: android.util.Log.d("wrapper.c", $17_phi); $21_phi = null; if $opred != 7 goto label7; $21_phi = "Setting VU-Meter Interval to %i"; goto label8; label7: if $opred != 8 goto label8; boxed = java.lang.Integer.valueOf($p0); $casted = virtualinvoke boxed.toString(); $21_phi = $casted; label8: android.util.Log.d("wrapper.c", $21_phi); return null; }
1 the param is logged by LOGI log_sink
net.avs234_16.apk Sink: <net.avs234.AndLessSrv: boolean libInit(int)> staticinvoke <android.util.Log: int i(java.lang.String,java.lang.String)>("liblossless", $r0) Source: <net.avs234.AndLessSrv: void onCreate()> $i0 = staticinvoke <java.lang.Integer: int parseInt(java.lang.String)>($r5)
https://github.com/redesh/andless/blob/master/jni/main.c#L218 static jboolean libinit(JNIEnv *env, jobject obj, jint sdk) { /* #include <sys/system_properties.h> int sdk; char c[PROP_VALUE_MAX]; if(__system_property_get("ro.build.version.sdk",c) > 0) sscanf(c,"%d",&sdk); else sdk = 8; */ __android_log_print(ANDROID_LOG_INFO,"liblossless","libinit: sdk=%d",sdk); if(!libhandle) { if(sdk >= 17) libhandle = dlopen("/data/data/net.avs234/lib/libatrack17.so", RTLD_NOW); else if(sdk == 16) libhandle = dlopen("/data/data/net.avs234/lib/libatrack16.so", RTLD_NOW); else if(sdk > 8) libhandle = dlopen("/data/data/net.avs234/lib/libatrack9.so", RTLD_NOW); else libhandle = dlopen("/data/data/net.avs234/lib/libatrack8.so", RTLD_NOW); if(libhandle) { libmedia_pause = (typeof(libmedia_pause)) dlsym(libhandle,"libmedia_pause"); libmedia_resume = (typeof(libmedia_resume)) dlsym(libhandle,"libmedia_resume"); libmedia_start = (typeof(libmedia_start)) dlsym(libhandle,"libmedia_start"); libmedia_stop = (typeof(libmedia_stop)) dlsym(libhandle,"libmedia_stop"); libmedia_write = (typeof(libmedia_write)) dlsym(libhandle,"libmedia_write"); libmediacb_start = (typeof(libmediacb_start)) dlsym(libhandle,"libmediacb_start"); libmediacb_stop = (typeof(libmediacb_stop)) dlsym(libhandle,"libmediacb_stop"); libmediacb_write = (typeof(libmediacb_write)) dlsym(libhandle,"libmediacb_write"); libmediacb_wait_done = (typeof(libmediacb_wait_done)) dlsym(libhandle,"libmediacb_wait_done"); } } __android_log_print(ANDROID_LOG_INFO,"liblossless","libinit: handle=%p",libhandle); return libhandle != 0; }
$z0 = staticinvoke <net.avs234.AndLessSrv: boolean libInit(int)>($i0)
<Source Statement="$i0 = staticinvoke &lt;java.lang.Integer: int parseInt(java.lang.String)&gt;($r5)" Method="&lt;net.avs234.AndLessSrv: void onCreate()&gt;"> <AccessPath Value="$i0" Type="int" TaintSubFields="true" /> <TaintPath> <PathElement Statement="$i0 = staticinvoke &lt;java.lang.Integer: int parseInt(java.lang.String)&gt;($r5)" Method="&lt;net.avs234.AndLessSrv: void onCreate()&gt;"> <AccessPath Value="$i0" Type="int" TaintSubFields="true" /> </PathElement> <PathElement Statement="$z0 = staticinvoke &lt;net.avs234.AndLessSrv: boolean libInit(int)&gt;($i0)" Method="&lt;net.avs234.AndLessSrv: void onCreate()&gt;"> <AccessPath Value="$i0" Type="int" TaintSubFields="true" /> </PathElement> <PathElement Statement="$r1 = staticinvoke &lt;java.lang.Integer: java.lang.Integer valueOf(int)&gt;($i0)" Method="&lt;net.avs234.AndLessSrv: boolean libInit(int)&gt;"> <AccessPath Value="$r1" Type="java.lang.Integer" TaintSubFields="true" /> </PathElement> <PathElement Statement="$r0 = virtualinvoke $r1.&lt;java.lang.Integer: java.lang.String toString()&gt;()" Method="&lt;net.avs234.AndLessSrv: boolean libInit(int)&gt;"> <AccessPath Value="$r0" Type="java.lang.String" TaintSubFields="true" /> </PathElement> <PathElement Statement="staticinvoke &lt;android.util.Log: int i(java.lang.String,java.lang.String)&gt;(&quot;liblossless&quot;, $r0)" Method="&lt;net.avs234.AndLessSrv: boolean libInit(int)&gt;"> <AccessPath Value="$r0" Type="java.lang.String" TaintSubFields="true" /> </PathElement> </TaintPath> </Source>
the param0 id -> log
public static boolean libInit(int) { int $p0, $opred; java.lang.String $0_phi, $casted, $5_phi; java.lang.Integer boxed; boolean $9_phi; $p0 := @parameter0; $0_phi = null; $opred = org.example.NativeSummaryAux.opaqueInt(); if $opred != 1 goto label01; $0_phi = "libinit: sdk=%d"; goto label02; label01: if $opred != 2 goto label02; boxed = java.lang.Integer.valueOf($p0); $casted = virtualinvoke boxed.toString(); $0_phi = $casted; label02: android.util.Log.i("liblossless", $0_phi); $5_phi = null; if $opred != 3 goto label03; $5_phi = "/data/data/net.avs234/lib/libatrack9.so"; goto label07; label03: if $opred != 4 goto label04; $5_phi = "/data/data/net.avs234/lib/libatrack8.so"; goto label07; label04: if $opred != 5 goto label05; $5_phi = "libinit: handle=%p"; goto label07; label05: if $opred != 6 goto label06; $5_phi = "/data/data/net.avs234/lib/libatrack17.so"; goto label07; label06: if $opred != 7 goto label07; $5_phi = "/data/data/net.avs234/lib/libatrack16.so"; label07: android.util.Log.i("liblossless", $5_phi); $9_phi = 0; if $opred != 8 goto label08; $9_phi = 16L; goto label12; label08: if $opred != 9 goto label09; $9_phi = 1L; goto label12; label09: if $opred != 10 goto label10; $9_phi = 136L; goto label12; label10: if $opred != 11 goto label11; $9_phi = 232L; goto label12; label11: if $opred != 12 goto label12; $9_phi = 184L; label12: return $9_phi; }
1 the param0 is logged in native code log_sink
org.emunix.unipatcher_160100.apk Sink: <org.emunix.unipatcher.patcher.XDelta: int xdelta3apply(java.lang.String,java.lang.String,java.lang.String,boolean)> $i0 = staticinvoke <org.example.NativeSummaryFuncs: int fopen(java.lang.String,java.lang.String)>($r0, "rb") Source: <org.emunix.unipatcher.patcher.XDelta: void a(boolean)> $r3 = virtualinvoke $r2.<java.io.File: java.lang.String getPath()>()
https://github.com/btimofeev/UniPatcher/blob/a5a69cc607fadef43734589b311e5ef1bcde6941/app/src/main/cpp/xdelta3/xdelta3.c#L42 int Java_org_emunix_unipatcher_patcher_XDelta_xdelta3apply(JNIEnv *env, jobject this, jstring patchPath, jstring romPath, jstring outputPath, jboolean ignoreChecksum) { int ret = 0; const char *patchName = (*env)->GetStringUTFChars(env, patchPath, NULL); const char *romName = (*env)->GetStringUTFChars(env, romPath, NULL); const char *outputName = (*env)->GetStringUTFChars(env, outputPath, NULL); FILE *patchFile = fopen(patchName, "rb"); FILE *romFile = fopen(romName, "rb"); FILE *outputFile = fopen(outputName, "wb"); (*env)->ReleaseStringUTFChars(env, patchPath, patchName); (*env)->ReleaseStringUTFChars(env, romPath, romName); (*env)->ReleaseStringUTFChars(env, outputPath, outputName); if (!patchFile) { return ERR_UNABLE_OPEN_PATCH; } if (!romFile) { fclose(patchFile); return ERR_UNABLE_OPEN_ROM; } if (!outputFile) { fclose(patchFile); fclose(romFile); return ERR_UNABLE_OPEN_OUTPUT; } ret = code(0, patchFile, romFile, outputFile, (int)ignoreChecksum); fclose(patchFile); fclose(romFile); fclose(outputFile); return ret; }
$i0 = staticinvoke <org.emunix.unipatcher.patcher.XDelta: int xdelta3apply(java.lang.String,java.lang.String,java.lang.String,boolean)>($r3, $r4, $r5, $z0) $i0 = staticinvoke <org.example.NativeSummaryFuncs: int fopen(java.lang.String,java.lang.String)>($r0, "rb")
<Source Statement="$r3 = virtualinvoke $r2.&lt;java.io.File: java.lang.String getPath()&gt;()" Method="&lt;org.emunix.unipatcher.patcher.XDelta: void a(boolean)&gt;"> <AccessPath Value="$r3" Type="java.lang.String" TaintSubFields="true" /> <TaintPath> <PathElement Statement="$r3 = virtualinvoke $r2.&lt;java.io.File: java.lang.String getPath()&gt;()" Method="&lt;org.emunix.unipatcher.patcher.XDelta: void a(boolean)&gt;"> <AccessPath Value="$r3" Type="java.lang.String" TaintSubFields="true" /> </PathElement> <PathElement Statement="$i0 = staticinvoke &lt;org.emunix.unipatcher.patcher.XDelta: int xdelta3apply(java.lang.String,java.lang.String,java.lang.String,boolean)&gt;($r3, $r4, $r5, $z0)" Method="&lt;org.emunix.unipatcher.patcher.XDelta: void a(boolean)&gt;"> <AccessPath Value="$r0" Type="java.lang.String" TaintSubFields="true" /> </PathElement> <PathElement Statement="$i0 = staticinvoke &lt;org.example.NativeSummaryFuncs: int fopen(java.lang.String,java.lang.String)&gt;($r0, &quot;rb&quot;)" Method="&lt;org.emunix.unipatcher.patcher.XDelta: int xdelta3apply(java.lang.String,java.lang.String,java.lang.String,boolean)&gt;"> <AccessPath Value="$r0" Type="java.lang.String" TaintSubFields="true" /> </PathElement> </TaintPath> </Source>
param0 -> fopen
public static int xdelta3apply(java.lang.String, java.lang.String, java.lang.String, boolean) { int $4, $16, $19, $21; java.lang.String $p0, $p1, $p2; boolean $p3; $p0 := @parameter0; $p1 := @parameter1; $p2 := @parameter2; $p3 := @parameter3; $4 = org.example.NativeSummaryFuncs.fopen($p0, "rb"); org.example.NativeSummaryFuncs.fopen($p1, "rb"); org.example.NativeSummaryFuncs.fopen($p2, "wb"); org.example.NativeSummaryFuncs.fclose($4); $16 = org.example.NativeSummaryFuncs.malloc(4096L); org.example.NativeSummaryFuncs.fread($16, 1L, 4096L, null); $19 = org.example.NativeSummaryFuncs.malloc(4096L); $21 = org.example.NativeSummaryFuncs.fread($19, 1L, 4096L, null); org.example.NativeSummaryFuncs.raise(8L); org.example.NativeSummaryFuncs.raise(8L); org.example.NativeSummaryFuncs.raise(8L); org.example.NativeSummaryFuncs.raise(8L); org.example.NativeSummaryFuncs.fread($16, 1L, null, null); org.example.NativeSummaryFuncs.free($19); org.example.NativeSummaryFuncs.free($16); org.example.NativeSummaryFuncs.fclose(null); org.example.NativeSummaryFuncs.fclose($21); org.example.NativeSummaryFuncs.fclose($21); org.example.NativeSummaryFuncs.fclose($4); return $21; }
1 the param0 path is opened by fopen nsfunc_sink fopen
net.tedstein.AndroSS_17.apk Sink: <net.tedstein.AndroSS.AndroSSService: int[] getFBPixels(int,java.lang.String,int,int,int,int,int[],int[])> staticinvoke <org.example.NativeSummaryFuncs: int GetIntArrayRegion(java.lang.Object,int[],java.lang.Object,long,java.lang.Object)>(null, $r2, null, 4L, null) Source: <net.tedstein.AndroSS.AndroSSService: boolean init()> $i1 = staticinvoke <java.lang.Integer: int parseInt(java.lang.String)>($r2)
https://github.com/tstein/AndroSS/blob/5d5502312efe3b9a2c5e4c8b09128f196458776b/jni/AndroSS_nbridge.c#L193 jintArray Java_net_tedstein_AndroSS_AndroSSService_getFBPixels( JNIEnv * env, jobject this, jint type, jstring command_j, jint height, jint width, jint bpp, jint stride, jintArray offsets_j, jintArray sizes_j) { if (type == TYPE_GENERIC) { LogD("NBridge: Getting pixels on a generic device."); } else if (type == TYPE_TEGRA) { LogD("NBridge: Getting pixels on a Tegra device."); } else { LogE("NBridge: What the hell am I getting pixels on?! Got type %d", type); return 0; } // Extract color offsets and sizes from the Java array types. int offsets[4], sizes[4]; (*env)->GetIntArrayRegion(env, offsets_j, 0, 4, offsets); (*env)->GetIntArrayRegion(env, sizes_j, 0, 4, sizes); const char * command_const = (*env)->GetStringUTFChars(env, command_j, 0); char * command = (char *)calloc(strlen(command_const) + 1, sizeof(char)); strncpy(command, command_const, strlen(command_const)); // Allocate enough space to store all pixels in ARGB_8888. We'll initially // put the pixels at the highest address within our buffer they can fit. int pixbuf_size = height * ((stride > width * 4) ? stride : width * 4); uint8_t * pixbuf = malloc(pixbuf_size); unsigned int pixbuf_offset = pixbuf_size - (stride * height); if (type == TYPE_GENERIC) { char bytes_str[MAX_BYTES_DIGITS]; sprintf(bytes_str, "%u", stride * height); // Tell the external binary to read the framebuffer and how many bytes we want. setenv(MODE_ENVVAR, "FB_DATA", 1); setenv(FB_BYTES_ENVVAR, bytes_str, 1); } // And then slurp the data. char ** argv = mkargv(command); execForOutput(argv, pixbuf + pixbuf_offset, stride * height, 1, type == TYPE_TEGRA ? TEGRA_SKIP_BYTES : 0); // Convert all of the pixels to ARGB_8888 according to the parameters passed // in from Dalvikspace. To save space and time, we do this in-place. If each // pixel is fewer than four bytes, this involves shifting data like this: // (lower addresses to the left, r = raw, f = formatted, two bytes per char) // < -- -- -- -- r1 r2 r3 r4 > // < f1 f1 -- -- r1 r2 r3 r4 > // < f1 f1 f2 f2 r1 r2 r3 r4 > // < f1 f1 f2 f2 f3 f3 r3 r4 > // < f1 f1 f2 f2 f3 f3 f4 f4 > int pixels = width * height; LogD("NBridge: Converting %u pixels.", pixels); struct timeval start_tv, end_tv; gettimeofday(&start_tv, NULL); uint8_t * unformatted_pixels = pixbuf + pixbuf_offset; for (int i = 0; i < height; ++i) { uint8_t * unformatted_line = unformatted_pixels + (i * stride); for (int j = 0; j < width; ++j) { uint32_t pix = extractPixel(unformatted_line, j, bpp); *(((uint32_t *)pixbuf) + (i * width) + j) = formatPixel(pix, offsets, sizes); } } gettimeofday(&end_tv, NULL); int seconds = end_tv.tv_sec - start_tv.tv_sec; int useconds = end_tv.tv_usec - start_tv.tv_usec; LogD("NBridge: Conversion finished in %u ms.", (seconds * 1000) + (useconds / 1000)); // Finally, cast pixbuf as an jint[] and convert it to a jintArray we can // return to Java. jintArray ret = (*env)->NewIntArray(env, pixels); (*env)->SetIntArrayRegion(env, ret, 0, pixels, (jint *)pixbuf); free(pixbuf); LogD("NBridge: Returning data."); return ret; }
r5 = staticinvoke <net.tedstein.AndroSS.AndroSSService: int[] getFBPixels(int,java.lang.String,int,int,int,int,int[],int[])>($i7, r6, $i8, $i9, i0, i10, r5, $r8) staticinvoke <org.example.NativeSummaryFuncs: int GetIntArrayRegion(java.lang.Object,int[],java.lang.Object,long,java.lang.Object)>(null, $r2, null, 4L, null)
<Source Statement="$i1 = staticinvoke &lt;java.lang.Integer: int parseInt(java.lang.String)&gt;($r2)" Method="&lt;net.tedstein.AndroSS.AndroSSService: boolean init()&gt;"> <AccessPath Value="$i1" Type="int" TaintSubFields="true" /> <TaintPath> <PathElement Statement="$i1 = staticinvoke &lt;java.lang.Integer: int parseInt(java.lang.String)&gt;($r2)" Method="&lt;net.tedstein.AndroSS.AndroSSService: boolean init()&gt;"> <AccessPath Value="$i1" Type="int" TaintSubFields="true" /> </PathElement> <PathElement Statement="$r4[$i0] = $i1" Method="&lt;net.tedstein.AndroSS.AndroSSService: boolean init()&gt;"> <AccessPath Value="$r4" Type="int[]" TaintSubFields="true" /> </PathElement> <PathElement Statement="$r4 = &lt;net.tedstein.AndroSS.AndroSSService: int[] c_sizes&gt;" Method="&lt;net.tedstein.AndroSS.AndroSSService: boolean init()&gt;"> <AccessPath TaintSubFields="true"> <Fields> <Field Value="&lt;net.tedstein.AndroSS.AndroSSService: int[] c_sizes&gt;" Type="int[]" /> </Fields> </AccessPath> </PathElement> <PathElement Statement="return 1" Method="&lt;net.tedstein.AndroSS.AndroSSService: boolean init()&gt;"> <AccessPath TaintSubFields="true"> <Fields> <Field Value="&lt;net.tedstein.AndroSS.AndroSSService: int[] c_sizes&gt;" Type="int[]" /> </Fields> </AccessPath> </PathElement> <PathElement Statement="return" Method="&lt;net.tedstein.AndroSS.AndroSSService: void onCreate()&gt;"> <AccessPath TaintSubFields="true"> <Fields> <Field Value="&lt;net.tedstein.AndroSS.AndroSSService: int[] c_sizes&gt;" Type="int[]" /> </Fields> </AccessPath> </PathElement> <PathElement Statement="virtualinvoke $r0.&lt;net.tedstein.AndroSS.AndroSSService: int onStartCommand(android.content.Intent,int,int)&gt;(null, 0, 0)" Method="&lt;dummyMainClass: net.tedstein.AndroSS.AndroSSService dummyMainMethod_net_tedstein_AndroSS_AndroSSService(android.content.Intent)&gt;"> <AccessPath TaintSubFields="true"> <Fields> <Field Value="&lt;net.tedstein.AndroSS.AndroSSService: int[] c_sizes&gt;" Type="int[]" /> </Fields> </AccessPath> </PathElement> <PathElement Statement="virtualinvoke r0.&lt;net.tedstein.AndroSS.AndroSSService: void takeScreenshot()&gt;()" Method="&lt;net.tedstein.AndroSS.AndroSSService: int onStartCommand(android.content.Intent,int,int)&gt;"> <AccessPath TaintSubFields="true"> <Fields> <Field Value="&lt;net.tedstein.AndroSS.AndroSSService: int[] c_sizes&gt;" Type="int[]" /> </Fields> </AccessPath> </PathElement> <PathElement Statement="$r8 = &lt;net.tedstein.AndroSS.AndroSSService: int[] c_sizes&gt;" Method="&lt;net.tedstein.AndroSS.AndroSSService: void takeScreenshot()&gt;"> <AccessPath Value="$r8" Type="int[]" TaintSubFields="true" /> </PathElement> <PathElement Statement="r5 = staticinvoke &lt;net.tedstein.AndroSS.AndroSSService: int[] getFBPixels(int,java.lang.String,int,int,int,int,int[],int[])&gt;($i7, r6, $i8, $i9, i0, i10, r5, $r8)" Method="&lt;net.tedstein.AndroSS.AndroSSService: void takeScreenshot()&gt;"> <AccessPath Value="$r2" Type="int[]" TaintSubFields="true" /> </PathElement> <PathElement Statement="staticinvoke &lt;org.example.NativeSummaryFuncs: int GetIntArrayRegion(java.lang.Object,int[],java.lang.Object,long,java.lang.Object)&gt;(null, $r2, null, 4L, null)" Method="&lt;net.tedstein.AndroSS.AndroSSService: int[] getFBPixels(int,java.lang.String,int,int,int,int,int[],int[])&gt;"> <AccessPath Value="$r2" Type="int[]" TaintSubFields="true" /> </PathElement> </TaintPath> </Source>
last param -> GetIntArrayRegion
private static int[] getFBPixels(int, java.lang.String, int, int, int, int, int[], int[]) { java.lang.Integer boxed, boxed, boxed, boxed, boxed, boxed, boxed, boxed, boxed, boxed, boxed, boxed, boxed, boxed, boxed, boxed, boxed, boxed, boxed, boxed, boxed, boxed, boxed, boxed, boxed, boxed, boxed, boxed, boxed, boxed; java.lang.Long boxed, boxed; java.lang.String $p1, $0_phi, $4_phi, $11, $12_phi, $casted, $casted, $casted, $13, $14_phi, $17_phi, $casted, $casted, $19_phi, $24_phi, $casted, $29_phi, $36_phi, $41_phi, $casted, $46_phi, $casted, $casted, $casted, $51_phi, $casted, $casted, $casted, $56_phi, $casted, $casted, $63_phi, $casted, $casted, $67_phi, $73_phi, $casted, $casted, $74_phi, $casted, $casted, $casted, $casted, $76_phi, $casted, $casted, $casted, $casted, $79_phi, $casted, $casted, $83_phi, $casted; int[] $p6, $p7; int $p0, $p2, $p3, $p4, $p5, $opred, $33; $p0 := @parameter0; $p1 := @parameter1; $p2 := @parameter2; $p3 := @parameter3; $p4 := @parameter4; $p5 := @parameter5; $p6 := @parameter6; $p7 := @parameter7; $0_phi = null; $opred = org.example.NativeSummaryAux.opaqueInt(); if $opred != 1 goto label01; $0_phi = "AndroSS"; goto label02; label01: if $opred != 2 goto label02; $0_phi = "NBridge: Getting pixels on a generic device."; label02: android.util.Log.d("AndroSS", $0_phi); $4_phi = null; if $opred != 3 goto label03; $4_phi = "AndroSS"; goto label04; label03: if $opred != 4 goto label04; $4_phi = "NBridge: Getting pixels on a Tegra device."; label04: android.util.Log.d("AndroSS", $4_phi); org.example.NativeSummaryFuncs.GetIntArrayRegion(null, $p6, null, 4L, null); org.example.NativeSummaryFuncs.GetIntArrayRegion(null, $p7, null, 4L, null); $11 = org.example.NativeSummaryFuncs.calloc(17L, 1L); $12_phi = null; if $opred != 5 goto label05; boxed = java.lang.Integer.valueOf($p2); $casted = virtualinvoke boxed.toString(); $12_phi = $casted; goto label07; label05: if $opred != 6 goto label06; boxed = java.lang.Integer.valueOf($p5); $casted = virtualinvoke boxed.toString(); $12_phi = $casted; goto label07; label06: if $opred != 7 goto label07; boxed = java.lang.Integer.valueOf($p3); $casted = virtualinvoke boxed.toString(); $12_phi = $casted; label07: $13 = org.example.NativeSummaryFuncs.malloc($12_phi); $14_phi = null; if $opred != 8 goto label08; $14_phi = null; goto label09; label08: if $opred != 9 goto label09; $14_phi = $11; label09: org.example.NativeSummaryFuncs.strchr($14_phi, 32L); org.example.NativeSummaryFuncs.calloc(null, 4L); $17_phi = null; if $opred != 10 goto label10; boxed = java.lang.Integer.valueOf($p2); $casted = virtualinvoke boxed.toString(); $17_phi = $casted; goto label11; label10: if $opred != 11 goto label11; boxed = java.lang.Integer.valueOf($p5); $casted = virtualinvoke boxed.toString(); $17_phi = $casted; label11: org.example.NativeSummaryFuncs.sprintf(null, "%u", $17_phi); $19_phi = null; if $opred != 12 goto label12; $19_phi = null; goto label13; label12: if $opred != 13 goto label13; $19_phi = $11; label13: org.example.NativeSummaryFuncs.strchr($19_phi, 32L); org.example.NativeSummaryFuncs.calloc(null, 4L); org.example.NativeSummaryFuncs.pipe(null); $24_phi = null; if $opred != 14 goto label14; boxed = java.lang.Long.valueOf(1L); $casted = virtualinvoke boxed.toString(); $24_phi = $casted; goto label17; label14: if $opred != 15 goto label15; $24_phi = "NBridge: Reading fd %d from %s with args:"; goto label17; label15: if $opred != 16 goto label16; $24_phi = null; goto label17; label16: if $opred != 17 goto label17; $24_phi = $11; label17: android.util.Log.d("AndroSS", $24_phi); $29_phi = null; if $opred != 18 goto label18; $29_phi = null; goto label20; label18: if $opred != 19 goto label19; $29_phi = "\t%s"; goto label20; label19: if $opred != 20 goto label20; $29_phi = $11; label20: android.util.Log.d("AndroSS", $29_phi); $33 = org.example.NativeSummaryFuncs.fork(); org.example.NativeSummaryFuncs.close(null); org.example.NativeSummaryFuncs.close(null); $36_phi = null; if $opred != 21 goto label21; $36_phi = null; goto label22; label21: if $opred != 22 goto label22; $36_phi = "NBridge: Error skipping junk! Only tossed %d bytes."; label22: android.util.Log.e("AndroSS", $36_phi); $41_phi = null; if $opred != 23 goto label23; $41_phi = "NBridge: Skipped %d bytes."; goto label25; label23: if $opred != 24 goto label24; boxed = java.lang.Long.valueOf(52L); $casted = virtualinvoke boxed.toString(); $41_phi = $casted; goto label25; label24: if $opred != 25 goto label25; $41_phi = null; label25: android.util.Log.d("AndroSS", $41_phi); $46_phi = null; if $opred != 26 goto label26; $46_phi = "NBridge: Error while reading from subprocess:"; goto label29; label26: if $opred != 27 goto label27; boxed = java.lang.Integer.valueOf($p2); $casted = virtualinvoke boxed.toString(); $46_phi = $casted; goto label29; label27: if $opred != 28 goto label28; boxed = java.lang.Integer.valueOf($p5); $casted = virtualinvoke boxed.toString(); $46_phi = $casted; goto label29; label28: if $opred != 29 goto label29; boxed = java.lang.Integer.valueOf($p3); $casted = virtualinvoke boxed.toString(); $46_phi = $casted; label29: android.util.Log.e("AndroSS", $46_phi); $51_phi = null; if $opred != 30 goto label30; boxed = java.lang.Integer.valueOf($p2); $casted = virtualinvoke boxed.toString(); $51_phi = $casted; goto label33; label30: if $opred != 31 goto label31; boxed = java.lang.Integer.valueOf($p5); $casted = virtualinvoke boxed.toString(); $51_phi = $casted; goto label33; label31: if $opred != 32 goto label32; boxed = java.lang.Integer.valueOf($p3); $casted = virtualinvoke boxed.toString(); $51_phi = $casted; goto label33; label32: if $opred != 33 goto label33; $51_phi = null; label33: android.util.Log.e("AndroSS", $51_phi); $56_phi = null; if $opred != 34 goto label34; $56_phi = "NBridge: Read %d of %d bytes from subprocess with %d reads."; goto label37; label34: if $opred != 35 goto label35; boxed = java.lang.Integer.valueOf($p2); $casted = virtualinvoke boxed.toString(); $56_phi = $casted; goto label37; label35: if $opred != 36 goto label36; boxed = java.lang.Integer.valueOf($p5); $casted = virtualinvoke boxed.toString(); $56_phi = $casted; goto label37; label36: if $opred != 37 goto label37; $56_phi = null; label37: android.util.Log.d("AndroSS", $56_phi); org.example.NativeSummaryFuncs.close(null); org.example.NativeSummaryFuncs.waitpid($33, null, null); $63_phi = null; if $opred != 38 goto label38; boxed = java.lang.Integer.valueOf($p2); $casted = virtualinvoke boxed.toString(); $63_phi = $casted; goto label40; label38: if $opred != 39 goto label39; boxed = java.lang.Integer.valueOf($p3); $casted = virtualinvoke boxed.toString(); $63_phi = $casted; goto label40; label39: if $opred != 40 goto label40; $63_phi = "NBridge: Converting %u pixels."; label40: android.util.Log.d("AndroSS", $63_phi); $67_phi = null; if $opred != 41 goto label41; $67_phi = "NBridge: Conversion finished in %u ms."; goto label42; label41: if $opred != 42 goto label42; $67_phi = null; label42: android.util.Log.d("AndroSS", $67_phi); if $opred != 43 goto label43; boxed = java.lang.Integer.valueOf($p2); virtualinvoke boxed.toString(); goto label44; label43: if $opred != 44 goto label44; boxed = java.lang.Integer.valueOf($p3); virtualinvoke boxed.toString(); label44: $73_phi = null; if $opred != 45 goto label45; boxed = java.lang.Integer.valueOf($p2); $casted = virtualinvoke boxed.toString(); $73_phi = $casted; goto label46; label45: if $opred != 46 goto label46; boxed = java.lang.Integer.valueOf($p3); $casted = virtualinvoke boxed.toString(); $73_phi = $casted; label46: $74_phi = null; if $opred != 47 goto label47; $74_phi = $13; goto label51; label47: if $opred != 48 goto label48; boxed = java.lang.Integer.valueOf($p2); $casted = virtualinvoke boxed.toString(); $74_phi = $casted; goto label51; label48: if $opred != 49 goto label49; boxed = java.lang.Integer.valueOf($p5); $casted = virtualinvoke boxed.toString(); $74_phi = $casted; goto label51; label49: if $opred != 50 goto label50; boxed = java.lang.Integer.valueOf($p3); $casted = virtualinvoke boxed.toString(); $74_phi = $casted; goto label51; label50: if $opred != 51 goto label51; boxed = java.lang.Integer.valueOf($p4); $casted = virtualinvoke boxed.toString(); $74_phi = $casted; label51: org.example.NativeSummaryFuncs.SetIntArrayRegion(null, null, null, $73_phi, $74_phi); $76_phi = null; if $opred != 52 goto label52; $76_phi = $13; goto label56; label52: if $opred != 53 goto label53; boxed = java.lang.Integer.valueOf($p2); $casted = virtualinvoke boxed.toString(); $76_phi = $casted; goto label56; label53: if $opred != 54 goto label54; boxed = java.lang.Integer.valueOf($p5); $casted = virtualinvoke boxed.toString(); $76_phi = $casted; goto label56; label54: if $opred != 55 goto label55; boxed = java.lang.Integer.valueOf($p3); $casted = virtualinvoke boxed.toString(); $76_phi = $casted; goto label56; label55: if $opred != 56 goto label56; boxed = java.lang.Integer.valueOf($p4); $casted = virtualinvoke boxed.toString(); $76_phi = $casted; label56: org.example.NativeSummaryFuncs.free($76_phi); $79_phi = null; if $opred != 57 goto label57; boxed = java.lang.Integer.valueOf($p2); $casted = virtualinvoke boxed.toString(); $79_phi = $casted; goto label59; label57: if $opred != 58 goto label58; boxed = java.lang.Integer.valueOf($p3); $casted = virtualinvoke boxed.toString(); $79_phi = $casted; goto label59; label58: if $opred != 59 goto label59; $79_phi = "NBridge: Returning data."; label59: android.util.Log.d("AndroSS", $79_phi); $83_phi = null; if $opred != 60 goto label60; $83_phi = "NBridge: What the hell am I getting pixels on?! Got type %d"; goto label61; label60: if $opred != 61 goto label61; boxed = java.lang.Integer.valueOf($p0); $casted = virtualinvoke boxed.toString(); $83_phi = $casted; label61: android.util.Log.e("AndroSS", $83_phi); return null; }
1 the last param is passed into array region nsfunc_sink
network.ubic.ubic_7.apk Sink: <network.ubic.ubic.Fragments.SendFragment: android.view.View onCreateView(android.view.LayoutInflater,android.view.ViewGroup,android.os.Bundle)> virtualinvoke $r23.<network.ubic.ubic.AsyncTasks.GetBalance: android.os.AsyncTask execute(java.lang.Object[])>($r26) Source: <network.ubic.ubic.AsyncTasks.GetBalance: java.lang.Void doInBackground(java.lang.Void[])> $z0 = virtualinvoke $r10.<org.json.JSONObject: boolean getBoolean(java.lang.String)>("is_receiving_ubi")
https://github.com/rgex/UBIC-android-wallet/blob/98e0643159bed18ec981962295c2f52dc86921f1/app/src/main/cpp/native-lib.cpp#L31 JNICALL Java_network_ubic_ubic_AsyncTasks_ReceiveFragmentPopulate_getAddress( JNIEnv *env, jobject /* this */, jbyteArray seed) { std::cout << "C++:" << std::endl; Wallet& wallet = Wallet::Instance(); int len = env->GetArrayLength (seed); std::cout << "Length:" << len << std::endl; unsigned char* seedUC = new unsigned char[len]; env->GetByteArrayRegion (seed, 0, len, reinterpret_cast<jbyte*>(seedUC)); std::vector<unsigned char> seedVector = std::vector<unsigned char>(seedUC, seedUC + 20); wallet.setSeed(seedVector); std::cout << "seedUC" << std::endl; wallet.initWallet(); std::cout << "initWallet" << std::endl; Address address = wallet.getRandomAddressFromWallet(); return env->NewStringUTF(wallet.readableAddressFromAddress(address).c_str()); }
virtualinvoke r0.<network.ubic.ubic.AsyncTasks.GetBalance: java.lang.String getAddress(byte[])>($r7)
<Source Statement="$z0 = virtualinvoke $r10.&lt;org.json.JSONObject: boolean getBoolean(java.lang.String)&gt;(&quot;is_receiving_ubi&quot;)" Method="&lt;network.ubic.ubic.AsyncTasks.GetBalance: java.lang.Void doInBackground(java.lang.Void[])&gt;"> <AccessPath Value="$z0" Type="boolean" TaintSubFields="true" /> <TaintPath> <PathElement Statement="$z0 = virtualinvoke $r10.&lt;org.json.JSONObject: boolean getBoolean(java.lang.String)&gt;(&quot;is_receiving_ubi&quot;)" Method="&lt;network.ubic.ubic.AsyncTasks.GetBalance: java.lang.Void doInBackground(java.lang.Void[])&gt;"> <AccessPath Value="$z0" Type="boolean" TaintSubFields="true" /> </PathElement> <PathElement Statement="r0.&lt;network.ubic.ubic.AsyncTasks.GetBalance: boolean isReceivingUBI&gt; = $z0" Method="&lt;network.ubic.ubic.AsyncTasks.GetBalance: java.lang.Void doInBackground(java.lang.Void[])&gt;"> <AccessPath Value="r0" Type="network.ubic.ubic.AsyncTasks.GetBalance" TaintSubFields="true"> <Fields> <Field Value="&lt;network.ubic.ubic.AsyncTasks.GetBalance: boolean isReceivingUBI&gt;" Type="boolean" /> </Fields> </AccessPath> </PathElement> <PathElement Statement="virtualinvoke r0.&lt;network.ubic.ubic.AsyncTasks.GetBalance: java.lang.String getAddress(byte[])&gt;($r7)" Method="&lt;network.ubic.ubic.AsyncTasks.GetBalance: java.lang.Void doInBackground(java.lang.Void[])&gt;"> <AccessPath Value="r0" Type="network.ubic.ubic.AsyncTasks.GetBalance" TaintSubFields="true"> <Fields> <Field Value="&lt;network.ubic.ubic.AsyncTasks.GetBalance: boolean isReceivingUBI&gt;" Type="boolean" /> </Fields> </AccessPath> </PathElement> <PathElement Statement="r0 := @this: network.ubic.ubic.AsyncTasks.GetBalance" Method="&lt;network.ubic.ubic.AsyncTasks.GetBalance: java.lang.String getAddress(byte[])&gt;"> <AccessPath Value="r0" Type="network.ubic.ubic.AsyncTasks.GetBalance" TaintSubFields="true"> <Fields> <Field Value="&lt;network.ubic.ubic.AsyncTasks.GetBalance: boolean isReceivingUBI&gt;" Type="boolean" /> </Fields> </AccessPath> </PathElement> <PathElement Statement="r0 := @this: network.ubic.ubic.AsyncTasks.GetBalance" Method="&lt;network.ubic.ubic.AsyncTasks.GetBalance: java.lang.Void doInBackground(java.lang.Void[])&gt;"> <AccessPath Value="r0" Type="network.ubic.ubic.AsyncTasks.GetBalance" TaintSubFields="true"> <Fields> <Field Value="&lt;network.ubic.ubic.AsyncTasks.GetBalance: boolean isReceivingUBI&gt;" Type="boolean" /> </Fields> </AccessPath> </PathElement> <PathElement Statement="r0 := @this: network.ubic.ubic.AsyncTasks.GetBalance" Method="&lt;network.ubic.ubic.AsyncTasks.GetBalance: java.lang.Object doInBackground(java.lang.Object[])&gt;"> <AccessPath Value="$r23" Type="network.ubic.ubic.AsyncTasks.GetBalance" TaintSubFields="true"> <Fields> <Field Value="&lt;network.ubic.ubic.AsyncTasks.GetBalance: boolean isReceivingUBI&gt;" Type="boolean" /> </Fields> </AccessPath> </PathElement> <PathElement Statement="specialinvoke $r23.&lt;network.ubic.ubic.AsyncTasks.GetBalance: void &lt;init&gt;(network.ubic.ubic.AsyncTasks.OnGetBalanceCompleted,byte[])&gt;(r0, $r25)" Method="&lt;network.ubic.ubic.Fragments.SendFragment: android.view.View onCreateView(android.view.LayoutInflater,android.view.ViewGroup,android.os.Bundle)&gt;"> <AccessPath Value="r0" Type="network.ubic.ubic.AsyncTasks.GetBalance" TaintSubFields="true"> <Fields> <Field Value="&lt;network.ubic.ubic.AsyncTasks.GetBalance: boolean isReceivingUBI&gt;" Type="boolean" /> </Fields> </AccessPath> </PathElement> <PathElement Statement="return" Method="&lt;network.ubic.ubic.AsyncTasks.GetBalance: void &lt;init&gt;(network.ubic.ubic.AsyncTasks.OnGetBalanceCompleted,byte[])&gt;"> <AccessPath Value="$r23" Type="network.ubic.ubic.AsyncTasks.GetBalance" TaintSubFields="true"> <Fields> <Field Value="&lt;network.ubic.ubic.AsyncTasks.GetBalance: boolean isReceivingUBI&gt;" Type="boolean" /> </Fields> </AccessPath> </PathElement> <PathElement Statement="virtualinvoke $r23.&lt;network.ubic.ubic.AsyncTasks.GetBalance: android.os.AsyncTask execute(java.lang.Object[])&gt;($r26)" Method="&lt;network.ubic.ubic.Fragments.SendFragment: android.view.View onCreateView(android.view.LayoutInflater,android.view.ViewGroup,android.os.Bundle)&gt;"> <AccessPath Value="$r23" Type="network.ubic.ubic.AsyncTasks.GetBalance" TaintSubFields="true"> <Fields> <Field Value="&lt;network.ubic.ubic.AsyncTasks.GetBalance: boolean isReceivingUBI&gt;" Type="boolean" /> </Fields> </AccessPath> </PathElement> </TaintPath> </Source>
the dataflow is not related to native code
public java.lang.String getAddress(byte[]) { network.ubic.ubic.AsyncTasks.ReceiveFragmentPopulate $this; byte[] $p0; int $4, $opred; java.lang.String $32_phi; $this := @this; $p0 := @parameter0; org.example.NativeSummaryFuncs.malloc(132L); org.example.NativeSummaryFuncs.malloc(132L); org.example.NativeSummaryFuncs.malloc(132L); org.example.NativeSummaryFuncs.__aeabi_memclr4(); $4 = org.example.NativeSummaryFuncs.GetArrayLength(null, null); org.example.NativeSummaryFuncs.malloc($4); org.example.NativeSummaryFuncs.malloc($4); org.example.NativeSummaryFuncs.malloc(132L); org.example.NativeSummaryFuncs.GetByteArrayRegion(null, $4, null, $4, null); org.example.NativeSummaryFuncs.free(null); org.example.NativeSummaryFuncs.free(null); org.example.NativeSummaryFuncs.free(null); org.example.NativeSummaryFuncs.malloc(null); org.example.NativeSummaryFuncs.malloc(null); org.example.NativeSummaryFuncs.malloc(null); org.example.NativeSummaryFuncs.malloc(null); org.example.NativeSummaryFuncs.malloc(1073741833L); org.example.NativeSummaryFuncs.malloc(1073741833L); org.example.NativeSummaryFuncs.malloc(1L); org.example.NativeSummaryFuncs.malloc(1L); org.example.NativeSummaryFuncs.malloc(null); org.example.NativeSummaryFuncs.malloc(null); org.example.NativeSummaryFuncs.free(null); org.example.NativeSummaryFuncs.free(null); org.example.NativeSummaryFuncs.free(null); org.example.NativeSummaryFuncs.free(null); org.example.NativeSummaryFuncs.free(null); org.example.NativeSummaryFuncs.free(null); $32_phi = null; $opred = org.example.NativeSummaryAux.opaqueInt(); if $opred != 1 goto label1; $32_phi = null; goto label2; label1: if $opred != 2 goto label2; $32_phi = "seedUC: %s"; label2: android.util.Log.d("foo", $32_phi); org.example.NativeSummaryFuncs.free(null); org.example.NativeSummaryFuncs.free(null); org.example.NativeSummaryFuncs.free(null); org.example.NativeSummaryFuncs.free(null); org.example.NativeSummaryFuncs.free(null); org.example.NativeSummaryFuncs.free(null); org.example.NativeSummaryFuncs.free(null); org.example.NativeSummaryFuncs.free(null); org.example.NativeSummaryFuncs.free(null); org.example.NativeSummaryFuncs.malloc(null); org.example.NativeSummaryFuncs.free(null); org.example.NativeSummaryFuncs.free(null); org.example.NativeSummaryFuncs.free(null); org.example.NativeSummaryFuncs.free(null); org.example.NativeSummaryFuncs.free(null); org.example.NativeSummaryFuncs.malloc(4294967292L); org.example.NativeSummaryFuncs.free(null); org.example.NativeSummaryFuncs.free(null); org.example.NativeSummaryFuncs.free(null); org.example.NativeSummaryFuncs.free(null); org.example.NativeSummaryFuncs.raise(8L); org.example.NativeSummaryFuncs.raise(8L); org.example.NativeSummaryFuncs.raise(8L); org.example.NativeSummaryFuncs.free(null); org.example.NativeSummaryFuncs.free(null); org.example.NativeSummaryFuncs.free(null); org.example.NativeSummaryFuncs.free(null); org.example.NativeSummaryFuncs.free(null); org.example.NativeSummaryFuncs.raise(8L); org.example.NativeSummaryFuncs.free(null); org.example.NativeSummaryFuncs.free(null); org.example.NativeSummaryFuncs.free(null); org.example.NativeSummaryFuncs.free(null); org.example.NativeSummaryFuncs.free(null); org.example.NativeSummaryFuncs.free(null); org.example.NativeSummaryFuncs.free(null); org.example.NativeSummaryFuncs.free(null); org.example.NativeSummaryFuncs.free(null); org.example.NativeSummaryFuncs.free(null); org.example.NativeSummaryFuncs.free(null); org.example.NativeSummaryFuncs.free(null); org.example.NativeSummaryFuncs.free(null); org.example.NativeSummaryFuncs.free(null); org.example.NativeSummaryFuncs.free(null); org.example.NativeSummaryFuncs.free(null); org.example.NativeSummaryFuncs.free(null); org.example.NativeSummaryFuncs.free(null); return null; }
1 the dataflow is not related to native code none
com.tnibler.cryptocam_17.apk Sink: <cryptocam_age_encryption.Cryptocam_age_encryption: cryptocam_age_encryption.EncryptedWriter createWriterWithX25519Recipients(long,java.lang.String)> staticinvoke <android.util.Log: int e(java.lang.String,java.lang.String)>("go/Seq", $r1) Source: <f.j.b: java.lang.Appendable d(java.lang.Iterable,java.lang.Appendable,java.lang.CharSequence,java.lang.CharSequence,java.lang.CharSequence,int,java.lang.CharSequence,f.n.b.l)> $r7 = interfaceinvoke $r5.<java.lang.Iterable: java.util.Iterator iterator()>()
https://gitlab.com/cryptocam/cryptocam/-/blob/master/age-encryption/encrypted_writer.go#L28 // recipients is a single string with all recipient public keys separated by newlines // because arrays aren't supported by gobind func CreateWriterWithX25519Recipients(fd int, recipients string) (*EncryptedWriter, error) { parsed, err := age.ParseRecipients(strings.NewReader(recipients)) if err != nil { return nil, err } file := os.NewFile(uintptr(fd), "asdasd") if file == nil { return nil, errors.New("Failed opening file descriptor.") } encrypted, err := age.Encrypt(file, parsed...) if err != nil { return nil, err } return &EncryptedWriter{ &encrypted, }, nil; }
$r22 = staticinvoke <cryptocam_age_encryption.Cryptocam_age_encryption: cryptocam_age_encryption.EncryptedWriter createWriterWithX25519Recipients(long,java.lang.String)>($l1, $r9)
<Source Statement="$r7 = interfaceinvoke $r5.&lt;java.lang.Iterable: java.util.Iterator iterator()&gt;()" Method="&lt;f.j.b: java.lang.Appendable d(java.lang.Iterable,java.lang.Appendable,java.lang.CharSequence,java.lang.CharSequence,java.lang.CharSequence,int,java.lang.CharSequence,f.n.b.l)&gt;"> <AccessPath Value="$r7" Type="java.util.Iterator" TaintSubFields="true" /> <TaintPath> <PathElement Statement="$r7 = interfaceinvoke $r5.&lt;java.lang.Iterable: java.util.Iterator iterator()&gt;()" Method="&lt;f.j.b: java.lang.Appendable d(java.lang.Iterable,java.lang.Appendable,java.lang.CharSequence,java.lang.CharSequence,java.lang.CharSequence,int,java.lang.CharSequence,f.n.b.l)&gt;"> <AccessPath Value="$r7" Type="java.util.Iterator" TaintSubFields="true" /> </PathElement> <PathElement Statement="$r8 = interfaceinvoke $r7.&lt;java.util.Iterator: java.lang.Object next()&gt;()" Method="&lt;f.j.b: java.lang.Appendable d(java.lang.Iterable,java.lang.Appendable,java.lang.CharSequence,java.lang.CharSequence,java.lang.CharSequence,int,java.lang.CharSequence,f.n.b.l)&gt;"> <AccessPath Value="$r8" Type="java.lang.Object" TaintSubFields="true" /> </PathElement> <PathElement Statement="$r10 = (java.lang.Character) $r8" Method="&lt;f.j.b: java.lang.Appendable d(java.lang.Iterable,java.lang.Appendable,java.lang.CharSequence,java.lang.CharSequence,java.lang.CharSequence,int,java.lang.CharSequence,f.n.b.l)&gt;"> <AccessPath Value="$r10" Type="java.lang.Character" TaintSubFields="true" /> </PathElement> <PathElement Statement="$c2 = virtualinvoke $r10.&lt;java.lang.Character: char charValue()&gt;()" Method="&lt;f.j.b: java.lang.Appendable d(java.lang.Iterable,java.lang.Appendable,java.lang.CharSequence,java.lang.CharSequence,java.lang.CharSequence,int,java.lang.CharSequence,f.n.b.l)&gt;"> <AccessPath Value="$c2" Type="char" TaintSubFields="true" /> </PathElement> <PathElement Statement="interfaceinvoke $r0.&lt;java.lang.Appendable: java.lang.Appendable append(char)&gt;($c2)" Method="&lt;f.j.b: java.lang.Appendable d(java.lang.Iterable,java.lang.Appendable,java.lang.CharSequence,java.lang.CharSequence,java.lang.CharSequence,int,java.lang.CharSequence,f.n.b.l)&gt;"> <AccessPath Value="$r0" Type="java.lang.Appendable" TaintSubFields="true" /> </PathElement> <PathElement Statement="return $r0" Method="&lt;f.j.b: java.lang.Appendable d(java.lang.Iterable,java.lang.Appendable,java.lang.CharSequence,java.lang.CharSequence,java.lang.CharSequence,int,java.lang.CharSequence,f.n.b.l)&gt;"> <AccessPath Value="$r9" Type="java.lang.StringBuilder" TaintSubFields="true" /> </PathElement> <PathElement Statement="$r3 = virtualinvoke $r9.&lt;java.lang.StringBuilder: java.lang.String toString()&gt;()" Method="&lt;f.j.b: java.lang.String e(java.lang.Iterable,java.lang.CharSequence,java.lang.CharSequence,java.lang.CharSequence,int,java.lang.CharSequence,f.n.b.l,int)&gt;"> <AccessPath Value="$r3" Type="java.lang.String" TaintSubFields="true" /> </PathElement> <PathElement Statement="return $r3" Method="&lt;f.j.b: java.lang.String e(java.lang.Iterable,java.lang.CharSequence,java.lang.CharSequence,java.lang.CharSequence,int,java.lang.CharSequence,f.n.b.l,int)&gt;"> <AccessPath Value="$r9" Type="java.lang.String" TaintSubFields="true" /> </PathElement> <PathElement Statement="$r22 = staticinvoke &lt;cryptocam_age_encryption.Cryptocam_age_encryption: cryptocam_age_encryption.EncryptedWriter createWriterWithX25519Recipients(long,java.lang.String)&gt;($l1, $r9)" Method="&lt;d.e.a.n.n: d.e.a.n.n$a a()&gt;"> <AccessPath Value="$r0" Type="java.lang.String" TaintSubFields="true" /> </PathElement> <PathElement Statement="$r1 = $r0" Method="&lt;cryptocam_age_encryption.Cryptocam_age_encryption: cryptocam_age_encryption.EncryptedWriter createWriterWithX25519Recipients(long,java.lang.String)&gt;"> <AccessPath Value="$r1" Type="java.lang.String" TaintSubFields="true" /> </PathElement> <PathElement Statement="staticinvoke &lt;android.util.Log: int e(java.lang.String,java.lang.String)&gt;(&quot;go/Seq&quot;, $r1)" Method="&lt;cryptocam_age_encryption.Cryptocam_age_encryption: cryptocam_age_encryption.EncryptedWriter createWriterWithX25519Recipients(long,java.lang.String)&gt;"> <AccessPath Value="$r1" Type="java.lang.String" TaintSubFields="true" /> </PathElement> </TaintPath> </Source>
param1 -> log
public static cryptocam_age_encryption.EncryptedWriter createWriterWithX25519Recipients(long, java.lang.String) { int $opred; long $p0; java.lang.String $p1, $4_phi; $p0 := @parameter0; $p1 := @parameter1; org.example.NativeSummaryFuncs.malloc(null); $4_phi = null; $opred = org.example.NativeSummaryAux.opaqueInt(); if $opred != 1 goto label1; $4_phi = "GetStringChars failed"; goto label4; label1: if $opred != 2 goto label2; $4_phi = "utf16Decode: malloc failed"; goto label4; label2: if $opred != 3 goto label3; $4_phi = "utf16Decode: buffer overflow"; goto label4; label3: if $opred != 4 goto label4; $4_phi = $p1; label4: android.util.Log.e("go/Seq", $4_phi); return null; }
1 param1 is logged by go runtime. log_sink
org.hanenoshino.onscripter_20120310.apk Sink: <org.hanenoshino.onscripter.ui.ONScripterActivity: void runSDLApp()> virtualinvoke $r5.<android.widget.Button: void setOnClickListener(android.view.View$OnClickListener)>($r13) Source: <org.hanenoshino.onscripter.ui.ONScripterActivity: void runSDLApp()> $i0 = virtualinvoke $r4.<android.view.Display: int getHeight()>()
https://github.com/kamikat/onscripter/blob/e118d50dacf149d9a2859a0a419334d04a1b3e33/ONScripter_sound.cpp#L57 JNIEXPORT jint JNICALL JAVA_EXPORT_NAME(ONScripter_nativeInitJavaCallbacks) (JNIEnv * jniEnv, jobject thiz) { JavaONScripter = jniEnv->NewGlobalRef(thiz); jclass JavaONScripterClass = jniEnv->GetObjectClass(JavaONScripter); JavaPlayVideo = jniEnv->GetMethodID(JavaONScripterClass, "playVideo", "([C)V"); }
specialinvoke r0.<org.hanenoshino.onscripter.core.ONScripter: int nativeInitJavaCallbacks()>()
<Source Statement="$i0 = virtualinvoke $r4.&lt;android.view.Display: int getHeight()&gt;()" Method="&lt;org.hanenoshino.onscripter.ui.ONScripterActivity: void runSDLApp()&gt;"> <AccessPath Value="$i0" Type="int" TaintSubFields="true" /> <TaintPath> <PathElement Statement="$i0 = virtualinvoke $r4.&lt;android.view.Display: int getHeight()&gt;()" Method="&lt;org.hanenoshino.onscripter.ui.ONScripterActivity: void runSDLApp()&gt;"> <AccessPath Value="$i0" Type="int" TaintSubFields="true" /> </PathElement> <PathElement Statement="$i2 = $i0 * $i2" Method="&lt;org.hanenoshino.onscripter.ui.ONScripterActivity: void runSDLApp()&gt;"> <AccessPath Value="$i2" Type="int" TaintSubFields="true" /> </PathElement> <PathElement Statement="$i1 = $i2 / $i1" Method="&lt;org.hanenoshino.onscripter.ui.ONScripterActivity: void runSDLApp()&gt;"> <AccessPath Value="$i1" Type="int" TaintSubFields="true" /> </PathElement> <PathElement Statement="$i1 = $i1 &amp; -2" Method="&lt;org.hanenoshino.onscripter.ui.ONScripterActivity: void runSDLApp()&gt;"> <AccessPath Value="$i1" Type="int" TaintSubFields="true" /> </PathElement> <PathElement Statement="r0.&lt;org.hanenoshino.onscripter.ui.ONScripterActivity: int screen_w&gt; = $i1" Method="&lt;org.hanenoshino.onscripter.ui.ONScripterActivity: void runSDLApp()&gt;"> <AccessPath Value="r0" Type="org.hanenoshino.onscripter.ui.ONScripterActivity" TaintSubFields="true"> <Fields> <Field Value="&lt;org.hanenoshino.onscripter.ui.ONScripterActivity: int screen_w&gt;" Type="int" /> </Fields> </AccessPath> </PathElement> <PathElement Statement="$i1 = r0.&lt;org.hanenoshino.onscripter.ui.ONScripterActivity: int screen_w&gt;" Method="&lt;org.hanenoshino.onscripter.ui.ONScripterActivity: void runSDLApp()&gt;"> <AccessPath Value="$i1" Type="int" TaintSubFields="true" /> </PathElement> <PathElement Statement="$i3 = $i3 - $i1" Method="&lt;org.hanenoshino.onscripter.ui.ONScripterActivity: void runSDLApp()&gt;"> <AccessPath Value="$i3" Type="int" TaintSubFields="true" /> </PathElement> <PathElement Statement="r0.&lt;org.hanenoshino.onscripter.ui.ONScripterActivity: int button_w&gt; = $i3" Method="&lt;org.hanenoshino.onscripter.ui.ONScripterActivity: void runSDLApp()&gt;"> <AccessPath Value="r0" Type="org.hanenoshino.onscripter.ui.ONScripterActivity" TaintSubFields="true"> <Fields> <Field Value="&lt;org.hanenoshino.onscripter.ui.ONScripterActivity: int button_w&gt;" Type="int" /> </Fields> </AccessPath> </PathElement> <PathElement Statement="r0 := @this: org.hanenoshino.onscripter.ui.ONScripterActivity" Method="&lt;org.hanenoshino.onscripter.ui.ONScripterActivity: void runSDLApp()&gt;"> <AccessPath Value="r0" Type="org.hanenoshino.onscripter.ui.ONScripterActivity" TaintSubFields="true"> <Fields> <Field Value="&lt;org.hanenoshino.onscripter.ui.ONScripterActivity: int button_w&gt;" Type="int" /> </Fields> </AccessPath> </PathElement> <PathElement Statement="specialinvoke $r7.&lt;org.hanenoshino.onscripter.ui.ONScripterView: void &lt;init&gt;(android.app.Activity,java.lang.String,boolean)&gt;(r0, $r6, 1)" Method="&lt;org.hanenoshino.onscripter.ui.ONScripterActivity: void onCreate(android.os.Bundle)&gt;"> <AccessPath Value="$r1" Type="org.hanenoshino.onscripter.ui.ONScripterActivity" TaintSubFields="true"> <Fields> <Field Value="&lt;org.hanenoshino.onscripter.ui.ONScripterActivity: int button_w&gt;" Type="int" /> </Fields> </AccessPath> </PathElement> <PathElement Statement="specialinvoke r0.&lt;org.hanenoshino.onscripter.core.ONScripter: void &lt;init&gt;(android.app.Activity,java.lang.String,boolean)&gt;($r1, $r2, 1)" Method="&lt;org.hanenoshino.onscripter.ui.ONScripterView: void &lt;init&gt;(android.app.Activity,java.lang.String,boolean)&gt;"> <AccessPath Value="$r1" Type="org.hanenoshino.onscripter.ui.ONScripterActivity" TaintSubFields="true"> <Fields> <Field Value="&lt;org.hanenoshino.onscripter.ui.ONScripterActivity: int button_w&gt;" Type="int" /> </Fields> </AccessPath> </PathElement> <PathElement Statement="specialinvoke r0.&lt;org.hanenoshino.onscripter.core.DemoGLSurfaceView: void &lt;init&gt;(android.content.Context,java.lang.String,boolean)&gt;($r1, $r2, 1)" Method="&lt;org.hanenoshino.onscripter.core.ONScripter: void &lt;init&gt;(android.app.Activity,java.lang.String,boolean)&gt;"> <AccessPath Value="$r1" Type="org.hanenoshino.onscripter.ui.ONScripterActivity" TaintSubFields="true"> <Fields> <Field Value="&lt;org.hanenoshino.onscripter.ui.ONScripterActivity: int button_w&gt;" Type="int" /> </Fields> </AccessPath> </PathElement> <PathElement Statement="specialinvoke $r4.&lt;org.hanenoshino.onscripter.core.DemoRenderer: void &lt;init&gt;(android.content.Context,java.lang.String,boolean)&gt;($r1, $r2, 1)" Method="&lt;org.hanenoshino.onscripter.core.DemoGLSurfaceView: void &lt;init&gt;(android.content.Context,java.lang.String,boolean)&gt;"> <AccessPath Value="$r1" Type="org.hanenoshino.onscripter.ui.ONScripterActivity" TaintSubFields="true"> <Fields> <Field Value="&lt;org.hanenoshino.onscripter.ui.ONScripterActivity: int button_w&gt;" Type="int" /> </Fields> </AccessPath> </PathElement> <PathElement Statement="return" Method="&lt;org.hanenoshino.onscripter.core.DemoRenderer: void &lt;init&gt;(android.content.Context,java.lang.String,boolean)&gt;"> <AccessPath Value="$r1" Type="org.hanenoshino.onscripter.ui.ONScripterActivity" TaintSubFields="true"> <Fields> <Field Value="&lt;org.hanenoshino.onscripter.ui.ONScripterActivity: int button_w&gt;" Type="int" /> </Fields> </AccessPath> </PathElement> <PathElement Statement="return" Method="&lt;org.hanenoshino.onscripter.core.DemoGLSurfaceView: void &lt;init&gt;(android.content.Context,java.lang.String,boolean)&gt;"> <AccessPath Value="$r1" Type="org.hanenoshino.onscripter.ui.ONScripterActivity" TaintSubFields="true"> <Fields> <Field Value="&lt;org.hanenoshino.onscripter.ui.ONScripterActivity: int button_w&gt;" Type="int" /> </Fields> </AccessPath> </PathElement> <PathElement Statement="r0.&lt;org.hanenoshino.onscripter.core.ONScripter: android.app.Activity parent&gt; = $r1" Method="&lt;org.hanenoshino.onscripter.core.ONScripter: void &lt;init&gt;(android.app.Activity,java.lang.String,boolean)&gt;"> <AccessPath Value="r0" Type="org.hanenoshino.onscripter.core.ONScripter" TaintSubFields="true"> <Fields> <Field Value="&lt;org.hanenoshino.onscripter.core.ONScripter: android.app.Activity parent&gt;" Type="org.hanenoshino.onscripter.ui.ONScripterActivity" /> <Field Value="&lt;org.hanenoshino.onscripter.ui.ONScripterActivity: int button_w&gt;" Type="int" /> </Fields> </AccessPath> </PathElement> <PathElement Statement="specialinvoke r0.&lt;org.hanenoshino.onscripter.core.ONScripter: int nativeInitJavaCallbacks()&gt;()" Method="&lt;org.hanenoshino.onscripter.core.ONScripter: void &lt;init&gt;(android.app.Activity,java.lang.String,boolean)&gt;"> <AccessPath Value="r0" Type="org.hanenoshino.onscripter.core.ONScripter" TaintSubFields="true"> <Fields> <Field Value="&lt;org.hanenoshino.onscripter.core.ONScripter: android.app.Activity parent&gt;" Type="org.hanenoshino.onscripter.ui.ONScripterActivity" /> <Field Value="&lt;org.hanenoshino.onscripter.ui.ONScripterActivity: int button_w&gt;" Type="int" /> </Fields> </AccessPath> </PathElement> <PathElement Statement="return 0" Method="&lt;org.hanenoshino.onscripter.core.ONScripter: int nativeInitJavaCallbacks()&gt;"> <AccessPath Value="r0" Type="org.hanenoshino.onscripter.core.ONScripter" TaintSubFields="true"> <Fields> <Field Value="&lt;org.hanenoshino.onscripter.core.ONScripter: android.app.Activity parent&gt;" Type="org.hanenoshino.onscripter.ui.ONScripterActivity" /> <Field Value="&lt;org.hanenoshino.onscripter.ui.ONScripterActivity: int button_w&gt;" Type="int" /> </Fields> </AccessPath> </PathElement> <PathElement Statement="return" Method="&lt;org.hanenoshino.onscripter.core.ONScripter: void &lt;init&gt;(android.app.Activity,java.lang.String,boolean)&gt;"> <AccessPath Value="r0" Type="org.hanenoshino.onscripter.ui.ONScripterView" TaintSubFields="true"> <Fields> <Field Value="&lt;org.hanenoshino.onscripter.core.ONScripter: android.app.Activity parent&gt;" Type="org.hanenoshino.onscripter.ui.ONScripterActivity" /> <Field Value="&lt;org.hanenoshino.onscripter.ui.ONScripterActivity: int button_w&gt;" Type="int" /> </Fields> </AccessPath> </PathElement> <PathElement Statement="return" Method="&lt;org.hanenoshino.onscripter.ui.ONScripterView: void &lt;init&gt;(android.app.Activity,java.lang.String,boolean)&gt;"> <AccessPath Value="$r7" Type="org.hanenoshino.onscripter.ui.ONScripterView" TaintSubFields="true"> <Fields> <Field Value="&lt;org.hanenoshino.onscripter.core.ONScripter: android.app.Activity parent&gt;" Type="org.hanenoshino.onscripter.ui.ONScripterActivity" /> <Field Value="&lt;org.hanenoshino.onscripter.ui.ONScripterActivity: int button_w&gt;" Type="int" /> </Fields> </AccessPath> </PathElement> <PathElement Statement="r0.&lt;org.hanenoshino.onscripter.ui.ONScripterActivity: org.hanenoshino.onscripter.ui.ONScripterView mGLView&gt; = $r7" Method="&lt;org.hanenoshino.onscripter.ui.ONScripterActivity: void onCreate(android.os.Bundle)&gt;"> <AccessPath Value="r0" Type="org.hanenoshino.onscripter.ui.ONScripterActivity" TaintSubFields="true"> <Fields> <Field Value="&lt;org.hanenoshino.onscripter.ui.ONScripterActivity: int button_w&gt;" Type="int" /> </Fields> </AccessPath> </PathElement> <PathElement Statement="specialinvoke r0.&lt;org.hanenoshino.onscripter.ui.ONScripterActivity: void runSDLApp()&gt;()" Method="&lt;org.hanenoshino.onscripter.ui.ONScripterActivity: void onCreate(android.os.Bundle)&gt;"> <AccessPath Value="r0" Type="org.hanenoshino.onscripter.ui.ONScripterActivity" TaintSubFields="true"> <Fields> <Field Value="&lt;org.hanenoshino.onscripter.ui.ONScripterActivity: int button_w&gt;" Type="int" /> </Fields> </AccessPath> </PathElement> <PathElement Statement="specialinvoke $r11.&lt;org.hanenoshino.onscripter.ui.ONScripterActivity$1: void &lt;init&gt;(org.hanenoshino.onscripter.ui.ONScripterActivity)&gt;(r0)" Method="&lt;org.hanenoshino.onscripter.ui.ONScripterActivity: void runSDLApp()&gt;"> <AccessPath Value="$r1" Type="org.hanenoshino.onscripter.ui.ONScripterActivity" TaintSubFields="true"> <Fields> <Field Value="&lt;org.hanenoshino.onscripter.ui.ONScripterActivity: int button_w&gt;" Type="int" /> </Fields> </AccessPath> </PathElement> <PathElement Statement="return" Method="&lt;org.hanenoshino.onscripter.ui.ONScripterActivity$1: void &lt;init&gt;(org.hanenoshino.onscripter.ui.ONScripterActivity)&gt;"> <AccessPath Value="r0" Type="org.hanenoshino.onscripter.ui.ONScripterActivity" TaintSubFields="true"> <Fields> <Field Value="&lt;org.hanenoshino.onscripter.ui.ONScripterActivity: int button_w&gt;" Type="int" /> </Fields> </AccessPath> </PathElement> <PathElement Statement="specialinvoke $r12.&lt;org.hanenoshino.onscripter.ui.ONScripterActivity$2: void &lt;init&gt;(org.hanenoshino.onscripter.ui.ONScripterActivity)&gt;(r0)" Method="&lt;org.hanenoshino.onscripter.ui.ONScripterActivity: void runSDLApp()&gt;"> <AccessPath Value="$r1" Type="org.hanenoshino.onscripter.ui.ONScripterActivity" TaintSubFields="true"> <Fields> <Field Value="&lt;org.hanenoshino.onscripter.ui.ONScripterActivity: int button_w&gt;" Type="int" /> </Fields> </AccessPath> </PathElement> <PathElement Statement="return" Method="&lt;org.hanenoshino.onscripter.ui.ONScripterActivity$2: void &lt;init&gt;(org.hanenoshino.onscripter.ui.ONScripterActivity)&gt;"> <AccessPath Value="r0" Type="org.hanenoshino.onscripter.ui.ONScripterActivity" TaintSubFields="true"> <Fields> <Field Value="&lt;org.hanenoshino.onscripter.ui.ONScripterActivity: int button_w&gt;" Type="int" /> </Fields> </AccessPath> </PathElement> <PathElement Statement="specialinvoke $r13.&lt;org.hanenoshino.onscripter.ui.ONScripterActivity$3: void &lt;init&gt;(org.hanenoshino.onscripter.ui.ONScripterActivity)&gt;(r0)" Method="&lt;org.hanenoshino.onscripter.ui.ONScripterActivity: void runSDLApp()&gt;"> <AccessPath Value="$r1" Type="org.hanenoshino.onscripter.ui.ONScripterActivity" TaintSubFields="true"> <Fields> <Field Value="&lt;org.hanenoshino.onscripter.ui.ONScripterActivity: int button_w&gt;" Type="int" /> </Fields> </AccessPath> </PathElement> <PathElement Statement="r0.&lt;org.hanenoshino.onscripter.ui.ONScripterActivity$3: org.hanenoshino.onscripter.ui.ONScripterActivity this$0&gt; = $r1" Method="&lt;org.hanenoshino.onscripter.ui.ONScripterActivity$3: void &lt;init&gt;(org.hanenoshino.onscripter.ui.ONScripterActivity)&gt;"> <AccessPath Value="r0" Type="org.hanenoshino.onscripter.ui.ONScripterActivity$3" TaintSubFields="true"> <Fields> <Field Value="&lt;org.hanenoshino.onscripter.ui.ONScripterActivity$3: org.hanenoshino.onscripter.ui.ONScripterActivity this$0&gt;" Type="org.hanenoshino.onscripter.ui.ONScripterActivity" /> <Field Value="&lt;org.hanenoshino.onscripter.ui.ONScripterActivity: int button_w&gt;" Type="int" /> </Fields> </AccessPath> </PathElement> <PathElement Statement="return" Method="&lt;org.hanenoshino.onscripter.ui.ONScripterActivity$3: void &lt;init&gt;(org.hanenoshino.onscripter.ui.ONScripterActivity)&gt;"> <AccessPath Value="$r13" Type="org.hanenoshino.onscripter.ui.ONScripterActivity$3" TaintSubFields="true"> <Fields> <Field Value="&lt;org.hanenoshino.onscripter.ui.ONScripterActivity$3: org.hanenoshino.onscripter.ui.ONScripterActivity this$0&gt;" Type="org.hanenoshino.onscripter.ui.ONScripterActivity" /> <Field Value="&lt;org.hanenoshino.onscripter.ui.ONScripterActivity: int button_w&gt;" Type="int" /> </Fields> </AccessPath> </PathElement> <PathElement Statement="virtualinvoke $r5.&lt;android.widget.Button: void setOnClickListener(android.view.View$OnClickListener)&gt;($r13)" Method="&lt;org.hanenoshino.onscripter.ui.ONScripterActivity: void runSDLApp()&gt;"> <AccessPath Value="$r13" Type="org.hanenoshino.onscripter.ui.ONScripterActivity$3" TaintSubFields="true"> <Fields> <Field Value="&lt;org.hanenoshino.onscripter.ui.ONScripterActivity$3: org.hanenoshino.onscripter.ui.ONScripterActivity this$0&gt;" Type="org.hanenoshino.onscripter.ui.ONScripterActivity" /> <Field Value="&lt;org.hanenoshino.onscripter.ui.ONScripterActivity: int button_w&gt;" Type="int" /> </Fields> </AccessPath> </PathElement> </TaintPath> </Source>
not related to native code
private void nativeInitJavaCallbacks() { org.hanenoshino.onscripter.core.DemoRenderer $this; $this := @this; return; }
1 not related to native code none
eu.faircode.netguard_2022111001.apk Sink: <eu.faircode.netguard.ServiceSinkhole: void jni_pcap(java.lang.String,int,int)> staticinvoke <org.example.NativeSummaryFuncs: int fopen(java.lang.String,java.lang.String)>($r0, "ab+") Source: <eu.faircode.netguard.ServiceSinkhole: void setPcap(boolean,android.content.Context)> $r2 = virtualinvoke $r8.<java.io.File: java.lang.String getAbsolutePath()>()
https://github.com/M66B/NetGuard/blob/1f56b996f54d5fa515e3f193a49da1d1b4df871a/app/src/main/jni/netguard/netguard.c#L250 JNIEXPORT void JNICALL Java_eu_faircode_netguard_ServiceSinkhole_jni_1pcap( JNIEnv *env, jclass type, jstring name_, jint record_size, jint file_size) { pcap_record_size = (size_t) record_size; pcap_file_size = file_size; //if (pthread_mutex_lock(&lock)) // log_android(ANDROID_LOG_ERROR, "pthread_mutex_lock failed"); if (name_ == NULL) { if (pcap_file != NULL) { int flags = fcntl(fileno(pcap_file), F_GETFL, 0); if (flags < 0 || fcntl(fileno(pcap_file), F_SETFL, flags & ~O_NONBLOCK) < 0) log_android(ANDROID_LOG_ERROR, "PCAP fcntl ~O_NONBLOCK error %d: %s", errno, strerror(errno)); if (fsync(fileno(pcap_file))) log_android(ANDROID_LOG_ERROR, "PCAP fsync error %d: %s", errno, strerror(errno)); if (fclose(pcap_file)) log_android(ANDROID_LOG_ERROR, "PCAP fclose error %d: %s", errno, strerror(errno)); pcap_file = NULL; } log_android(ANDROID_LOG_WARN, "PCAP disabled"); } else { const char *name = (*env)->GetStringUTFChars(env, name_, 0); ng_add_alloc(name, "name"); log_android(ANDROID_LOG_WARN, "PCAP file %s record size %d truncate @%ld", name, pcap_record_size, pcap_file_size); pcap_file = fopen(name, "ab+"); if (pcap_file == NULL) log_android(ANDROID_LOG_ERROR, "PCAP fopen error %d: %s", errno, strerror(errno)); else { int flags = fcntl(fileno(pcap_file), F_GETFL, 0); if (flags < 0 || fcntl(fileno(pcap_file), F_SETFL, flags | O_NONBLOCK) < 0) log_android(ANDROID_LOG_ERROR, "PCAP fcntl O_NONBLOCK error %d: %s", errno, strerror(errno)); long size = ftell(pcap_file); if (size == 0) { log_android(ANDROID_LOG_WARN, "PCAP initialize"); write_pcap_hdr(); } else log_android(ANDROID_LOG_WARN, "PCAP current size %ld", size); } (*env)->ReleaseStringUTFChars(env, name_, name); ng_delete_alloc(name, __FILE__, __LINE__); } //if (pthread_mutex_unlock(&lock)) // log_android(ANDROID_LOG_ERROR, "pthread_mutex_unlock failed"); }
staticinvoke <eu.faircode.netguard.ServiceSinkhole: void jni_pcap(java.lang.String,int,int)>($r2, $i0, $i1) staticinvoke <org.example.NativeSummaryFuncs: int fopen(java.lang.String,java.lang.String)>($r0, "ab+")
<Source Statement="$r2 = virtualinvoke $r8.&lt;java.io.File: java.lang.String getAbsolutePath()&gt;()" Method="&lt;eu.faircode.netguard.ServiceSinkhole: void setPcap(boolean,android.content.Context)&gt;"> <AccessPath Value="$r2" Type="java.lang.String" TaintSubFields="true" /> <TaintPath> <PathElement Statement="$r2 = virtualinvoke $r8.&lt;java.io.File: java.lang.String getAbsolutePath()&gt;()" Method="&lt;eu.faircode.netguard.ServiceSinkhole: void setPcap(boolean,android.content.Context)&gt;"> <AccessPath Value="$r2" Type="java.lang.String" TaintSubFields="true" /> </PathElement> <PathElement Statement="staticinvoke &lt;eu.faircode.netguard.ServiceSinkhole: void jni_pcap(java.lang.String,int,int)&gt;($r2, $i0, $i1)" Method="&lt;eu.faircode.netguard.ServiceSinkhole: void setPcap(boolean,android.content.Context)&gt;"> <AccessPath Value="$r0" Type="java.lang.String" TaintSubFields="true" /> </PathElement> <PathElement Statement="staticinvoke &lt;org.example.NativeSummaryFuncs: int fopen(java.lang.String,java.lang.String)&gt;($r0, &quot;ab+&quot;)" Method="&lt;eu.faircode.netguard.ServiceSinkhole: void jni_pcap(java.lang.String,int,int)&gt;"> <AccessPath Value="$r0" Type="java.lang.String" TaintSubFields="true" /> </PathElement> </TaintPath> </Source>
param0 -> fopen
private static void jni_pcap(java.lang.String, int, int) { int $p1, $p2, $opred; java.lang.String $p0, $0_phi, $4_phi, $9_phi, $13_phi, $18_phi, $24_phi, $28_phi, $32_phi, $36_phi, $40_phi, $44_phi, $48_phi; $p0 := @parameter0; $p1 := @parameter1; $p2 := @parameter2; $0_phi = null; $opred = org.example.NativeSummaryAux.opaqueInt(); if $opred != 1 goto label01; $0_phi = null; goto label02; label01: if $opred != 2 goto label02; $0_phi = "%s"; label02: android.util.Log.e("NetGuard.JNI", $0_phi); $4_phi = null; if $opred != 3 goto label03; $4_phi = null; goto label04; label03: if $opred != 4 goto label04; $4_phi = "%s"; label04: android.util.Log.e("NetGuard.JNI", $4_phi); org.example.NativeSummaryFuncs.fclose(null); $9_phi = null; if $opred != 5 goto label05; $9_phi = null; goto label06; label05: if $opred != 6 goto label06; $9_phi = "%s"; label06: android.util.Log.e("NetGuard.JNI", $9_phi); $13_phi = null; if $opred != 7 goto label07; $13_phi = null; goto label08; label07: if $opred != 8 goto label08; $13_phi = "%s"; label08: android.util.Log.w("NetGuard.JNI", $13_phi); $18_phi = null; if $opred != 9 goto label09; $18_phi = null; goto label10; label09: if $opred != 10 goto label10; $18_phi = "%s"; label10: android.util.Log.w("NetGuard.JNI", $18_phi); org.example.NativeSummaryFuncs.fopen($p0, "ab+"); $24_phi = null; if $opred != 11 goto label11; $24_phi = null; goto label12; label11: if $opred != 12 goto label12; $24_phi = "%s"; label12: android.util.Log.e("NetGuard.JNI", $24_phi); $28_phi = null; if $opred != 13 goto label13; $28_phi = null; goto label14; label13: if $opred != 14 goto label14; $28_phi = "%s"; label14: android.util.Log.w("NetGuard.JNI", $28_phi); $32_phi = null; if $opred != 15 goto label15; $32_phi = null; goto label16; label15: if $opred != 16 goto label16; $32_phi = "%s"; label16: android.util.Log.d("NetGuard.JNI", $32_phi); $36_phi = null; if $opred != 17 goto label17; $36_phi = null; goto label18; label17: if $opred != 18 goto label18; $36_phi = "%s"; label18: android.util.Log.w("NetGuard.JNI", $36_phi); $40_phi = null; if $opred != 19 goto label19; $40_phi = null; goto label20; label19: if $opred != 20 goto label20; $40_phi = "%s"; label20: android.util.Log.e("NetGuard.JNI", $40_phi); $44_phi = null; if $opred != 21 goto label21; $44_phi = null; goto label22; label21: if $opred != 22 goto label22; $44_phi = "%s"; label22: android.util.Log.w("NetGuard.JNI", $44_phi); $48_phi = null; if $opred != 23 goto label23; $48_phi = null; goto label24; label23: if $opred != 24 goto label24; $48_phi = "%s"; label24: android.util.Log.e("NetGuard.JNI", $48_phi); return; }
1 param0 path is opened in native nsfunc_sink fopen
com.renard.ocr_82.apk Sink: <com.googlecode.leptonica.android.WriteFile: boolean nativeWriteImpliedFormat(long,java.lang.String,int,boolean)> staticinvoke <android.util.Log: int e(java.lang.String,java.lang.String)>("Leptonica(native)", $r1) Source: <com.googlecode.leptonica.android.WriteFile: boolean writeImpliedFormat(com.googlecode.leptonica.android.Pix,java.io.File,int,boolean)> $r2 = virtualinvoke $r1.<java.io.File: java.lang.String getAbsolutePath()>()
https://github.com/rmtheis/tess-two/blob/ab4cab1bd9794aacb74162aff339daa921a68c3f/tess-two/jni/com_googlecode_leptonica_android/writefile.cpp#L51 jboolean Java_com_googlecode_leptonica_android_WriteFile_nativeWriteImpliedFormat(JNIEnv *env, jclass clazz, jlong nativePix, jstring fileName) { PIX *pixs = (PIX *) nativePix; const char *c_fileName = env->GetStringUTFChars(fileName, NULL); if (c_fileName == NULL) { LOGE("could not extract fileName string!"); return JNI_FALSE; } jboolean result = JNI_TRUE; if (pixWriteImpliedFormat(c_fileName, pixs, 85, JNI_FALSE)) { LOGE("could not write pix data to %s", c_fileName); result = JNI_FALSE; } env->ReleaseStringUTFChars(fileName, c_fileName); return result; }
$z0 = staticinvoke <com.googlecode.leptonica.android.WriteFile: boolean nativeWriteImpliedFormat(long,java.lang.String,int,boolean)>($l1, $r2, 85, 1)
<Source Statement="$r2 = virtualinvoke $r1.&lt;java.io.File: java.lang.String getAbsolutePath()&gt;()" Method="&lt;com.googlecode.leptonica.android.WriteFile: boolean writeImpliedFormat(com.googlecode.leptonica.android.Pix,java.io.File,int,boolean)&gt;"> <AccessPath Value="$r2" Type="java.lang.String" TaintSubFields="true" /> <TaintPath> <PathElement Statement="$r2 = virtualinvoke $r1.&lt;java.io.File: java.lang.String getAbsolutePath()&gt;()" Method="&lt;com.googlecode.leptonica.android.WriteFile: boolean writeImpliedFormat(com.googlecode.leptonica.android.Pix,java.io.File,int,boolean)&gt;"> <AccessPath Value="$r2" Type="java.lang.String" TaintSubFields="true" /> </PathElement> <PathElement Statement="$z0 = staticinvoke &lt;com.googlecode.leptonica.android.WriteFile: boolean nativeWriteImpliedFormat(long,java.lang.String,int,boolean)&gt;($l1, $r2, 85, 1)" Method="&lt;com.googlecode.leptonica.android.WriteFile: boolean writeImpliedFormat(com.googlecode.leptonica.android.Pix,java.io.File,int,boolean)&gt;"> <AccessPath Value="$r0" Type="java.lang.String" TaintSubFields="true" /> </PathElement> <PathElement Statement="$r1 = $r0" Method="&lt;com.googlecode.leptonica.android.WriteFile: boolean nativeWriteImpliedFormat(long,java.lang.String,int,boolean)&gt;"> <AccessPath Value="$r1" Type="java.lang.String" TaintSubFields="true" /> </PathElement> <PathElement Statement="staticinvoke &lt;android.util.Log: int e(java.lang.String,java.lang.String)&gt;(&quot;Leptonica(native)&quot;, $r1)" Method="&lt;com.googlecode.leptonica.android.WriteFile: boolean nativeWriteImpliedFormat(long,java.lang.String,int,boolean)&gt;"> <AccessPath Value="$r1" Type="java.lang.String" TaintSubFields="true" /> </PathElement> </TaintPath> </Source>
param1 -> log
private static boolean nativeWriteImpliedFormat(long, java.lang.String, int, boolean) { long $p0; int $p2, $opred; java.lang.String $p1, $2_phi, $8_phi; boolean $p3, $12_phi; $p0 := @parameter0; $p1 := @parameter1; $p2 := @parameter2; $p3 := @parameter3; $2_phi = null; $opred = org.example.NativeSummaryAux.opaqueInt(); if $opred != 1 goto label1; $2_phi = "could not write pix data to %s"; goto label2; label1: if $opred != 2 goto label2; $2_phi = $p1; label2: android.util.Log.e("Leptonica(native)", $2_phi); $8_phi = null; if $opred != 3 goto label3; $8_phi = "could not extract fileName string!"; goto label4; label3: if $opred != 4 goto label4; $8_phi = $p1; label4: android.util.Log.e("Leptonica(native)", $8_phi); $12_phi = 0; if $opred != 5 goto label5; $12_phi = 1L; goto label6; label5: if $opred != 6 goto label6; $12_phi = null; label6: return $12_phi; }
1 param1 filename is logged log_sink
se.traffar.dot_race_4.apk Sink: <org.libsdl.app.SDLActivity: void onNativeTouch(int,int,int,float,float,float)> staticinvoke <org.example.NativeSummaryFuncs: int realloc(int,java.lang.Object)>($i4, null) Source: <org.libsdl.app.SDLSurface: boolean onTouch(android.view.View,android.view.MotionEvent)> $i2 = virtualinvoke $r2.<android.view.MotionEvent: int getActionMasked()>()
https://github.com/libsdl-org/SDL/blob/764fe7244928c4220a8dd94e38144646a61503f9/src/core/android/SDL_android.c#L1230 /* Touch */ JNIEXPORT void JNICALL SDL_JAVA_INTERFACE(onNativeTouch)( JNIEnv *env, jclass jcls, jint touch_device_id_in, jint pointer_finger_id_in, jint action, jfloat x, jfloat y, jfloat p) { SDL_LockMutex(Android_ActivityMutex); Android_OnTouch(Android_Window, touch_device_id_in, pointer_finger_id_in, action, x, y, p); SDL_UnlockMutex(Android_ActivityMutex); }
staticinvoke <org.libsdl.app.SDLActivity: void onNativeTouch(int,int,int,float,float,float)>($i0, $i1, $i2, $f0, $f1, $f2) staticinvoke <org.example.NativeSummaryFuncs: int realloc(int,java.lang.Object)>($i4, null)
<Source Statement="$i2 = virtualinvoke $r2.&lt;android.view.MotionEvent: int getActionMasked()&gt;()" Method="&lt;org.libsdl.app.SDLSurface: boolean onTouch(android.view.View,android.view.MotionEvent)&gt;"> <AccessPath Value="$i2" Type="int" TaintSubFields="true" /> <TaintPath> <PathElement Statement="$i2 = virtualinvoke $r2.&lt;android.view.MotionEvent: int getActionMasked()&gt;()" Method="&lt;org.libsdl.app.SDLSurface: boolean onTouch(android.view.View,android.view.MotionEvent)&gt;"> <AccessPath Value="$i2" Type="int" TaintSubFields="true" /> </PathElement> <PathElement Statement="staticinvoke &lt;org.libsdl.app.SDLActivity: void onNativeTouch(int,int,int,float,float,float)&gt;($i0, $i1, $i2, $f0, $f1, $f2)" Method="&lt;org.libsdl.app.SDLSurface: boolean onTouch(android.view.View,android.view.MotionEvent)&gt;"> <AccessPath Value="$i2" Type="int" TaintSubFields="true" /> </PathElement> <PathElement Statement="$i4 = $i2" Method="&lt;org.libsdl.app.SDLActivity: void onNativeTouch(int,int,int,float,float,float)&gt;"> <AccessPath Value="$i4" Type="int" TaintSubFields="true" /> </PathElement> <PathElement Statement="staticinvoke &lt;org.example.NativeSummaryFuncs: int realloc(int,java.lang.Object)&gt;($i4, null)" Method="&lt;org.libsdl.app.SDLActivity: void onNativeTouch(int,int,int,float,float,float)&gt;"> <AccessPath Value="$i4" Type="int" TaintSubFields="true" /> </PathElement> </TaintPath> </Source>
the param2 is passed to realloc
public static void onNativeTouch(int, int, int, float, float, float) { int $p0, $p1, $p2, $2_phi, $opred, $7_phi; float $p3, $p4, $p5; java.lang.String $10_phi; $p0 := @parameter0; $p1 := @parameter1; $p2 := @parameter2; $p3 := @parameter3; $p4 := @parameter4; $p5 := @parameter5; org.example.NativeSummaryFuncs.malloc(24L); org.example.NativeSummaryFuncs.raise(8L); $2_phi = 0; $opred = org.example.NativeSummaryAux.opaqueInt(); if $opred != 1 goto label1; $2_phi = $p1; goto label3; label1: if $opred != 2 goto label2; $2_phi = $p0; goto label3; label2: if $opred != 3 goto label3; $2_phi = $p2; label3: org.example.NativeSummaryFuncs.realloc($2_phi, null); org.example.NativeSummaryFuncs.free(null); org.example.NativeSummaryFuncs.malloc(12L); org.example.NativeSummaryFuncs.malloc(776L); $7_phi = 0; if $opred != 4 goto label4; $7_phi = $p1; goto label6; label4: if $opred != 5 goto label5; $7_phi = $p0; goto label6; label5: if $opred != 6 goto label6; $7_phi = $p2; label6: org.example.NativeSummaryFuncs.realloc($7_phi, null); org.example.NativeSummaryFuncs.malloc(776L); $10_phi = null; if $opred != 7 goto label7; $10_phi = "ERROR"; goto label8; label7: if $opred != 8 goto label8; $10_phi = "INFO"; label8: org.example.NativeSummaryFuncs.fprintf(null, "%s: %s\n", $10_phi, null); org.example.NativeSummaryFuncs.calloc(1L, 32L); org.example.NativeSummaryFuncs.malloc(80L); org.example.NativeSummaryFuncs.malloc(16L); org.example.NativeSummaryFuncs.calloc(1L, 32L); org.example.NativeSummaryFuncs.calloc(1L, 32L); return; }
1 the param2 is passed to realloc nsfunc_sink
fr.ubordeaux.math.paridroid_25.apk Sink: <fr.ubordeaux.math.paridroid.PariNative: java.lang.String read(int)> staticinvoke <org.example.NativeSummaryFuncs: int fclose(int)>($i0) Source: <fr.ubordeaux.math.paridroid.PariActivity: void onActivityResult(int,int,android.content.Intent)> $i0 = virtualinvoke $r6.<android.os.ParcelFileDescriptor: int getFd()>()
https://pari.math.u-bordeaux.fr/cgi-bin/gitweb.cgi?p=paridroid.git;a=blob;f=PariDroid/app/src/main/jni/paridroid/fr_ubordeaux_math_paridroid_PariNative.c;h=19aec0ffa9f0ddaf3c5b8dd37d9fcdb6edd9db57;hb=HEAD 88 jstring 89 Java_fr_ubordeaux_math_paridroid_PariNative_read (JNIEnv *env, jclass cls, jint file) 90 { 91 int fd; 92 char *line; 93 94 fd = (int) file; 95 96 paridroid_read (fd, &line); 97 98 jstring s = (*env)->NewStringUTF (env, line); 99 100 return s; 101 } 166 void 167 paridroid_read (const int file, char **out) 168 { 169 FILE *f; 170 volatile GEN z_next = gnil, z; 171 pari_timer T, Tw; 172 173 f = fdopen (dup (file), "r"); 174 175 command_prepare (&T, &Tw); 176 177 do { 178 z = z_next; 179 z_next = gp_read_stream (f); 180 } while (z_next != NULL); 181 182 fclose (f); 183 184 command_postpare (out, z, 1, T, Tw); 185 }
$r4 = staticinvoke <fr.ubordeaux.math.paridroid.PariNative: java.lang.String read(int)>($i0) staticinvoke <org.example.NativeSummaryFuncs: int fclose(int)>($i0)
<Source Statement="$i0 = virtualinvoke $r6.&lt;android.os.ParcelFileDescriptor: int getFd()&gt;()" Method="&lt;fr.ubordeaux.math.paridroid.PariActivity: void onActivityResult(int,int,android.content.Intent)&gt;"> <AccessPath Value="$i0" Type="int" TaintSubFields="true" /> <TaintPath> <PathElement Statement="$i0 = virtualinvoke $r6.&lt;android.os.ParcelFileDescriptor: int getFd()&gt;()" Method="&lt;fr.ubordeaux.math.paridroid.PariActivity: void onActivityResult(int,int,android.content.Intent)&gt;"> <AccessPath Value="$i0" Type="int" TaintSubFields="true" /> </PathElement> <PathElement Statement="$r4 = staticinvoke &lt;fr.ubordeaux.math.paridroid.PariNative: java.lang.String read(int)&gt;($i0)" Method="&lt;fr.ubordeaux.math.paridroid.PariActivity: void onActivityResult(int,int,android.content.Intent)&gt;"> <AccessPath Value="$i0" Type="int" TaintSubFields="true" /> </PathElement> <PathElement Statement="staticinvoke &lt;org.example.NativeSummaryFuncs: int fclose(int)&gt;($i0)" Method="&lt;fr.ubordeaux.math.paridroid.PariNative: java.lang.String read(int)&gt;"> <AccessPath Value="$i0" Type="int" TaintSubFields="true" /> </PathElement> </TaintPath> </Source>
param0 -> fclose
public static java.lang.String read(int) { int $p0; $p0 := @parameter0; org.example.NativeSummaryFuncs.fclose($p0); org.example.NativeSummaryFuncs.free(null); org.example.NativeSummaryFuncs.raise(null); org.example.NativeSummaryFuncs.malloc(null); org.example.NativeSummaryFuncs.raise(null); return null; }
1 param0 fd is closed in native nsfunc_sink fopen
com.atelieryl.wonderdroid_51.apk Sink: <com.atelieryl.wonderdroid.WonderSwan: void loadbackup(java.lang.String)> $i1 = staticinvoke <org.example.NativeSummaryFuncs: int fopen(java.lang.String,java.lang.String)>($r0, "r") Source: <com.atelieryl.wonderdroid.Main$1: void onPostExecute(java.lang.Void)> $r5 = virtualinvoke $r4.<java.io.File: java.lang.String getAbsolutePath()>()
https://github.com/williehwc/wonderdroid-x/blob/bca8527d9cb4ace82ae6a9ab19f3c84e96ae8571/app/src/main/jni/com_atelieryl_wonderdroid_WonderSwan.cpp#L196 JNIEXPORT void JNICALL Java_com_atelieryl_wonderdroid_WonderSwan_loadstate(JNIEnv *env, jclass obj, jstring filename) { _runGame = false; MDFNI_LoadState(env->GetStringUTFChars(filename, NULL), ""); _runGame = true; } https://github.com/williehwc/wonderdroid-x/blob/bca8527d9cb4ace82ae6a9ab19f3c84e96ae8571/app/src/main/jni/mednafen/mednafen.cpp#L1221
staticinvoke <com.atelieryl.wonderdroid.WonderSwan: void loadbackup(java.lang.String)>($r5) $i1 = staticinvoke <org.example.NativeSummaryFuncs: int fopen(java.lang.String,java.lang.String)>($r0, "r")
<Source Statement="$r5 = virtualinvoke $r4.&lt;java.io.File: java.lang.String getAbsolutePath()&gt;()" Method="&lt;com.atelieryl.wonderdroid.Main$1: void onPostExecute(java.lang.Void)&gt;"> <AccessPath Value="$r5" Type="java.lang.String" TaintSubFields="true" /> <TaintPath> <PathElement Statement="$r5 = virtualinvoke $r4.&lt;java.io.File: java.lang.String getAbsolutePath()&gt;()" Method="&lt;com.atelieryl.wonderdroid.Main$1: void onPostExecute(java.lang.Void)&gt;"> <AccessPath Value="$r5" Type="java.lang.String" TaintSubFields="true" /> </PathElement> <PathElement Statement="staticinvoke &lt;com.atelieryl.wonderdroid.WonderSwan: void loadbackup(java.lang.String)&gt;($r5)" Method="&lt;com.atelieryl.wonderdroid.Main$1: void onPostExecute(java.lang.Void)&gt;"> <AccessPath Value="$r0" Type="java.lang.String" TaintSubFields="true" /> </PathElement> <PathElement Statement="$i1 = staticinvoke &lt;org.example.NativeSummaryFuncs: int fopen(java.lang.String,java.lang.String)&gt;($r0, &quot;r&quot;)" Method="&lt;com.atelieryl.wonderdroid.WonderSwan: void loadbackup(java.lang.String)&gt;"> <AccessPath Value="$r0" Type="java.lang.String" TaintSubFields="true" /> </PathElement> </TaintPath> </Source>
filepath -> fopen
public static void loadbackup(java.lang.String) { int $opred, $7, $26; java.lang.String $p0, $0_phi, $8_phi, $13_phi, $19_phi, $27_phi, $32_phi; $p0 := @parameter0; $0_phi = null; $opred = org.example.NativeSummaryAux.opaqueInt(); if $opred != 1 goto label01; $0_phi = "loading backup data"; goto label02; label01: if $opred != 2 goto label02; $0_phi = null; label02: android.util.Log.d("libwonderswan", $0_phi); org.example.NativeSummaryFuncs.snprintf(null, 256L, "eeprom size %d, sram size %d", null, null); $7 = org.example.NativeSummaryFuncs.fopen($p0, "r"); $8_phi = null; if $opred != 3 goto label03; $8_phi = "Loading SRAM"; goto label04; label03: if $opred != 4 goto label04; $8_phi = null; label04: android.util.Log.d("libwonderswan", $8_phi); org.example.NativeSummaryFuncs.fread(null, 1L, null, $7); $13_phi = null; if $opred != 5 goto label05; $13_phi = null; goto label06; label05: if $opred != 6 goto label06; $13_phi = "Loading eeprom"; label06: android.util.Log.d("libwonderswan", $13_phi); org.example.NativeSummaryFuncs.fread(null, 1L, null, $7); org.example.NativeSummaryFuncs.fclose($7); $19_phi = null; if $opred != 7 goto label07; $19_phi = "loading backup data"; goto label08; label07: if $opred != 8 goto label08; $19_phi = null; label08: android.util.Log.d("libwonderswan", $19_phi); org.example.NativeSummaryFuncs.snprintf(null, 256L, "eeprom size %d, sram size %d", null, null); $26 = org.example.NativeSummaryFuncs.fopen($p0, "r"); $27_phi = null; if $opred != 9 goto label09; $27_phi = "Loading SRAM"; goto label10; label09: if $opred != 10 goto label10; $27_phi = null; label10: android.util.Log.d("libwonderswan", $27_phi); org.example.NativeSummaryFuncs.fread(null, 1L, null, $26); $32_phi = null; if $opred != 11 goto label11; $32_phi = null; goto label12; label11: if $opred != 12 goto label12; $32_phi = "Loading eeprom"; label12: android.util.Log.d("libwonderswan", $32_phi); org.example.NativeSummaryFuncs.fread(null, 1L, null, $26); org.example.NativeSummaryFuncs.fclose($26); return; }
1 the file is opened to load backup nsfunc_sink fopen
com.htruong.inputmethod.latin_6.apk Sink: <com.htruong.inputmethod.latin.LatinIME: void setInputView(android.view.View)> specialinvoke r0.<android.inputmethodservice.InputMethodService: void setInputView(android.view.View)>($r1) Source: <com.htruong.inputmethod.latin.w: com.htruong.inputmethod.latin.v a(android.content.Context,java.util.Locale,boolean)> $r8 = virtualinvoke $r7.<java.util.ArrayList: java.util.Iterator iterator()>()
DynReg: https://github.com/htruong/sophia_oss/blob/d99f4405f2a0987ef5ab9616b011ab7bd7aa8224/latinime/jni/com_htruong_inputmethod_latin_BinaryDictionary.cpp#L252 https://github.com/htruong/sophia_oss/blob/d99f4405f2a0987ef5ab9616b011ab7bd7aa8224/latinime/jni/com_htruong_inputmethod_latin_BinaryDictionary.cpp#L47 static jlong latinime_BinaryDictionary_open(JNIEnv *env, jobject object, jstring sourceDir, jlong dictOffset, jlong dictSize, jint typedLetterMultiplier, jint fullWordMultiplier, jint maxWordLength, jint maxWords) { PROF_OPEN; PROF_START(66); const char *sourceDirChars = env->GetStringUTFChars(sourceDir, 0); if (sourceDirChars == 0) { AKLOGE("DICT: Can't get sourceDir string"); return 0; } int fd = 0; void *dictBuf = 0; int adjust = 0; #ifdef USE_MMAP_FOR_DICTIONARY /* mmap version */ fd = open(sourceDirChars, O_RDONLY); if (fd < 0) { AKLOGE("DICT: Can't open sourceDir. sourceDirChars=%s errno=%d", sourceDirChars, errno); return 0; } int pagesize = getpagesize(); adjust = dictOffset % pagesize; int adjDictOffset = dictOffset - adjust; int adjDictSize = dictSize + adjust; dictBuf = mmap(0, sizeof(char) * adjDictSize, PROT_READ, MAP_PRIVATE, fd, adjDictOffset); if (dictBuf == MAP_FAILED) { AKLOGE("DICT: Can't mmap dictionary. errno=%d", errno); return 0; } dictBuf = (void *)((char *)dictBuf + adjust); #else // USE_MMAP_FOR_DICTIONARY /* malloc version */ FILE *file = 0; file = fopen(sourceDirChars, "rb"); if (file == 0) { AKLOGE("DICT: Can't fopen sourceDir. sourceDirChars=%s errno=%d", sourceDirChars, errno); return 0; } dictBuf = malloc(sizeof(char) * dictSize); if (!dictBuf) { AKLOGE("DICT: Can't allocate memory region for dictionary. errno=%d", errno); return 0; } int ret = fseek(file, (long)dictOffset, SEEK_SET); if (ret != 0) { AKLOGE("DICT: Failure in fseek. ret=%d errno=%d", ret, errno); return 0; } ret = fread(dictBuf, sizeof(char) * dictSize, 1, file); if (ret != 1) { AKLOGE("DICT: Failure in fread. ret=%d errno=%d", ret, errno); return 0; } ret = fclose(file); if (ret != 0) { AKLOGE("DICT: Failure in fclose. ret=%d errno=%d", ret, errno); return 0; } #endif // USE_MMAP_FOR_DICTIONARY env->ReleaseStringUTFChars(sourceDir, sourceDirChars); if (!dictBuf) { AKLOGE("DICT: dictBuf is null"); return 0; } Dictionary *dictionary = 0; if (BinaryFormat::UNKNOWN_FORMAT == BinaryFormat::detectFormat((uint8_t*)dictBuf)) { AKLOGE("DICT: dictionary format is unknown, bad magic number"); #ifdef USE_MMAP_FOR_DICTIONARY releaseDictBuf(((char*)dictBuf) - adjust, adjDictSize, fd); #else // USE_MMAP_FOR_DICTIONARY releaseDictBuf(dictBuf, 0, 0); #endif // USE_MMAP_FOR_DICTIONARY } else { dictionary = new Dictionary(dictBuf, dictSize, fd, adjust, typedLetterMultiplier, fullWordMultiplier, maxWordLength, maxWords); } PROF_END(66); PROF_CLOSE; return (jlong)dictionary; }
$l0 = specialinvoke r0.<com.htruong.inputmethod.latin.BinaryDictionary: long openNative(java.lang.String,long,long,int,int,int,int)>($r1, $l0, $l1, 2, 2, 48, 18)
<Source Statement="$r8 = virtualinvoke $r7.&lt;java.util.ArrayList: java.util.Iterator iterator()&gt;()" Method="&lt;com.htruong.inputmethod.latin.w: com.htruong.inputmethod.latin.v a(android.content.Context,java.util.Locale,boolean)&gt;"> <AccessPath Value="$r8" Type="java.util.Iterator" TaintSubFields="true" /> <TaintPath> <PathElement Statement="$r8 = virtualinvoke $r7.&lt;java.util.ArrayList: java.util.Iterator iterator()&gt;()" Method="&lt;com.htruong.inputmethod.latin.w: com.htruong.inputmethod.latin.v a(android.content.Context,java.util.Locale,boolean)&gt;"> <AccessPath Value="$r8" Type="java.util.Iterator" TaintSubFields="true" /> </PathElement> <PathElement Statement="$r9 = interfaceinvoke $r8.&lt;java.util.Iterator: java.lang.Object next()&gt;()" Method="&lt;com.htruong.inputmethod.latin.w: com.htruong.inputmethod.latin.v a(android.content.Context,java.util.Locale,boolean)&gt;"> <AccessPath Value="$r9" Type="java.lang.Object" TaintSubFields="true" /> </PathElement> <PathElement Statement="$r10 = (com.htruong.inputmethod.latin.k) $r9" Method="&lt;com.htruong.inputmethod.latin.w: com.htruong.inputmethod.latin.v a(android.content.Context,java.util.Locale,boolean)&gt;"> <AccessPath Value="$r10" Type="com.htruong.inputmethod.latin.k" TaintSubFields="true" /> </PathElement> <PathElement Statement="$l1 = $r10.&lt;com.htruong.inputmethod.latin.k: long b&gt;" Method="&lt;com.htruong.inputmethod.latin.w: com.htruong.inputmethod.latin.v a(android.content.Context,java.util.Locale,boolean)&gt;"> <AccessPath Value="$l1" Type="long" TaintSubFields="true" /> </PathElement> <PathElement Statement="specialinvoke $r6.&lt;com.htruong.inputmethod.latin.BinaryDictionary: void &lt;init&gt;(android.content.Context,java.lang.String,long,long,boolean,java.util.Locale)&gt;($r0, $r3, $l1, $l0, 0, $r1)" Method="&lt;com.htruong.inputmethod.latin.w: com.htruong.inputmethod.latin.v a(android.content.Context,java.util.Locale,boolean)&gt;"> <AccessPath Value="$l0" Type="long" TaintSubFields="true" /> </PathElement> <PathElement Statement="specialinvoke r0.&lt;com.htruong.inputmethod.latin.BinaryDictionary: void loadDictionary(java.lang.String,long,long)&gt;($r2, $l0, $l1)" Method="&lt;com.htruong.inputmethod.latin.BinaryDictionary: void &lt;init&gt;(android.content.Context,java.lang.String,long,long,boolean,java.util.Locale)&gt;"> <AccessPath Value="$l0" Type="long" TaintSubFields="true" /> </PathElement> <PathElement Statement="$l0 = specialinvoke r0.&lt;com.htruong.inputmethod.latin.BinaryDictionary: long openNative(java.lang.String,long,long,int,int,int,int)&gt;($r1, $l0, $l1, 2, 2, 48, 18)" Method="&lt;com.htruong.inputmethod.latin.BinaryDictionary: void loadDictionary(java.lang.String,long,long)&gt;"> <AccessPath Value="$l0" Type="long" TaintSubFields="true" /> </PathElement> <PathElement Statement="return $l0" Method="&lt;com.htruong.inputmethod.latin.BinaryDictionary: long openNative(java.lang.String,long,long,int,int,int,int)&gt;"> <AccessPath Value="$l0" Type="long" TaintSubFields="true" /> </PathElement> <PathElement Statement="r0.&lt;com.htruong.inputmethod.latin.BinaryDictionary: long mNativeDict&gt; = $l0" Method="&lt;com.htruong.inputmethod.latin.BinaryDictionary: void loadDictionary(java.lang.String,long,long)&gt;"> <AccessPath Value="r0" Type="com.htruong.inputmethod.latin.BinaryDictionary" TaintSubFields="true"> <Fields> <Field Value="&lt;com.htruong.inputmethod.latin.BinaryDictionary: long mNativeDict&gt;" Type="long" /> </Fields> </AccessPath> </PathElement> <PathElement Statement="return" Method="&lt;com.htruong.inputmethod.latin.BinaryDictionary: void loadDictionary(java.lang.String,long,long)&gt;"> <AccessPath Value="r0" Type="com.htruong.inputmethod.latin.BinaryDictionary" TaintSubFields="true"> <Fields> <Field Value="&lt;com.htruong.inputmethod.latin.BinaryDictionary: long mNativeDict&gt;" Type="long" /> </Fields> </AccessPath> </PathElement> <PathElement Statement="return" Method="&lt;com.htruong.inputmethod.latin.BinaryDictionary: void &lt;init&gt;(android.content.Context,java.lang.String,long,long,boolean,java.util.Locale)&gt;"> <AccessPath Value="$r6" Type="com.htruong.inputmethod.latin.BinaryDictionary" TaintSubFields="true"> <Fields> <Field Value="&lt;com.htruong.inputmethod.latin.BinaryDictionary: long mNativeDict&gt;" Type="long" /> </Fields> </AccessPath> </PathElement> <PathElement Statement="$z1 = virtualinvoke $r6.&lt;com.htruong.inputmethod.latin.BinaryDictionary: boolean isValidDictionary()&gt;()" Method="&lt;com.htruong.inputmethod.latin.w: com.htruong.inputmethod.latin.v a(android.content.Context,java.util.Locale,boolean)&gt;"> <AccessPath Value="r0" Type="com.htruong.inputmethod.latin.BinaryDictionary" TaintSubFields="true"> <Fields> <Field Value="&lt;com.htruong.inputmethod.latin.BinaryDictionary: long mNativeDict&gt;" Type="long" /> </Fields> </AccessPath> </PathElement> <PathElement Statement="return 1" Method="&lt;com.htruong.inputmethod.latin.BinaryDictionary: boolean isValidDictionary()&gt;"> <AccessPath Value="$r6" Type="com.htruong.inputmethod.latin.BinaryDictionary" TaintSubFields="true"> <Fields> <Field Value="&lt;com.htruong.inputmethod.latin.BinaryDictionary: long mNativeDict&gt;" Type="long" /> </Fields> </AccessPath> </PathElement> <PathElement Statement="virtualinvoke $r2.&lt;java.util.LinkedList: boolean add(java.lang.Object)&gt;($r6)" Method="&lt;com.htruong.inputmethod.latin.w: com.htruong.inputmethod.latin.v a(android.content.Context,java.util.Locale,boolean)&gt;"> <AccessPath Value="$r2" Type="java.util.LinkedList" TaintSubFields="true"> <Fields> <Field Value="&lt;java.util.Collection: java.lang.Object[] innerArray&gt;" Type="java.lang.Object[]" /> </Fields> </AccessPath> </PathElement> <PathElement Statement="specialinvoke $r4.&lt;com.htruong.inputmethod.latin.v: void &lt;init&gt;(java.util.Collection)&gt;($r2)" Method="&lt;com.htruong.inputmethod.latin.w: com.htruong.inputmethod.latin.v a(android.content.Context,java.util.Locale,boolean)&gt;"> <AccessPath Value="$r1" Type="java.util.LinkedList" TaintSubFields="true"> <Fields> <Field Value="&lt;java.util.Collection: java.lang.Object[] innerArray&gt;" Type="java.lang.Object[]" /> </Fields> </AccessPath> </PathElement> <PathElement Statement="specialinvoke $r4.&lt;java.util.concurrent.CopyOnWriteArrayList: void &lt;init&gt;(java.util.Collection)&gt;($r1)" Method="&lt;com.htruong.inputmethod.latin.v: void &lt;init&gt;(java.util.Collection)&gt;"> <AccessPath Value="$r4" Type="java.util.concurrent.CopyOnWriteArrayList" TaintSubFields="true"> <Fields> <Field Value="&lt;java.util.Collection: java.lang.Object[] innerArray&gt;" Type="java.lang.Object[]" /> </Fields> </AccessPath> </PathElement> <PathElement Statement="r0.&lt;com.htruong.inputmethod.latin.v: java.util.concurrent.CopyOnWriteArrayList b&gt; = $r4" Method="&lt;com.htruong.inputmethod.latin.v: void &lt;init&gt;(java.util.Collection)&gt;"> <AccessPath Value="r0" Type="com.htruong.inputmethod.latin.v" TaintSubFields="true"> <Fields> <Field Value="&lt;com.htruong.inputmethod.latin.v: java.util.concurrent.CopyOnWriteArrayList b&gt;" Type="java.util.concurrent.CopyOnWriteArrayList" /> <Field Value="&lt;java.util.Collection: java.lang.Object[] innerArray&gt;" Type="java.lang.Object[]" /> </Fields> </AccessPath> </PathElement> <PathElement Statement="return" Method="&lt;com.htruong.inputmethod.latin.v: void &lt;init&gt;(java.util.Collection)&gt;"> <AccessPath Value="$r4" Type="com.htruong.inputmethod.latin.v" TaintSubFields="true"> <Fields> <Field Value="&lt;com.htruong.inputmethod.latin.v: java.util.concurrent.CopyOnWriteArrayList b&gt;" Type="java.util.concurrent.CopyOnWriteArrayList" /> <Field Value="&lt;java.util.Collection: java.lang.Object[] innerArray&gt;" Type="java.lang.Object[]" /> </Fields> </AccessPath> </PathElement> <PathElement Statement="return $r4" Method="&lt;com.htruong.inputmethod.latin.w: com.htruong.inputmethod.latin.v a(android.content.Context,java.util.Locale,boolean)&gt;"> <AccessPath Value="$r2" Type="com.htruong.inputmethod.latin.v" TaintSubFields="true"> <Fields> <Field Value="&lt;com.htruong.inputmethod.latin.v: java.util.concurrent.CopyOnWriteArrayList b&gt;" Type="java.util.concurrent.CopyOnWriteArrayList" /> <Field Value="&lt;java.util.Collection: java.lang.Object[] innerArray&gt;" Type="java.lang.Object[]" /> </Fields> </AccessPath> </PathElement> <PathElement Statement="return $r2" Method="&lt;com.htruong.inputmethod.latin.w: com.htruong.inputmethod.latin.v a(android.content.Context,java.util.Locale)&gt;"> <AccessPath Value="$r3" Type="com.htruong.inputmethod.latin.v" TaintSubFields="true"> <Fields> <Field Value="&lt;com.htruong.inputmethod.latin.v: java.util.concurrent.CopyOnWriteArrayList b&gt;" Type="java.util.concurrent.CopyOnWriteArrayList" /> <Field Value="&lt;java.util.Collection: java.lang.Object[] innerArray&gt;" Type="java.lang.Object[]" /> </Fields> </AccessPath> </PathElement> <PathElement Statement="staticinvoke &lt;com.htruong.inputmethod.latin.Suggest: void a(java.util.concurrent.ConcurrentHashMap,java.lang.String,com.htruong.inputmethod.latin.t)&gt;($r5, &quot;main&quot;, $r3)" Method="&lt;com.htruong.inputmethod.latin.ao: void run()&gt;"> <AccessPath Value="$r2" Type="com.htruong.inputmethod.latin.v" TaintSubFields="true"> <Fields> <Field Value="&lt;com.htruong.inputmethod.latin.v: java.util.concurrent.CopyOnWriteArrayList b&gt;" Type="java.util.concurrent.CopyOnWriteArrayList" /> <Field Value="&lt;java.util.Collection: java.lang.Object[] innerArray&gt;" Type="java.lang.Object[]" /> </Fields> </AccessPath> </PathElement> <PathElement Statement="staticinvoke &lt;com.htruong.inputmethod.latin.Suggest: void b(java.util.concurrent.ConcurrentHashMap,java.lang.String,com.htruong.inputmethod.latin.t)&gt;($r0, &quot;main&quot;, $r2)" Method="&lt;com.htruong.inputmethod.latin.Suggest: void a(java.util.concurrent.ConcurrentHashMap,java.lang.String,com.htruong.inputmethod.latin.t)&gt;"> <AccessPath Value="$r2" Type="com.htruong.inputmethod.latin.v" TaintSubFields="true"> <Fields> <Field Value="&lt;com.htruong.inputmethod.latin.v: java.util.concurrent.CopyOnWriteArrayList b&gt;" Type="java.util.concurrent.CopyOnWriteArrayList" /> <Field Value="&lt;java.util.Collection: java.lang.Object[] innerArray&gt;" Type="java.lang.Object[]" /> </Fields> </AccessPath> </PathElement> <PathElement Statement="$r3 = virtualinvoke $r0.&lt;java.util.concurrent.ConcurrentHashMap: java.lang.Object put(java.lang.Object,java.lang.Object)&gt;($r1, $r2)" Method="&lt;com.htruong.inputmethod.latin.Suggest: void b(java.util.concurrent.ConcurrentHashMap,java.lang.String,com.htruong.inputmethod.latin.t)&gt;"> <AccessPath Value="$r0" Type="java.util.concurrent.ConcurrentHashMap" TaintSubFields="true"> <Fields> <Field Value="&lt;java.util.Map: java.lang.Object[] values&gt;" Type="java.lang.Object[]" /> </Fields> </AccessPath> </PathElement> <PathElement Statement="$r0 := @parameter0: java.util.concurrent.ConcurrentHashMap" Method="&lt;com.htruong.inputmethod.latin.Suggest: void b(java.util.concurrent.ConcurrentHashMap,java.lang.String,com.htruong.inputmethod.latin.t)&gt;"> <AccessPath Value="$r0" Type="java.util.concurrent.ConcurrentHashMap" TaintSubFields="true"> <Fields> <Field Value="&lt;java.util.Map: java.lang.Object[] values&gt;" Type="java.lang.Object[]" /> </Fields> </AccessPath> </PathElement> <PathElement Statement="$r0 := @parameter0: java.util.concurrent.ConcurrentHashMap" Method="&lt;com.htruong.inputmethod.latin.Suggest: void a(java.util.concurrent.ConcurrentHashMap,java.lang.String,com.htruong.inputmethod.latin.t)&gt;"> <AccessPath Value="$r5" Type="java.util.concurrent.ConcurrentHashMap" TaintSubFields="true"> <Fields> <Field Value="&lt;java.util.Map: java.lang.Object[] values&gt;" Type="java.lang.Object[]" /> </Fields> </AccessPath> </PathElement> <PathElement Statement="$r5 = staticinvoke &lt;com.htruong.inputmethod.latin.Suggest: java.util.concurrent.ConcurrentHashMap b(com.htruong.inputmethod.latin.Suggest)&gt;($r4)" Method="&lt;com.htruong.inputmethod.latin.ao: void run()&gt;"> <AccessPath Value="r1" Type="java.util.concurrent.ConcurrentHashMap" TaintSubFields="true"> <Fields> <Field Value="&lt;java.util.Map: java.lang.Object[] values&gt;" Type="java.lang.Object[]" /> </Fields> </AccessPath> </PathElement> <PathElement Statement="r1 = $r0.&lt;com.htruong.inputmethod.latin.Suggest: java.util.concurrent.ConcurrentHashMap g&gt;" Method="&lt;com.htruong.inputmethod.latin.Suggest: java.util.concurrent.ConcurrentHashMap b(com.htruong.inputmethod.latin.Suggest)&gt;"> <AccessPath Value="$r0" Type="com.htruong.inputmethod.latin.Suggest" TaintSubFields="true"> <Fields> <Field Value="&lt;com.htruong.inputmethod.latin.Suggest: java.util.concurrent.ConcurrentHashMap g&gt;" Type="java.util.concurrent.ConcurrentHashMap" /> <Field Value="&lt;java.util.Map: java.lang.Object[] values&gt;" Type="java.lang.Object[]" /> </Fields> </AccessPath> </PathElement> <PathElement Statement="$r0 := @parameter0: com.htruong.inputmethod.latin.Suggest" Method="&lt;com.htruong.inputmethod.latin.Suggest: java.util.concurrent.ConcurrentHashMap b(com.htruong.inputmethod.latin.Suggest)&gt;"> <AccessPath Value="$r4" Type="com.htruong.inputmethod.latin.Suggest" TaintSubFields="true"> <Fields> <Field Value="&lt;com.htruong.inputmethod.latin.Suggest: java.util.concurrent.ConcurrentHashMap g&gt;" Type="java.util.concurrent.ConcurrentHashMap" /> <Field Value="&lt;java.util.Map: java.lang.Object[] values&gt;" Type="java.lang.Object[]" /> </Fields> </AccessPath> </PathElement> <PathElement Statement="$r4 = r0.&lt;com.htruong.inputmethod.latin.ao: com.htruong.inputmethod.latin.Suggest c&gt;" Method="&lt;com.htruong.inputmethod.latin.ao: void run()&gt;"> <AccessPath Value="r0" Type="com.htruong.inputmethod.latin.ao" TaintSubFields="true"> <Fields> <Field Value="&lt;com.htruong.inputmethod.latin.ao: com.htruong.inputmethod.latin.Suggest c&gt;" Type="com.htruong.inputmethod.latin.Suggest" /> <Field Value="&lt;com.htruong.inputmethod.latin.Suggest: java.util.concurrent.ConcurrentHashMap g&gt;" Type="java.util.concurrent.ConcurrentHashMap" /> <Field Value="&lt;java.util.Map: java.lang.Object[] values&gt;" Type="java.lang.Object[]" /> </Fields> </AccessPath> </PathElement> <PathElement Statement="r0 := @this: com.htruong.inputmethod.latin.ao" Method="&lt;com.htruong.inputmethod.latin.ao: void run()&gt;"> <AccessPath Value="$r3" Type="com.htruong.inputmethod.latin.ao" TaintSubFields="true"> <Fields> <Field Value="&lt;com.htruong.inputmethod.latin.ao: com.htruong.inputmethod.latin.Suggest c&gt;" Type="com.htruong.inputmethod.latin.Suggest" /> <Field Value="&lt;com.htruong.inputmethod.latin.Suggest: java.util.concurrent.ConcurrentHashMap g&gt;" Type="java.util.concurrent.ConcurrentHashMap" /> <Field Value="&lt;java.util.Map: java.lang.Object[] values&gt;" Type="java.lang.Object[]" /> </Fields> </AccessPath> </PathElement> <PathElement Statement="specialinvoke $r3.&lt;com.htruong.inputmethod.latin.ao: void &lt;init&gt;(com.htruong.inputmethod.latin.Suggest,java.lang.String,android.content.Context,java.util.Locale)&gt;(r0, &quot;InitializeBinaryDictionary&quot;, $r1, $r2)" Method="&lt;com.htruong.inputmethod.latin.Suggest: void a(android.content.Context,java.util.Locale)&gt;"> <AccessPath Value="r0" Type="com.htruong.inputmethod.latin.ao" TaintSubFields="true"> <Fields> <Field Value="&lt;com.htruong.inputmethod.latin.ao: com.htruong.inputmethod.latin.Suggest c&gt;" Type="com.htruong.inputmethod.latin.Suggest" /> <Field Value="&lt;com.htruong.inputmethod.latin.Suggest: java.util.concurrent.ConcurrentHashMap g&gt;" Type="java.util.concurrent.ConcurrentHashMap" /> <Field Value="&lt;java.util.Map: java.lang.Object[] values&gt;" Type="java.lang.Object[]" /> </Fields> </AccessPath> </PathElement> <PathElement Statement="r0.&lt;com.htruong.inputmethod.latin.ao: com.htruong.inputmethod.latin.Suggest c&gt; = $r1" Method="&lt;com.htruong.inputmethod.latin.ao: void &lt;init&gt;(com.htruong.inputmethod.latin.Suggest,java.lang.String,android.content.Context,java.util.Locale)&gt;"> <AccessPath Value="$r1" Type="com.htruong.inputmethod.latin.Suggest" TaintSubFields="true"> <Fields> <Field Value="&lt;com.htruong.inputmethod.latin.Suggest: java.util.concurrent.ConcurrentHashMap g&gt;" Type="java.util.concurrent.ConcurrentHashMap" /> <Field Value="&lt;java.util.Map: java.lang.Object[] values&gt;" Type="java.lang.Object[]" /> </Fields> </AccessPath> </PathElement> <PathElement Statement="r0 := @this: com.htruong.inputmethod.latin.ao" Method="&lt;com.htruong.inputmethod.latin.ao: void &lt;init&gt;(com.htruong.inputmethod.latin.Suggest,java.lang.String,android.content.Context,java.util.Locale)&gt;"> <AccessPath Value="r0" Type="com.htruong.inputmethod.latin.Suggest" TaintSubFields="true"> <Fields> <Field Value="&lt;com.htruong.inputmethod.latin.Suggest: java.util.concurrent.ConcurrentHashMap g&gt;" Type="java.util.concurrent.ConcurrentHashMap" /> <Field Value="&lt;java.util.Map: java.lang.Object[] values&gt;" Type="java.lang.Object[]" /> </Fields> </AccessPath> </PathElement> <PathElement Statement="r0 := @this: com.htruong.inputmethod.latin.Suggest" Method="&lt;com.htruong.inputmethod.latin.Suggest: void a(android.content.Context,java.util.Locale)&gt;"> <AccessPath Value="r0" Type="com.htruong.inputmethod.latin.Suggest" TaintSubFields="true"> <Fields> <Field Value="&lt;com.htruong.inputmethod.latin.Suggest: java.util.concurrent.ConcurrentHashMap g&gt;" Type="java.util.concurrent.ConcurrentHashMap" /> <Field Value="&lt;java.util.Map: java.lang.Object[] values&gt;" Type="java.lang.Object[]" /> </Fields> </AccessPath> </PathElement> <PathElement Statement="r0.&lt;com.htruong.inputmethod.latin.Suggest: java.util.concurrent.ConcurrentHashMap g&gt; = $r3" Method="&lt;com.htruong.inputmethod.latin.Suggest: void &lt;init&gt;(android.content.Context,java.util.Locale)&gt;"> <AccessPath Value="$r3" Type="java.util.concurrent.ConcurrentHashMap" TaintSubFields="true"> <Fields> <Field Value="&lt;java.util.Map: java.lang.Object[] values&gt;" Type="java.lang.Object[]" /> </Fields> </AccessPath> </PathElement> <PathElement Statement="r0.&lt;com.htruong.inputmethod.latin.Suggest: java.util.concurrent.ConcurrentHashMap g&gt; = $r3" Method="&lt;com.htruong.inputmethod.latin.Suggest: void &lt;init&gt;(android.content.Context,java.util.Locale)&gt;"> <AccessPath Value="r0" Type="com.htruong.inputmethod.latin.Suggest" TaintSubFields="true"> <Fields> <Field Value="&lt;com.htruong.inputmethod.latin.Suggest: java.util.concurrent.ConcurrentHashMap g&gt;" Type="java.util.concurrent.ConcurrentHashMap" /> <Field Value="&lt;java.util.Map: java.lang.Object[] values&gt;" Type="java.lang.Object[]" /> </Fields> </AccessPath> </PathElement> <PathElement Statement="r0 := @this: com.htruong.inputmethod.latin.Suggest" Method="&lt;com.htruong.inputmethod.latin.Suggest: void &lt;init&gt;(android.content.Context,java.util.Locale)&gt;"> <AccessPath Value="$r4" Type="com.htruong.inputmethod.latin.Suggest" TaintSubFields="true"> <Fields> <Field Value="&lt;com.htruong.inputmethod.latin.Suggest: java.util.concurrent.ConcurrentHashMap g&gt;" Type="java.util.concurrent.ConcurrentHashMap" /> <Field Value="&lt;java.util.Map: java.lang.Object[] values&gt;" Type="java.lang.Object[]" /> </Fields> </AccessPath> </PathElement> <PathElement Statement="$r4 = r0.&lt;com.htruong.inputmethod.latin.LatinIME: com.htruong.inputmethod.latin.Suggest m&gt;" Method="&lt;com.htruong.inputmethod.latin.LatinIME: void h()&gt;"> <AccessPath Value="r0" Type="com.htruong.inputmethod.latin.LatinIME" TaintSubFields="true"> <Fields> <Field Value="&lt;com.htruong.inputmethod.latin.LatinIME: com.htruong.inputmethod.latin.Suggest m&gt;" Type="com.htruong.inputmethod.latin.Suggest" /> <Field Value="&lt;com.htruong.inputmethod.latin.Suggest: java.util.concurrent.ConcurrentHashMap g&gt;" Type="java.util.concurrent.ConcurrentHashMap" /> <Field Value="&lt;java.util.Map: java.lang.Object[] values&gt;" Type="java.lang.Object[]" /> </Fields> </AccessPath> </PathElement> <PathElement Statement="specialinvoke $r4.&lt;com.htruong.inputmethod.latin.Suggest: void &lt;init&gt;(android.content.Context,java.util.Locale)&gt;(r0, $r2)" Method="&lt;com.htruong.inputmethod.latin.LatinIME: void h()&gt;"> <AccessPath Value="$r1" Type="com.htruong.inputmethod.latin.LatinIME" TaintSubFields="true"> <Fields> <Field Value="&lt;com.htruong.inputmethod.latin.LatinIME: com.htruong.inputmethod.latin.Suggest m&gt;" Type="com.htruong.inputmethod.latin.Suggest" /> <Field Value="&lt;com.htruong.inputmethod.latin.Suggest: java.util.concurrent.ConcurrentHashMap g&gt;" Type="java.util.concurrent.ConcurrentHashMap" /> <Field Value="&lt;java.util.Map: java.lang.Object[] values&gt;" Type="java.lang.Object[]" /> </Fields> </AccessPath> </PathElement> <PathElement Statement="virtualinvoke r0.&lt;com.htruong.inputmethod.latin.Suggest: void a(android.content.Context,java.util.Locale)&gt;($r1, $r2)" Method="&lt;com.htruong.inputmethod.latin.Suggest: void &lt;init&gt;(android.content.Context,java.util.Locale)&gt;"> <AccessPath Value="$r1" Type="com.htruong.inputmethod.latin.LatinIME" TaintSubFields="true"> <Fields> <Field Value="&lt;com.htruong.inputmethod.latin.LatinIME: com.htruong.inputmethod.latin.Suggest m&gt;" Type="com.htruong.inputmethod.latin.Suggest" /> <Field Value="&lt;com.htruong.inputmethod.latin.Suggest: java.util.concurrent.ConcurrentHashMap g&gt;" Type="java.util.concurrent.ConcurrentHashMap" /> <Field Value="&lt;java.util.Map: java.lang.Object[] values&gt;" Type="java.lang.Object[]" /> </Fields> </AccessPath> </PathElement> <PathElement Statement="specialinvoke $r3.&lt;com.htruong.inputmethod.latin.ao: void &lt;init&gt;(com.htruong.inputmethod.latin.Suggest,java.lang.String,android.content.Context,java.util.Locale)&gt;(r0, &quot;InitializeBinaryDictionary&quot;, $r1, $r2)" Method="&lt;com.htruong.inputmethod.latin.Suggest: void a(android.content.Context,java.util.Locale)&gt;"> <AccessPath Value="$r3" Type="com.htruong.inputmethod.latin.LatinIME" TaintSubFields="true"> <Fields> <Field Value="&lt;com.htruong.inputmethod.latin.LatinIME: com.htruong.inputmethod.latin.Suggest m&gt;" Type="com.htruong.inputmethod.latin.Suggest" /> <Field Value="&lt;com.htruong.inputmethod.latin.Suggest: java.util.concurrent.ConcurrentHashMap g&gt;" Type="java.util.concurrent.ConcurrentHashMap" /> <Field Value="&lt;java.util.Map: java.lang.Object[] values&gt;" Type="java.lang.Object[]" /> </Fields> </AccessPath> </PathElement> <PathElement Statement="return" Method="&lt;com.htruong.inputmethod.latin.ao: void &lt;init&gt;(com.htruong.inputmethod.latin.Suggest,java.lang.String,android.content.Context,java.util.Locale)&gt;"> <AccessPath Value="$r1" Type="com.htruong.inputmethod.latin.LatinIME" TaintSubFields="true"> <Fields> <Field Value="&lt;com.htruong.inputmethod.latin.LatinIME: com.htruong.inputmethod.latin.Suggest m&gt;" Type="com.htruong.inputmethod.latin.Suggest" /> <Field Value="&lt;com.htruong.inputmethod.latin.Suggest: java.util.concurrent.ConcurrentHashMap g&gt;" Type="java.util.concurrent.ConcurrentHashMap" /> <Field Value="&lt;java.util.Map: java.lang.Object[] values&gt;" Type="java.lang.Object[]" /> </Fields> </AccessPath> </PathElement> <PathElement Statement="return" Method="&lt;com.htruong.inputmethod.latin.Suggest: void a(android.content.Context,java.util.Locale)&gt;"> <AccessPath Value="$r1" Type="com.htruong.inputmethod.latin.LatinIME" TaintSubFields="true"> <Fields> <Field Value="&lt;com.htruong.inputmethod.latin.LatinIME: com.htruong.inputmethod.latin.Suggest m&gt;" Type="com.htruong.inputmethod.latin.Suggest" /> <Field Value="&lt;com.htruong.inputmethod.latin.Suggest: java.util.concurrent.ConcurrentHashMap g&gt;" Type="java.util.concurrent.ConcurrentHashMap" /> <Field Value="&lt;java.util.Map: java.lang.Object[] values&gt;" Type="java.lang.Object[]" /> </Fields> </AccessPath> </PathElement> <PathElement Statement="specialinvoke r0.&lt;com.htruong.inputmethod.latin.Suggest: void b(android.content.Context,java.util.Locale)&gt;($r1, $r2)" Method="&lt;com.htruong.inputmethod.latin.Suggest: void &lt;init&gt;(android.content.Context,java.util.Locale)&gt;"> <AccessPath Value="$r1" Type="com.htruong.inputmethod.latin.LatinIME" TaintSubFields="true"> <Fields> <Field Value="&lt;com.htruong.inputmethod.latin.LatinIME: com.htruong.inputmethod.latin.Suggest m&gt;" Type="com.htruong.inputmethod.latin.Suggest" /> <Field Value="&lt;com.htruong.inputmethod.latin.Suggest: java.util.concurrent.ConcurrentHashMap g&gt;" Type="java.util.concurrent.ConcurrentHashMap" /> <Field Value="&lt;java.util.Map: java.lang.Object[] values&gt;" Type="java.lang.Object[]" /> </Fields> </AccessPath> </PathElement> <PathElement Statement="specialinvoke $r3.&lt;com.htruong.inputmethod.latin.aL: void &lt;init&gt;(android.content.Context,java.util.Locale)&gt;($r1, $r2)" Method="&lt;com.htruong.inputmethod.latin.Suggest: void b(android.content.Context,java.util.Locale)&gt;"> <AccessPath Value="$r1" Type="com.htruong.inputmethod.latin.LatinIME" TaintSubFields="true"> <Fields> <Field Value="&lt;com.htruong.inputmethod.latin.LatinIME: com.htruong.inputmethod.latin.Suggest m&gt;" Type="com.htruong.inputmethod.latin.Suggest" /> <Field Value="&lt;com.htruong.inputmethod.latin.Suggest: java.util.concurrent.ConcurrentHashMap g&gt;" Type="java.util.concurrent.ConcurrentHashMap" /> <Field Value="&lt;java.util.Map: java.lang.Object[] values&gt;" Type="java.lang.Object[]" /> </Fields> </AccessPath> </PathElement> <PathElement Statement="specialinvoke r0.&lt;com.htruong.inputmethod.latin.D: void &lt;init&gt;(android.content.Context,int)&gt;($r1, 6)" Method="&lt;com.htruong.inputmethod.latin.aL: void &lt;init&gt;(android.content.Context,java.util.Locale)&gt;"> <AccessPath Value="$r1" Type="com.htruong.inputmethod.latin.LatinIME" TaintSubFields="true"> <Fields> <Field Value="&lt;com.htruong.inputmethod.latin.LatinIME: com.htruong.inputmethod.latin.Suggest m&gt;" Type="com.htruong.inputmethod.latin.Suggest" /> <Field Value="&lt;com.htruong.inputmethod.latin.Suggest: java.util.concurrent.ConcurrentHashMap g&gt;" Type="java.util.concurrent.ConcurrentHashMap" /> <Field Value="&lt;java.util.Map: java.lang.Object[] values&gt;" Type="java.lang.Object[]" /> </Fields> </AccessPath> </PathElement> <PathElement Statement="r0.&lt;com.htruong.inputmethod.latin.D: android.content.Context a&gt; = $r1" Method="&lt;com.htruong.inputmethod.latin.D: void &lt;init&gt;(android.content.Context,int)&gt;"> <AccessPath Value="r0" Type="com.htruong.inputmethod.latin.D" TaintSubFields="true"> <Fields> <Field Value="&lt;com.htruong.inputmethod.latin.D: android.content.Context a&gt;" Type="com.htruong.inputmethod.latin.LatinIME" /> <Field Value="&lt;com.htruong.inputmethod.latin.LatinIME: com.htruong.inputmethod.latin.Suggest m&gt;" Type="com.htruong.inputmethod.latin.Suggest" /> <Field Value="&lt;com.htruong.inputmethod.latin.Suggest: java.util.concurrent.ConcurrentHashMap g&gt;" Type="java.util.concurrent.ConcurrentHashMap" /> <Field Value="&lt;java.util.Map: java.lang.Object[] values&gt;" Type="java.lang.Object[]" /> </Fields> </AccessPath> </PathElement> <PathElement Statement="return" Method="&lt;com.htruong.inputmethod.latin.D: void &lt;init&gt;(android.content.Context,int)&gt;"> <AccessPath Value="r0" Type="com.htruong.inputmethod.latin.aL" TaintSubFields="true"> <Fields> <Field Value="&lt;com.htruong.inputmethod.latin.D: android.content.Context a&gt;" Type="com.htruong.inputmethod.latin.LatinIME" /> <Field Value="&lt;com.htruong.inputmethod.latin.LatinIME: com.htruong.inputmethod.latin.Suggest m&gt;" Type="com.htruong.inputmethod.latin.Suggest" /> <Field Value="&lt;com.htruong.inputmethod.latin.Suggest: java.util.concurrent.ConcurrentHashMap g&gt;" Type="java.util.concurrent.ConcurrentHashMap" /> <Field Value="&lt;java.util.Map: java.lang.Object[] values&gt;" Type="java.lang.Object[]" /> </Fields> </AccessPath> </PathElement> <PathElement Statement="specialinvoke $r5.&lt;com.htruong.inputmethod.latin.aM: void &lt;init&gt;(com.htruong.inputmethod.latin.aL)&gt;(r0)" Method="&lt;com.htruong.inputmethod.latin.aL: void &lt;init&gt;(android.content.Context,java.util.Locale)&gt;"> <AccessPath Value="$r1" Type="com.htruong.inputmethod.latin.aL" TaintSubFields="true"> <Fields> <Field Value="&lt;com.htruong.inputmethod.latin.D: android.content.Context a&gt;" Type="com.htruong.inputmethod.latin.LatinIME" /> <Field Value="&lt;com.htruong.inputmethod.latin.LatinIME: com.htruong.inputmethod.latin.Suggest m&gt;" Type="com.htruong.inputmethod.latin.Suggest" /> <Field Value="&lt;com.htruong.inputmethod.latin.Suggest: java.util.concurrent.ConcurrentHashMap g&gt;" Type="java.util.concurrent.ConcurrentHashMap" /> <Field Value="&lt;java.util.Map: java.lang.Object[] values&gt;" Type="java.lang.Object[]" /> </Fields> </AccessPath> </PathElement> <PathElement Statement="return" Method="&lt;com.htruong.inputmethod.latin.aM: void &lt;init&gt;(com.htruong.inputmethod.latin.aL)&gt;"> <AccessPath Value="r0" Type="com.htruong.inputmethod.latin.aL" TaintSubFields="true"> <Fields> <Field Value="&lt;com.htruong.inputmethod.latin.D: android.content.Context a&gt;" Type="com.htruong.inputmethod.latin.LatinIME" /> <Field Value="&lt;com.htruong.inputmethod.latin.LatinIME: com.htruong.inputmethod.latin.Suggest m&gt;" Type="com.htruong.inputmethod.latin.Suggest" /> <Field Value="&lt;com.htruong.inputmethod.latin.Suggest: java.util.concurrent.ConcurrentHashMap g&gt;" Type="java.util.concurrent.ConcurrentHashMap" /> <Field Value="&lt;java.util.Map: java.lang.Object[] values&gt;" Type="java.lang.Object[]" /> </Fields> </AccessPath> </PathElement> <PathElement Statement="return" Method="&lt;com.htruong.inputmethod.latin.aL: void &lt;init&gt;(android.content.Context,java.util.Locale)&gt;"> <AccessPath Value="$r3" Type="com.htruong.inputmethod.latin.aL" TaintSubFields="true"> <Fields> <Field Value="&lt;com.htruong.inputmethod.latin.D: android.content.Context a&gt;" Type="com.htruong.inputmethod.latin.LatinIME" /> <Field Value="&lt;com.htruong.inputmethod.latin.LatinIME: com.htruong.inputmethod.latin.Suggest m&gt;" Type="com.htruong.inputmethod.latin.Suggest" /> <Field Value="&lt;com.htruong.inputmethod.latin.Suggest: java.util.concurrent.ConcurrentHashMap g&gt;" Type="java.util.concurrent.ConcurrentHashMap" /> <Field Value="&lt;java.util.Map: java.lang.Object[] values&gt;" Type="java.lang.Object[]" /> </Fields> </AccessPath> </PathElement> <PathElement Statement="r0.&lt;com.htruong.inputmethod.latin.Suggest: com.htruong.inputmethod.latin.aL e&gt; = $r3" Method="&lt;com.htruong.inputmethod.latin.Suggest: void b(android.content.Context,java.util.Locale)&gt;"> <AccessPath Value="r0" Type="com.htruong.inputmethod.latin.Suggest" TaintSubFields="true"> <Fields> <Field Value="&lt;com.htruong.inputmethod.latin.Suggest: java.util.concurrent.ConcurrentHashMap g&gt;" Type="java.util.concurrent.ConcurrentHashMap" /> <Field Value="&lt;java.util.Map: java.lang.Object[] values&gt;" Type="java.lang.Object[]" /> </Fields> </AccessPath> </PathElement> <PathElement Statement="return" Method="&lt;com.htruong.inputmethod.latin.Suggest: void b(android.content.Context,java.util.Locale)&gt;"> <AccessPath Value="r0" Type="com.htruong.inputmethod.latin.Suggest" TaintSubFields="true"> <Fields> <Field Value="&lt;com.htruong.inputmethod.latin.Suggest: java.util.concurrent.ConcurrentHashMap g&gt;" Type="java.util.concurrent.ConcurrentHashMap" /> <Field Value="&lt;java.util.Map: java.lang.Object[] values&gt;" Type="java.lang.Object[]" /> </Fields> </AccessPath> </PathElement> <PathElement Statement="return" Method="&lt;com.htruong.inputmethod.latin.Suggest: void &lt;init&gt;(android.content.Context,java.util.Locale)&gt;"> <AccessPath Value="$r4" Type="com.htruong.inputmethod.latin.Suggest" TaintSubFields="true"> <Fields> <Field Value="&lt;com.htruong.inputmethod.latin.Suggest: java.util.concurrent.ConcurrentHashMap g&gt;" Type="java.util.concurrent.ConcurrentHashMap" /> <Field Value="&lt;java.util.Map: java.lang.Object[] values&gt;" Type="java.lang.Object[]" /> </Fields> </AccessPath> </PathElement> <PathElement Statement="r0.&lt;com.htruong.inputmethod.latin.LatinIME: com.htruong.inputmethod.latin.Suggest m&gt; = $r4" Method="&lt;com.htruong.inputmethod.latin.LatinIME: void h()&gt;"> <AccessPath Value="r0" Type="com.htruong.inputmethod.latin.LatinIME" TaintSubFields="true"> <Fields> <Field Value="&lt;com.htruong.inputmethod.latin.LatinIME: com.htruong.inputmethod.latin.Suggest m&gt;" Type="com.htruong.inputmethod.latin.Suggest" /> <Field Value="&lt;com.htruong.inputmethod.latin.Suggest: java.util.concurrent.ConcurrentHashMap g&gt;" Type="java.util.concurrent.ConcurrentHashMap" /> <Field Value="&lt;java.util.Map: java.lang.Object[] values&gt;" Type="java.lang.Object[]" /> </Fields> </AccessPath> </PathElement> <PathElement Statement="specialinvoke $r7.&lt;com.htruong.inputmethod.latin.aw: void &lt;init&gt;(android.content.Context,java.lang.String)&gt;(r0, $r3)" Method="&lt;com.htruong.inputmethod.latin.LatinIME: void h()&gt;"> <AccessPath Value="$r1" Type="com.htruong.inputmethod.latin.LatinIME" TaintSubFields="true"> <Fields> <Field Value="&lt;com.htruong.inputmethod.latin.LatinIME: com.htruong.inputmethod.latin.Suggest m&gt;" Type="com.htruong.inputmethod.latin.Suggest" /> <Field Value="&lt;com.htruong.inputmethod.latin.Suggest: java.util.concurrent.ConcurrentHashMap g&gt;" Type="java.util.concurrent.ConcurrentHashMap" /> <Field Value="&lt;java.util.Map: java.lang.Object[] values&gt;" Type="java.lang.Object[]" /> </Fields> </AccessPath> </PathElement> <PathElement Statement="specialinvoke r0.&lt;com.htruong.inputmethod.latin.aw: void &lt;init&gt;(android.content.Context,java.lang.String,boolean)&gt;($r1, $r2, 0)" Method="&lt;com.htruong.inputmethod.latin.aw: void &lt;init&gt;(android.content.Context,java.lang.String)&gt;"> <AccessPath Value="$r1" Type="com.htruong.inputmethod.latin.LatinIME" TaintSubFields="true"> <Fields> <Field Value="&lt;com.htruong.inputmethod.latin.LatinIME: com.htruong.inputmethod.latin.Suggest m&gt;" Type="com.htruong.inputmethod.latin.Suggest" /> <Field Value="&lt;com.htruong.inputmethod.latin.Suggest: java.util.concurrent.ConcurrentHashMap g&gt;" Type="java.util.concurrent.ConcurrentHashMap" /> <Field Value="&lt;java.util.Map: java.lang.Object[] values&gt;" Type="java.lang.Object[]" /> </Fields> </AccessPath> </PathElement> <PathElement Statement="specialinvoke r0.&lt;com.htruong.inputmethod.latin.A: void &lt;init&gt;(android.content.Context,java.lang.String,int)&gt;($r1, $r4, 2)" Method="&lt;com.htruong.inputmethod.latin.aw: void &lt;init&gt;(android.content.Context,java.lang.String,boolean)&gt;"> <AccessPath Value="$r1" Type="com.htruong.inputmethod.latin.LatinIME" TaintSubFields="true"> <Fields> <Field Value="&lt;com.htruong.inputmethod.latin.LatinIME: com.htruong.inputmethod.latin.Suggest m&gt;" Type="com.htruong.inputmethod.latin.Suggest" /> <Field Value="&lt;com.htruong.inputmethod.latin.Suggest: java.util.concurrent.ConcurrentHashMap g&gt;" Type="java.util.concurrent.ConcurrentHashMap" /> <Field Value="&lt;java.util.Map: java.lang.Object[] values&gt;" Type="java.lang.Object[]" /> </Fields> </AccessPath> </PathElement> <PathElement Statement="return" Method="&lt;com.htruong.inputmethod.latin.A: void &lt;init&gt;(android.content.Context,java.lang.String,int)&gt;"> <AccessPath Value="$r1" Type="com.htruong.inputmethod.latin.LatinIME" TaintSubFields="true"> <Fields> <Field Value="&lt;com.htruong.inputmethod.latin.LatinIME: com.htruong.inputmethod.latin.Suggest m&gt;" Type="com.htruong.inputmethod.latin.Suggest" /> <Field Value="&lt;com.htruong.inputmethod.latin.Suggest: java.util.concurrent.ConcurrentHashMap g&gt;" Type="java.util.concurrent.ConcurrentHashMap" /> <Field Value="&lt;java.util.Map: java.lang.Object[] values&gt;" Type="java.lang.Object[]" /> </Fields> </AccessPath> </PathElement> <PathElement Statement="throw $r5" Method="&lt;com.htruong.inputmethod.latin.aw: void &lt;init&gt;(android.content.Context,java.lang.String,boolean)&gt;"> <AccessPath Value="$r1" Type="com.htruong.inputmethod.latin.LatinIME" TaintSubFields="true"> <Fields> <Field Value="&lt;com.htruong.inputmethod.latin.LatinIME: com.htruong.inputmethod.latin.Suggest m&gt;" Type="com.htruong.inputmethod.latin.Suggest" /> <Field Value="&lt;com.htruong.inputmethod.latin.Suggest: java.util.concurrent.ConcurrentHashMap g&gt;" Type="java.util.concurrent.ConcurrentHashMap" /> <Field Value="&lt;java.util.Map: java.lang.Object[] values&gt;" Type="java.lang.Object[]" /> </Fields> </AccessPath> </PathElement> <PathElement Statement="return" Method="&lt;com.htruong.inputmethod.latin.aw: void &lt;init&gt;(android.content.Context,java.lang.String)&gt;"> <AccessPath Value="r0" Type="com.htruong.inputmethod.latin.LatinIME" TaintSubFields="true"> <Fields> <Field Value="&lt;com.htruong.inputmethod.latin.LatinIME: com.htruong.inputmethod.latin.Suggest m&gt;" Type="com.htruong.inputmethod.latin.Suggest" /> <Field Value="&lt;com.htruong.inputmethod.latin.Suggest: java.util.concurrent.ConcurrentHashMap g&gt;" Type="java.util.concurrent.ConcurrentHashMap" /> <Field Value="&lt;java.util.Map: java.lang.Object[] values&gt;" Type="java.lang.Object[]" /> </Fields> </AccessPath> </PathElement> <PathElement Statement="specialinvoke r0.&lt;com.htruong.inputmethod.latin.LatinIME: void a(com.htruong.inputmethod.latin.t)&gt;($r5)" Method="&lt;com.htruong.inputmethod.latin.LatinIME: void h()&gt;"> <AccessPath Value="r0" Type="com.htruong.inputmethod.latin.LatinIME" TaintSubFields="true"> <Fields> <Field Value="&lt;com.htruong.inputmethod.latin.LatinIME: com.htruong.inputmethod.latin.Suggest m&gt;" Type="com.htruong.inputmethod.latin.Suggest" /> <Field Value="&lt;com.htruong.inputmethod.latin.Suggest: java.util.concurrent.ConcurrentHashMap g&gt;" Type="java.util.concurrent.ConcurrentHashMap" /> <Field Value="&lt;java.util.Map: java.lang.Object[] values&gt;" Type="java.lang.Object[]" /> </Fields> </AccessPath> </PathElement> <PathElement Statement="specialinvoke $r5.&lt;com.htruong.inputmethod.latin.q: void &lt;init&gt;(android.content.Context,int,java.util.Locale)&gt;(r0, 4, $r1)" Method="&lt;com.htruong.inputmethod.latin.LatinIME: void a(com.htruong.inputmethod.latin.t)&gt;"> <AccessPath Value="$r1" Type="com.htruong.inputmethod.latin.LatinIME" TaintSubFields="true"> <Fields> <Field Value="&lt;com.htruong.inputmethod.latin.LatinIME: com.htruong.inputmethod.latin.Suggest m&gt;" Type="com.htruong.inputmethod.latin.Suggest" /> <Field Value="&lt;com.htruong.inputmethod.latin.Suggest: java.util.concurrent.ConcurrentHashMap g&gt;" Type="java.util.concurrent.ConcurrentHashMap" /> <Field Value="&lt;java.util.Map: java.lang.Object[] values&gt;" Type="java.lang.Object[]" /> </Fields> </AccessPath> </PathElement> <PathElement Statement="specialinvoke r0.&lt;com.htruong.inputmethod.latin.A: void &lt;init&gt;(android.content.Context,java.lang.String,int)&gt;($r1, $r3, 4)" Method="&lt;com.htruong.inputmethod.latin.q: void &lt;init&gt;(android.content.Context,int,java.util.Locale)&gt;"> <AccessPath Value="$r1" Type="com.htruong.inputmethod.latin.LatinIME" TaintSubFields="true"> <Fields> <Field Value="&lt;com.htruong.inputmethod.latin.LatinIME: com.htruong.inputmethod.latin.Suggest m&gt;" Type="com.htruong.inputmethod.latin.Suggest" /> <Field Value="&lt;com.htruong.inputmethod.latin.Suggest: java.util.concurrent.ConcurrentHashMap g&gt;" Type="java.util.concurrent.ConcurrentHashMap" /> <Field Value="&lt;java.util.Map: java.lang.Object[] values&gt;" Type="java.lang.Object[]" /> </Fields> </AccessPath> </PathElement> <PathElement Statement="return" Method="&lt;com.htruong.inputmethod.latin.A: void &lt;init&gt;(android.content.Context,java.lang.String,int)&gt;"> <AccessPath Value="$r1" Type="com.htruong.inputmethod.latin.LatinIME" TaintSubFields="true"> <Fields> <Field Value="&lt;com.htruong.inputmethod.latin.LatinIME: com.htruong.inputmethod.latin.Suggest m&gt;" Type="com.htruong.inputmethod.latin.Suggest" /> <Field Value="&lt;com.htruong.inputmethod.latin.Suggest: java.util.concurrent.ConcurrentHashMap g&gt;" Type="java.util.concurrent.ConcurrentHashMap" /> <Field Value="&lt;java.util.Map: java.lang.Object[] values&gt;" Type="java.lang.Object[]" /> </Fields> </AccessPath> </PathElement> <PathElement Statement="specialinvoke r0.&lt;com.htruong.inputmethod.latin.q: void b(android.content.Context)&gt;($r1)" Method="&lt;com.htruong.inputmethod.latin.q: void &lt;init&gt;(android.content.Context,int,java.util.Locale)&gt;"> <AccessPath Value="$r1" Type="com.htruong.inputmethod.latin.LatinIME" TaintSubFields="true"> <Fields> <Field Value="&lt;com.htruong.inputmethod.latin.LatinIME: com.htruong.inputmethod.latin.Suggest m&gt;" Type="com.htruong.inputmethod.latin.Suggest" /> <Field Value="&lt;com.htruong.inputmethod.latin.Suggest: java.util.concurrent.ConcurrentHashMap g&gt;" Type="java.util.concurrent.ConcurrentHashMap" /> <Field Value="&lt;java.util.Map: java.lang.Object[] values&gt;" Type="java.lang.Object[]" /> </Fields> </AccessPath> </PathElement> <PathElement Statement="throw $r6" Method="&lt;com.htruong.inputmethod.latin.q: void b(android.content.Context)&gt;"> <AccessPath Value="$r1" Type="com.htruong.inputmethod.latin.LatinIME" TaintSubFields="true"> <Fields> <Field Value="&lt;com.htruong.inputmethod.latin.LatinIME: com.htruong.inputmethod.latin.Suggest m&gt;" Type="com.htruong.inputmethod.latin.Suggest" /> <Field Value="&lt;com.htruong.inputmethod.latin.Suggest: java.util.concurrent.ConcurrentHashMap g&gt;" Type="java.util.concurrent.ConcurrentHashMap" /> <Field Value="&lt;java.util.Map: java.lang.Object[] values&gt;" Type="java.lang.Object[]" /> </Fields> </AccessPath> </PathElement> <PathElement Statement="return" Method="&lt;com.htruong.inputmethod.latin.q: void &lt;init&gt;(android.content.Context,int,java.util.Locale)&gt;"> <AccessPath Value="r0" Type="com.htruong.inputmethod.latin.LatinIME" TaintSubFields="true"> <Fields> <Field Value="&lt;com.htruong.inputmethod.latin.LatinIME: com.htruong.inputmethod.latin.Suggest m&gt;" Type="com.htruong.inputmethod.latin.Suggest" /> <Field Value="&lt;com.htruong.inputmethod.latin.Suggest: java.util.concurrent.ConcurrentHashMap g&gt;" Type="java.util.concurrent.ConcurrentHashMap" /> <Field Value="&lt;java.util.Map: java.lang.Object[] values&gt;" Type="java.lang.Object[]" /> </Fields> </AccessPath> </PathElement> <PathElement Statement="return" Method="&lt;com.htruong.inputmethod.latin.LatinIME: void a(com.htruong.inputmethod.latin.t)&gt;"> <AccessPath Value="r0" Type="com.htruong.inputmethod.latin.LatinIME" TaintSubFields="true"> <Fields> <Field Value="&lt;com.htruong.inputmethod.latin.LatinIME: com.htruong.inputmethod.latin.Suggest m&gt;" Type="com.htruong.inputmethod.latin.Suggest" /> <Field Value="&lt;com.htruong.inputmethod.latin.Suggest: java.util.concurrent.ConcurrentHashMap g&gt;" Type="java.util.concurrent.ConcurrentHashMap" /> <Field Value="&lt;java.util.Map: java.lang.Object[] values&gt;" Type="java.lang.Object[]" /> </Fields> </AccessPath> </PathElement> <PathElement Statement="return" Method="&lt;com.htruong.inputmethod.latin.LatinIME: void h()&gt;"> <AccessPath Value="r0" Type="com.htruong.inputmethod.latin.LatinIME" TaintSubFields="true"> <Fields> <Field Value="&lt;com.htruong.inputmethod.latin.LatinIME: com.htruong.inputmethod.latin.Suggest m&gt;" Type="com.htruong.inputmethod.latin.Suggest" /> <Field Value="&lt;com.htruong.inputmethod.latin.Suggest: java.util.concurrent.ConcurrentHashMap g&gt;" Type="java.util.concurrent.ConcurrentHashMap" /> <Field Value="&lt;java.util.Map: java.lang.Object[] values&gt;" Type="java.lang.Object[]" /> </Fields> </AccessPath> </PathElement> <PathElement Statement="return" Method="&lt;com.htruong.inputmethod.latin.LatinIME: void onCreate()&gt;"> <AccessPath Value="$r0" Type="com.htruong.inputmethod.latin.LatinIME" TaintSubFields="true"> <Fields> <Field Value="&lt;com.htruong.inputmethod.latin.LatinIME: com.htruong.inputmethod.latin.Suggest m&gt;" Type="com.htruong.inputmethod.latin.Suggest" /> <Field Value="&lt;com.htruong.inputmethod.latin.Suggest: java.util.concurrent.ConcurrentHashMap g&gt;" Type="java.util.concurrent.ConcurrentHashMap" /> <Field Value="&lt;java.util.Map: java.lang.Object[] values&gt;" Type="java.lang.Object[]" /> </Fields> </AccessPath> </PathElement> <PathElement Statement="virtualinvoke $r0.&lt;com.htruong.inputmethod.latin.LatinIME: void setInputView(android.view.View)&gt;(null)" Method="&lt;dummyMainClass: com.htruong.inputmethod.latin.LatinIME dummyMainMethod_com_htruong_inputmethod_latin_LatinIME(android.content.Intent)&gt;"> <AccessPath Value="r0" Type="com.htruong.inputmethod.latin.LatinIME" TaintSubFields="true"> <Fields> <Field Value="&lt;com.htruong.inputmethod.latin.LatinIME: com.htruong.inputmethod.latin.Suggest m&gt;" Type="com.htruong.inputmethod.latin.Suggest" /> <Field Value="&lt;com.htruong.inputmethod.latin.Suggest: java.util.concurrent.ConcurrentHashMap g&gt;" Type="java.util.concurrent.ConcurrentHashMap" /> <Field Value="&lt;java.util.Map: java.lang.Object[] values&gt;" Type="java.lang.Object[]" /> </Fields> </AccessPath> </PathElement> <PathElement Statement="specialinvoke r0.&lt;android.inputmethodservice.InputMethodService: void setInputView(android.view.View)&gt;($r1)" Method="&lt;com.htruong.inputmethod.latin.LatinIME: void setInputView(android.view.View)&gt;"> <AccessPath Value="r0" Type="com.htruong.inputmethod.latin.LatinIME" TaintSubFields="true"> <Fields> <Field Value="&lt;com.htruong.inputmethod.latin.LatinIME: com.htruong.inputmethod.latin.Suggest m&gt;" Type="com.htruong.inputmethod.latin.Suggest" /> <Field Value="&lt;com.htruong.inputmethod.latin.Suggest: java.util.concurrent.ConcurrentHashMap g&gt;" Type="java.util.concurrent.ConcurrentHashMap" /> <Field Value="&lt;java.util.Map: java.lang.Object[] values&gt;" Type="java.lang.Object[]" /> </Fields> </AccessPath> </PathElement> </TaintPath> </Source>
param1 -> return value
private long openNative(java.lang.String, long, long, int, int, int, int) { long $p1, $p2, $4, $7, $15_phi; com.htruong.inputmethod.latin.BinaryDictionary $this; int $p3, $p4, $p5, $p6, $2, $opred; java.lang.String $p0; $this := @this; $p0 := @parameter0; $p1 := @parameter1; $p2 := @parameter2; $p3 := @parameter3; $p4 := @parameter4; $p5 := @parameter5; $p6 := @parameter6; $2 = org.example.NativeSummaryFuncs.open($p0, null, null, "", null, null, null, null); org.example.NativeSummaryFuncs.raise(8L); $4 = org.example.NativeSummaryFuncs.raise(8L); $7 = org.example.NativeSummaryFuncs.malloc(32L); org.example.NativeSummaryFuncs.malloc(148L); org.example.NativeSummaryFuncs.malloc(11344L); org.example.NativeSummaryFuncs.malloc(1840L); org.example.NativeSummaryFuncs.malloc($p6); org.example.NativeSummaryFuncs.malloc(712L); org.example.NativeSummaryFuncs.malloc(32L); org.example.NativeSummaryFuncs.close($2); $15_phi = 0; $opred = org.example.NativeSummaryAux.opaqueInt(); if $opred != 1 goto label1; $15_phi = null; goto label4; label1: if $opred != 2 goto label2; $15_phi = $4; goto label4; label2: if $opred != 3 goto label3; $15_phi = $7; goto label4; label3: if $opred != 4 goto label4; $15_phi = $p1; label4: return $15_phi; }
0 param1 -> return value propagate
com.reecedunn.espeak_21.apk Sink: <com.reecedunn.espeak.SpeechSynthesis: boolean nativeSetParameter(int,int)> staticinvoke <android.util.Log: int d(java.lang.String,java.lang.String)>("eSpeakService", $r1) Source: <com.reecedunn.espeak.VoiceSettings: int getPreferenceValue(java.lang.String,int)> $i0 = staticinvoke <java.lang.Integer: int parseInt(java.lang.String)>($r2)
https://github.com/espeak-ng/espeak-ng/blob/890071ff30231883d761e4d59edabd6d69faf159/android/jni/jni/eSpeakService.c#L265 JNIEXPORT jboolean JNICALL Java_com_reecedunn_espeak_SpeechSynthesis_nativeSetParameter( JNIEnv *env, jobject object, jint parameter, jint value) { if (DEBUG) LOGV("%s(parameter=%d, value=%d)", __FUNCTION__, parameter, value); const espeak_ERROR result = espeak_SetParameter((espeak_PARAMETER)parameter, (int)value, 0); switch (result) { case EE_OK: return JNI_TRUE; case EE_INTERNAL_ERROR: LOGE("espeak_SetParameter: internal error."); break; case EE_BUFFER_FULL: LOGE("espeak_SetParameter: buffer full."); break; case EE_NOT_FOUND: LOGE("espeak_SetParameter: not found."); break; } return JNI_FALSE; }
$z0 = specialinvoke $r0.<com.reecedunn.espeak.SpeechSynthesis: boolean nativeSetParameter(int,int)>($i0, $i1)
<Source Statement="$i0 = staticinvoke &lt;java.lang.Integer: int parseInt(java.lang.String)&gt;($r2)" Method="&lt;com.reecedunn.espeak.VoiceSettings: int getPreferenceValue(java.lang.String,int)&gt;"> <AccessPath Value="$i0" Type="int" TaintSubFields="true" /> <TaintPath> <PathElement Statement="$i0 = staticinvoke &lt;java.lang.Integer: int parseInt(java.lang.String)&gt;($r2)" Method="&lt;com.reecedunn.espeak.VoiceSettings: int getPreferenceValue(java.lang.String,int)&gt;"> <AccessPath Value="$i0" Type="int" TaintSubFields="true" /> </PathElement> <PathElement Statement="return $i0" Method="&lt;com.reecedunn.espeak.VoiceSettings: int getPreferenceValue(java.lang.String,int)&gt;"> <AccessPath Value="$i3" Type="int" TaintSubFields="true" /> </PathElement> <PathElement Statement="$i2 = $i3" Method="&lt;com.reecedunn.espeak.VoiceSettings: int getPitchRange()&gt;"> <AccessPath Value="$i2" Type="int" TaintSubFields="true" /> </PathElement> <PathElement Statement="return $i2" Method="&lt;com.reecedunn.espeak.VoiceSettings: int getPitchRange()&gt;"> <AccessPath Value="$i0" Type="int" TaintSubFields="true" /> </PathElement> <PathElement Statement="virtualinvoke $r10.&lt;com.reecedunn.espeak.SpeechSynthesis$Parameter: void setValue(int)&gt;($i0)" Method="&lt;com.reecedunn.espeak.TtsService: void onSynthesizeText(android.speech.tts.SynthesisRequest,android.speech.tts.SynthesisCallback)&gt;"> <AccessPath Value="$i0" Type="int" TaintSubFields="true" /> </PathElement> <PathElement Statement="staticinvoke &lt;com.reecedunn.espeak.SpeechSynthesis: boolean access$100(com.reecedunn.espeak.SpeechSynthesis,int,int)&gt;($r1, $i1, $i0)" Method="&lt;com.reecedunn.espeak.SpeechSynthesis$Parameter: void setValue(int)&gt;"> <AccessPath Value="$i1" Type="int" TaintSubFields="true" /> </PathElement> <PathElement Statement="$z0 = specialinvoke $r0.&lt;com.reecedunn.espeak.SpeechSynthesis: boolean nativeSetParameter(int,int)&gt;($i0, $i1)" Method="&lt;com.reecedunn.espeak.SpeechSynthesis: boolean access$100(com.reecedunn.espeak.SpeechSynthesis,int,int)&gt;"> <AccessPath Value="$i1" Type="int" TaintSubFields="true" /> </PathElement> <PathElement Statement="$r2 = staticinvoke &lt;java.lang.Integer: java.lang.Integer valueOf(int)&gt;($i1)" Method="&lt;com.reecedunn.espeak.SpeechSynthesis: boolean nativeSetParameter(int,int)&gt;"> <AccessPath Value="$r2" Type="java.lang.Integer" TaintSubFields="true" /> </PathElement> <PathElement Statement="$r1 = virtualinvoke $r2.&lt;java.lang.Integer: java.lang.String toString()&gt;()" Method="&lt;com.reecedunn.espeak.SpeechSynthesis: boolean nativeSetParameter(int,int)&gt;"> <AccessPath Value="$r1" Type="java.lang.String" TaintSubFields="true" /> </PathElement> <PathElement Statement="staticinvoke &lt;android.util.Log: int d(java.lang.String,java.lang.String)&gt;(&quot;eSpeakService&quot;, $r1)" Method="&lt;com.reecedunn.espeak.SpeechSynthesis: boolean nativeSetParameter(int,int)&gt;"> <AccessPath Value="$r1" Type="java.lang.String" TaintSubFields="true" /> </PathElement> </TaintPath> </Source>
param1 -> log
private final boolean nativeSetParameter(int, int) { java.lang.Integer boxed, boxed, boxed; int $p0, $p1, $opred; java.lang.String $0_phi, $casted, $casted, $5_phi, $casted; com.reecedunn.espeak.SpeechSynthesis $this; boolean $9_phi; $this := @this; $p0 := @parameter0; $p1 := @parameter1; $0_phi = null; $opred = org.example.NativeSummaryAux.opaqueInt(); if $opred != 1 goto label01; boxed = java.lang.Integer.valueOf($p0); $casted = virtualinvoke boxed.toString(); $0_phi = $casted; goto label04; label01: if $opred != 2 goto label02; $0_phi = "Java_com_reecedunn_espeak_SpeechSynthesis_nativeSetParameter"; goto label04; label02: if $opred != 3 goto label03; $0_phi = "%s(parameter=%d, value=%d)"; goto label04; label03: if $opred != 4 goto label04; boxed = java.lang.Integer.valueOf($p1); $casted = virtualinvoke boxed.toString(); $0_phi = $casted; label04: android.util.Log.d("eSpeakService", $0_phi); $5_phi = null; if $opred != 5 goto label05; $5_phi = "espeak_SetParameter: buffer full."; goto label08; label05: if $opred != 6 goto label06; $5_phi = "espeak_SetParameter: internal error."; goto label08; label06: if $opred != 7 goto label07; $5_phi = "espeak_SetParameter: not found."; goto label08; label07: if $opred != 8 goto label08; boxed = java.lang.Integer.valueOf($p1); $casted = virtualinvoke boxed.toString(); $5_phi = $casted; label08: android.util.Log.e("eSpeakService", $5_phi); $9_phi = 0; if $opred != 9 goto label09; $9_phi = 1L; goto label10; label09: if $opred != 10 goto label10; $9_phi = null; label10: return $9_phi; }
1 param1 number is logged in native log_sink
network.ubic.ubic_7.apk Sink: <network.ubic.ubic.Fragments.SendFragment: java.lang.String getTransaction(byte[],java.lang.String,int,long,long,int)> $i0 = staticinvoke <org.example.NativeSummaryFuncs: int GetArrayLength(java.lang.Object,byte[])>(null, $r1) Source: <network.ubic.ubic.PrivateKeyStore: byte[] getPrivateKey(android.content.Context)> $r21 = virtualinvoke $r18.<javax.crypto.Cipher: byte[] doFinal(byte[])>($r21)
https://github.com/rgex/UBIC-android-wallet/blob/98e0643159bed18ec981962295c2f52dc86921f1/app/src/main/cpp/native-lib.cpp#L243 JNICALL Java_network_ubic_ubic_Fragments_SendFragment_getTransaction( JNIEnv *env, jobject, jbyteArray seed, jstring readableAddress, jint currency, jlong amount, jlong fee, jint nonce) { Transaction tx; Wallet &wallet = Wallet::Instance(); int len = env->GetArrayLength (seed); unsigned char* seedUC = new unsigned char[len]; env->GetByteArrayRegion (seed, 0, len, reinterpret_cast<jbyte*>(seedUC)); std::vector<unsigned char> seedVector = std::vector<unsigned char>(seedUC, seedUC + 20); wallet.setSeed(seedVector); wallet.initWallet(); std::vector<TxOut> txOuts; TxOut txOut; jboolean isCopy; std::vector<unsigned char> vectorAddress = wallet.readableAddressToVectorAddress( (env)->GetStringUTFChars(readableAddress, &isCopy)); Address address; CDataStream s(SER_DISK, 1); s.write((char *) vectorAddress.data(), vectorAddress.size()); s >> address; txOut.setScript(address.getScript()); UAmount outAmount; outAmount.map.insert(std::pair<uint8_t, CAmount>((uint8_t)currency, (CAmount)amount)); txOut.setScript(address.getScript()); txOut.setAmount(outAmount); txOuts.push_back(txOut); tx.setTxOuts(txOuts); UAmount inAmount; inAmount.map.insert(std::pair<uint8_t, CAmount>((uint8_t)currency, (CAmount)(amount + (fee/5)))); // the transaction will be about 180 bytes, the fee is the fee for 1kb TxIn txIn; txIn.setNonce(nonce); txIn.setAmount(inAmount); txIn.setInAddress(AddressHelper::addressLinkFromScript(wallet.getRandomPKHScriptFromWallet())); std::vector<TxIn> txIns; txIns.push_back(txIn); tx.setTxIns(txIns); tx.setNetwork(NET_CURRENT); Transaction* signedTx = wallet.signTransaction(&tx); CDataStream s2(SER_DISK, 1); s2 << *signedTx; std::string tx64 = base64_encode((unsigned char*)s2.str().data(), (uint32_t)s2.str().size()); return env->NewStringUTF(tx64.c_str()); }
virtualinvoke $r3.<network.ubic.ubic.Fragments.SendFragment: java.lang.String getTransaction(byte[],java.lang.String,int,long,long,int)>($r24, $r6, $i0, $l1, $l2, $i3) $i0 = staticinvoke <org.example.NativeSummaryFuncs: int GetArrayLength(java.lang.Object,byte[])>(null, $r1)
<Source Statement="$r21 = virtualinvoke $r18.&lt;javax.crypto.Cipher: byte[] doFinal(byte[])&gt;($r21)" Method="&lt;network.ubic.ubic.PrivateKeyStore: byte[] getPrivateKey(android.content.Context)&gt;"> <AccessPath Value="$r21" Type="byte[]" TaintSubFields="true" /> <TaintPath> <PathElement Statement="$r21 = virtualinvoke $r18.&lt;javax.crypto.Cipher: byte[] doFinal(byte[])&gt;($r21)" Method="&lt;network.ubic.ubic.PrivateKeyStore: byte[] getPrivateKey(android.content.Context)&gt;"> <AccessPath Value="$r21" Type="byte[]" TaintSubFields="true" /> </PathElement> <PathElement Statement="return $r21" Method="&lt;network.ubic.ubic.PrivateKeyStore: byte[] getPrivateKey(android.content.Context)&gt;"> <AccessPath Value="$r24" Type="byte[]" TaintSubFields="true" /> </PathElement> <PathElement Statement="virtualinvoke $r3.&lt;network.ubic.ubic.Fragments.SendFragment: java.lang.String getTransaction(byte[],java.lang.String,int,long,long,int)&gt;($r24, $r6, $i0, $l1, $l2, $i3)" Method="&lt;network.ubic.ubic.Fragments.SendFragment$2: void onClick(android.view.View)&gt;"> <AccessPath Value="$r1" Type="byte[]" TaintSubFields="true" /> </PathElement> <PathElement Statement="$i0 = staticinvoke &lt;org.example.NativeSummaryFuncs: int GetArrayLength(java.lang.Object,byte[])&gt;(null, $r1)" Method="&lt;network.ubic.ubic.Fragments.SendFragment: java.lang.String getTransaction(byte[],java.lang.String,int,long,long,int)&gt;"> <AccessPath Value="$r1" Type="byte[]" TaintSubFields="true" /> </PathElement> </TaintPath> </Source>
param1 -> GetArrayLength
public java.lang.String getTransaction(byte[], java.lang.String, int, long, long, int) { byte[] $p0; long $p3, $p4; int $p2, $p5, $5; java.lang.String $p1; network.ubic.ubic.Fragments.SendFragment $this; $this := @this; $p0 := @parameter0; $p1 := @parameter1; $p2 := @parameter2; $p3 := @parameter3; $p4 := @parameter4; $p5 := @parameter5; org.example.NativeSummaryFuncs.__aeabi_memclr4(); org.example.NativeSummaryFuncs.malloc(132L); org.example.NativeSummaryFuncs.malloc(132L); org.example.NativeSummaryFuncs.malloc(132L); org.example.NativeSummaryFuncs.__aeabi_memclr4(); $5 = org.example.NativeSummaryFuncs.GetArrayLength(null, $p0); org.example.NativeSummaryFuncs.malloc($5); org.example.NativeSummaryFuncs.malloc($5); org.example.NativeSummaryFuncs.malloc(132L); org.example.NativeSummaryFuncs.GetByteArrayRegion(null, $p0, null, $5, null); org.example.NativeSummaryFuncs.free(null); org.example.NativeSummaryFuncs.free(null); org.example.NativeSummaryFuncs.free(null); org.example.NativeSummaryFuncs.malloc(null); org.example.NativeSummaryFuncs.malloc(null); org.example.NativeSummaryFuncs.malloc(null); org.example.NativeSummaryFuncs.malloc(null); org.example.NativeSummaryFuncs.malloc(1073741833L); org.example.NativeSummaryFuncs.malloc(1073741833L); org.example.NativeSummaryFuncs.malloc(1L); org.example.NativeSummaryFuncs.malloc(1L); org.example.NativeSummaryFuncs.malloc(null); org.example.NativeSummaryFuncs.malloc(null); org.example.NativeSummaryFuncs.free(null); org.example.NativeSummaryFuncs.free(null); org.example.NativeSummaryFuncs.free(null); org.example.NativeSummaryFuncs.free(null); org.example.NativeSummaryFuncs.free(null); org.example.NativeSummaryFuncs.free(null); org.example.NativeSummaryFuncs.free(null); org.example.NativeSummaryFuncs.free(null); org.example.NativeSummaryFuncs.free(null); org.example.NativeSummaryFuncs.free(null); org.example.NativeSummaryFuncs.free(null); org.example.NativeSummaryFuncs.free(null); org.example.NativeSummaryFuncs.malloc(null); org.example.NativeSummaryFuncs.free(null); org.example.NativeSummaryFuncs.free(null); org.example.NativeSummaryFuncs.free(null); org.example.NativeSummaryFuncs.free(null); org.example.NativeSummaryFuncs.free(null); org.example.NativeSummaryFuncs.malloc(4294967292L); org.example.NativeSummaryFuncs.free(null); org.example.NativeSummaryFuncs.free(null); org.example.NativeSummaryFuncs.free(null); org.example.NativeSummaryFuncs.free(null); org.example.NativeSummaryFuncs.raise(8L); org.example.NativeSummaryFuncs.raise(8L); org.example.NativeSummaryFuncs.raise(8L); org.example.NativeSummaryFuncs.free(null); org.example.NativeSummaryFuncs.free(null); org.example.NativeSummaryFuncs.free(null); org.example.NativeSummaryFuncs.free(null); org.example.NativeSummaryFuncs.free(null); org.example.NativeSummaryFuncs.__aeabi_memclr4(); org.example.NativeSummaryFuncs.malloc(null); org.example.NativeSummaryFuncs.malloc(null); org.example.NativeSummaryFuncs.malloc(null); org.example.NativeSummaryFuncs.malloc(null); org.example.NativeSummaryFuncs.free(null); org.example.NativeSummaryFuncs.free(null); org.example.NativeSummaryFuncs.free(null); org.example.NativeSummaryFuncs.free(null); org.example.NativeSummaryFuncs.free(null); org.example.NativeSummaryFuncs.free(null); org.example.NativeSummaryFuncs.free(null); org.example.NativeSummaryFuncs.free(null); org.example.NativeSummaryFuncs.free(null); org.example.NativeSummaryFuncs.malloc(136L); org.example.NativeSummaryFuncs.malloc(136L); org.example.NativeSummaryFuncs.malloc(136L); org.example.NativeSummaryFuncs.malloc(136L); org.example.NativeSummaryFuncs.malloc(136L); org.example.NativeSummaryFuncs.free(null); org.example.NativeSummaryFuncs.free(null); org.example.NativeSummaryFuncs.free(null); org.example.NativeSummaryFuncs.__aeabi_memclr4(); org.example.NativeSummaryFuncs.free(null); org.example.NativeSummaryFuncs.free(null); org.example.NativeSummaryFuncs.free(null); org.example.NativeSummaryFuncs.__aeabi_memclr4(); org.example.NativeSummaryFuncs.raise(8L); org.example.NativeSummaryFuncs.__aeabi_memclr4(); org.example.NativeSummaryFuncs.raise(8L); org.example.NativeSummaryFuncs.free(null); org.example.NativeSummaryFuncs.free(null); org.example.NativeSummaryFuncs.free(null); org.example.NativeSummaryFuncs.free(null); org.example.NativeSummaryFuncs.free(null); org.example.NativeSummaryFuncs.free(null); org.example.NativeSummaryFuncs.free(null); org.example.NativeSummaryFuncs.free(null); org.example.NativeSummaryFuncs.free(null); org.example.NativeSummaryFuncs.malloc(16L); org.example.NativeSummaryFuncs.malloc(16L); org.example.NativeSummaryFuncs.free(null); org.example.NativeSummaryFuncs.free(null); org.example.NativeSummaryFuncs.free(null); org.example.NativeSummaryFuncs.free(null); org.example.NativeSummaryFuncs.free(null); org.example.NativeSummaryFuncs.free(null); org.example.NativeSummaryFuncs.free(null); org.example.NativeSummaryFuncs.free(null); org.example.NativeSummaryFuncs.free(null); org.example.NativeSummaryFuncs.free(null); org.example.NativeSummaryFuncs.free(null); org.example.NativeSummaryFuncs.free(null); return null; }
1 the byte array's length is get nsfunc_sink
cc.echonet.coolmicapp_10300.apk Sink: <cc.echonet.coolmicdspjava.Wrapper: void close()> staticinvoke <android.util.Log: int d(java.lang.String,java.lang.String)>("wrapper.c", $r1) Source: <cc.echonet.coolmicapp.Configuration.ProfileBase: void <init>(android.content.Context,java.lang.String)> $r3 = virtualinvoke $r2.<android.content.Context: android.content.SharedPreferences getSharedPreferences(java.lang.String,int)>($r1, 0)
https://github.com/CoolMicApp/CoolMicApp-Android/blob/4810d260d8f405ecadb6eef92da701f20d8e3dff/app/src/main/jni/libcoolmic-dsp-java/wrapper.c#L100 JNIEXPORT void JNICALL Java_cc_echonet_coolmicdspjava_Wrapper_close(JNIEnv * env, jobject obj) { wrapper_t * wrapper = get_wrapper_t(env, obj); LOGI("start unref"); if(wrapper->coolmic_simple_obj == NULL) { LOGI("unref bailing - no core obj"); } free_wrapper_t(env, obj, &wrapper); } static wrapper_t *get_wrapper_t(JNIEnv *env, jobject obj) { jclass cls = (*env)->GetObjectClass(env, obj); jfieldID fidNativeObject = (*env)->GetFieldID(env, cls, "nativeObject", "J"); wrapper_t * wrapper = (void*)(jlong)(*env)->GetLongField(env, obj, fidNativeObject); LOGI("wrapper=%p", wrapper); if (wrapper == NULL) { wrapper = calloc(1, sizeof(wrapper_t)); wrapper->vumeter_result_class = (*env)->NewGlobalRef(env, (*env)->FindClass(env, "cc/echonet/coolmicdspjava/VUMeterResult")); wrapper->wrapper_callback_events_class = (*env)->NewGlobalRef(env, (*env)->FindClass(env, "cc/echonet/coolmicdspjava/WrapperConstants$WrapperCallbackEvents")); (*env)->SetLongField(env, obj, fidNativeObject, wrapper); } return wrapper; }
virtualinvoke $r1.<cc.echonet.coolmicdspjava.Wrapper: void close()>()
<Source Statement="$r3 = virtualinvoke $r2.&lt;android.content.Context: android.content.SharedPreferences getSharedPreferences(java.lang.String,int)&gt;($r1, 0)" Method="&lt;cc.echonet.coolmicapp.Configuration.ProfileBase: void &lt;init&gt;(android.content.Context,java.lang.String)&gt;"> <AccessPath Value="$r3" Type="android.content.SharedPreferences" TaintSubFields="true" /> <TaintPath> <PathElement Statement="$r3 = virtualinvoke $r2.&lt;android.content.Context: android.content.SharedPreferences getSharedPreferences(java.lang.String,int)&gt;($r1, 0)" Method="&lt;cc.echonet.coolmicapp.Configuration.ProfileBase: void &lt;init&gt;(android.content.Context,java.lang.String)&gt;"> <AccessPath Value="$r3" Type="android.content.SharedPreferences" TaintSubFields="true" /> </PathElement> <PathElement Statement="r0.&lt;cc.echonet.coolmicapp.Configuration.ProfileBase: android.content.SharedPreferences prefs&gt; = $r3" Method="&lt;cc.echonet.coolmicapp.Configuration.ProfileBase: void &lt;init&gt;(android.content.Context,java.lang.String)&gt;"> <AccessPath Value="r0" Type="cc.echonet.coolmicapp.Configuration.ProfileBase" TaintSubFields="true"> <Fields> <Field Value="&lt;cc.echonet.coolmicapp.Configuration.ProfileBase: android.content.SharedPreferences prefs&gt;" Type="android.content.SharedPreferences" /> </Fields> </AccessPath> </PathElement> <PathElement Statement="return" Method="&lt;cc.echonet.coolmicapp.Configuration.ProfileBase: void &lt;init&gt;(android.content.Context,java.lang.String)&gt;"> <AccessPath Value="r0" Type="cc.echonet.coolmicapp.Configuration.Profile" TaintSubFields="true"> <Fields> <Field Value="&lt;cc.echonet.coolmicapp.Configuration.ProfileBase: android.content.SharedPreferences prefs&gt;" Type="android.content.SharedPreferences" /> </Fields> </AccessPath> </PathElement> <PathElement Statement="return" Method="&lt;cc.echonet.coolmicapp.Configuration.Profile: void &lt;init&gt;(android.content.Context,java.lang.String)&gt;"> <AccessPath Value="$r2" Type="cc.echonet.coolmicapp.Configuration.Profile" TaintSubFields="true"> <Fields> <Field Value="&lt;cc.echonet.coolmicapp.Configuration.ProfileBase: android.content.SharedPreferences prefs&gt;" Type="android.content.SharedPreferences" /> </Fields> </AccessPath> </PathElement> <PathElement Statement="return $r2" Method="&lt;cc.echonet.coolmicapp.Configuration.Manager: cc.echonet.coolmicapp.Configuration.Profile getProfile(java.lang.String)&gt;"> <AccessPath Value="$r3" Type="cc.echonet.coolmicapp.Configuration.Profile" TaintSubFields="true"> <Fields> <Field Value="&lt;cc.echonet.coolmicapp.Configuration.ProfileBase: android.content.SharedPreferences prefs&gt;" Type="android.content.SharedPreferences" /> </Fields> </AccessPath> </PathElement> <PathElement Statement="return $r3" Method="&lt;cc.echonet.coolmicapp.Configuration.Manager: cc.echonet.coolmicapp.Configuration.Profile getCurrentProfile()&gt;"> <AccessPath Value="$r1" Type="cc.echonet.coolmicapp.Configuration.Profile" TaintSubFields="true"> <Fields> <Field Value="&lt;cc.echonet.coolmicapp.Configuration.ProfileBase: android.content.SharedPreferences prefs&gt;" Type="android.content.SharedPreferences" /> </Fields> </AccessPath> </PathElement> <PathElement Statement="specialinvoke $r4.&lt;cc.echonet.coolmicapp.BackgroundService.Server.Driver: void &lt;init&gt;(android.content.Context,cc.echonet.coolmicapp.Configuration.Profile,cc.echonet.coolmicdspjava.CallbackHandler)&gt;(r0, $r1, r0)" Method="&lt;cc.echonet.coolmicapp.BackgroundService.Server.Server: void attachBaseContext(android.content.Context)&gt;"> <AccessPath Value="$r4" Type="cc.echonet.coolmicapp.Configuration.Profile" TaintSubFields="true"> <Fields> <Field Value="&lt;cc.echonet.coolmicapp.Configuration.ProfileBase: android.content.SharedPreferences prefs&gt;" Type="android.content.SharedPreferences" /> </Fields> </AccessPath> </PathElement> <PathElement Statement="r0.&lt;cc.echonet.coolmicapp.BackgroundService.Server.Driver: cc.echonet.coolmicapp.Configuration.Profile profile&gt; = $r4" Method="&lt;cc.echonet.coolmicapp.BackgroundService.Server.Driver: void &lt;init&gt;(android.content.Context,cc.echonet.coolmicapp.Configuration.Profile,cc.echonet.coolmicdspjava.CallbackHandler)&gt;"> <AccessPath Value="r0" Type="cc.echonet.coolmicapp.BackgroundService.Server.Driver" TaintSubFields="true"> <Fields> <Field Value="&lt;cc.echonet.coolmicapp.BackgroundService.Server.Driver: cc.echonet.coolmicapp.Configuration.Profile profile&gt;" Type="cc.echonet.coolmicapp.Configuration.Profile" /> <Field Value="&lt;cc.echonet.coolmicapp.Configuration.ProfileBase: android.content.SharedPreferences prefs&gt;" Type="android.content.SharedPreferences" /> </Fields> </AccessPath> </PathElement> <PathElement Statement="specialinvoke r0.&lt;cc.echonet.coolmicapp.BackgroundService.Server.Driver: cc.echonet.coolmicdspjava.WrapperConstants$WrapperInitializationStatus initWrapper()&gt;()" Method="&lt;cc.echonet.coolmicapp.BackgroundService.Server.Driver: void &lt;init&gt;(android.content.Context,cc.echonet.coolmicapp.Configuration.Profile,cc.echonet.coolmicdspjava.CallbackHandler)&gt;"> <AccessPath Value="r0" Type="cc.echonet.coolmicapp.BackgroundService.Server.Driver" TaintSubFields="true"> <Fields> <Field Value="&lt;cc.echonet.coolmicapp.BackgroundService.Server.Driver: cc.echonet.coolmicapp.Configuration.Profile profile&gt;" Type="cc.echonet.coolmicapp.Configuration.Profile" /> <Field Value="&lt;cc.echonet.coolmicapp.Configuration.ProfileBase: android.content.SharedPreferences prefs&gt;" Type="android.content.SharedPreferences" /> </Fields> </AccessPath> </PathElement> <PathElement Statement="return $r2" Method="&lt;cc.echonet.coolmicapp.BackgroundService.Server.Driver: cc.echonet.coolmicdspjava.WrapperConstants$WrapperInitializationStatus initWrapper()&gt;"> <AccessPath Value="r0" Type="cc.echonet.coolmicapp.BackgroundService.Server.Driver" TaintSubFields="true"> <Fields> <Field Value="&lt;cc.echonet.coolmicapp.BackgroundService.Server.Driver: cc.echonet.coolmicapp.Configuration.Profile profile&gt;" Type="cc.echonet.coolmicapp.Configuration.Profile" /> <Field Value="&lt;cc.echonet.coolmicapp.Configuration.ProfileBase: android.content.SharedPreferences prefs&gt;" Type="android.content.SharedPreferences" /> </Fields> </AccessPath> </PathElement> <PathElement Statement="return" Method="&lt;cc.echonet.coolmicapp.BackgroundService.Server.Driver: void &lt;init&gt;(android.content.Context,cc.echonet.coolmicapp.Configuration.Profile,cc.echonet.coolmicdspjava.CallbackHandler)&gt;"> <AccessPath Value="$r4" Type="cc.echonet.coolmicapp.BackgroundService.Server.Driver" TaintSubFields="true"> <Fields> <Field Value="&lt;cc.echonet.coolmicapp.BackgroundService.Server.Driver: cc.echonet.coolmicapp.Configuration.Profile profile&gt;" Type="cc.echonet.coolmicapp.Configuration.Profile" /> <Field Value="&lt;cc.echonet.coolmicapp.Configuration.ProfileBase: android.content.SharedPreferences prefs&gt;" Type="android.content.SharedPreferences" /> </Fields> </AccessPath> </PathElement> <PathElement Statement="r0.&lt;cc.echonet.coolmicapp.BackgroundService.Server.Server: cc.echonet.coolmicapp.BackgroundService.Server.Driver driver&gt; = $r4" Method="&lt;cc.echonet.coolmicapp.BackgroundService.Server.Server: void attachBaseContext(android.content.Context)&gt;"> <AccessPath Value="r0" Type="cc.echonet.coolmicapp.BackgroundService.Server.Server" TaintSubFields="true"> <Fields> <Field Value="&lt;cc.echonet.coolmicapp.BackgroundService.Server.Server: cc.echonet.coolmicapp.BackgroundService.Server.Driver driver&gt;" Type="cc.echonet.coolmicapp.BackgroundService.Server.Driver" /> <Field Value="&lt;cc.echonet.coolmicapp.BackgroundService.Server.Driver: cc.echonet.coolmicapp.Configuration.Profile profile&gt;" Type="cc.echonet.coolmicapp.Configuration.Profile" /> <Field Value="&lt;cc.echonet.coolmicapp.Configuration.ProfileBase: android.content.SharedPreferences prefs&gt;" Type="android.content.SharedPreferences" /> </Fields> </AccessPath> </PathElement> <PathElement Statement="return" Method="&lt;cc.echonet.coolmicapp.BackgroundService.Server.Server: void attachBaseContext(android.content.Context)&gt;"> <AccessPath Value="$r0" Type="cc.echonet.coolmicapp.BackgroundService.Server.Server" TaintSubFields="true"> <Fields> <Field Value="&lt;cc.echonet.coolmicapp.BackgroundService.Server.Server: cc.echonet.coolmicapp.BackgroundService.Server.Driver driver&gt;" Type="cc.echonet.coolmicapp.BackgroundService.Server.Driver" /> <Field Value="&lt;cc.echonet.coolmicapp.BackgroundService.Server.Driver: cc.echonet.coolmicapp.Configuration.Profile profile&gt;" Type="cc.echonet.coolmicapp.Configuration.Profile" /> <Field Value="&lt;cc.echonet.coolmicapp.Configuration.ProfileBase: android.content.SharedPreferences prefs&gt;" Type="android.content.SharedPreferences" /> </Fields> </AccessPath> </PathElement> <PathElement Statement="virtualinvoke $r0.&lt;cc.echonet.coolmicapp.BackgroundService.Server.Server: void attachBaseContext(android.content.Context)&gt;($r0)" Method="&lt;dummyMainClass: cc.echonet.coolmicapp.BackgroundService.Server.Server dummyMainMethod_cc_echonet_coolmicapp_BackgroundService_Server_Server(android.content.Intent)&gt;"> <AccessPath Value="r0" Type="cc.echonet.coolmicapp.BackgroundService.Server.Server" TaintSubFields="true"> <Fields> <Field Value="&lt;cc.echonet.coolmicapp.BackgroundService.Server.Server: cc.echonet.coolmicapp.BackgroundService.Server.Driver driver&gt;" Type="cc.echonet.coolmicapp.BackgroundService.Server.Driver" /> <Field Value="&lt;cc.echonet.coolmicapp.BackgroundService.Server.Driver: cc.echonet.coolmicapp.Configuration.Profile profile&gt;" Type="cc.echonet.coolmicapp.Configuration.Profile" /> <Field Value="&lt;cc.echonet.coolmicapp.Configuration.ProfileBase: android.content.SharedPreferences prefs&gt;" Type="android.content.SharedPreferences" /> </Fields> </AccessPath> </PathElement> <PathElement Statement="specialinvoke $r3.&lt;cc.echonet.coolmicapp.Configuration.Manager: void &lt;init&gt;(android.content.Context)&gt;(r0)" Method="&lt;cc.echonet.coolmicapp.BackgroundService.Server.Server: void attachBaseContext(android.content.Context)&gt;"> <AccessPath Value="$r1" Type="cc.echonet.coolmicapp.BackgroundService.Server.Server" TaintSubFields="true"> <Fields> <Field Value="&lt;cc.echonet.coolmicapp.BackgroundService.Server.Server: cc.echonet.coolmicapp.BackgroundService.Server.Driver driver&gt;" Type="cc.echonet.coolmicapp.BackgroundService.Server.Driver" /> <Field Value="&lt;cc.echonet.coolmicapp.BackgroundService.Server.Driver: cc.echonet.coolmicapp.Configuration.Profile profile&gt;" Type="cc.echonet.coolmicapp.Configuration.Profile" /> <Field Value="&lt;cc.echonet.coolmicapp.Configuration.ProfileBase: android.content.SharedPreferences prefs&gt;" Type="android.content.SharedPreferences" /> </Fields> </AccessPath> </PathElement> <PathElement Statement="specialinvoke $r2.&lt;cc.echonet.coolmicapp.Configuration.GlobalConfiguration: void &lt;init&gt;(android.content.Context)&gt;($r1)" Method="&lt;cc.echonet.coolmicapp.Configuration.Manager: void &lt;init&gt;(android.content.Context)&gt;"> <AccessPath Value="$r2" Type="cc.echonet.coolmicapp.BackgroundService.Server.Server" TaintSubFields="true"> <Fields> <Field Value="&lt;cc.echonet.coolmicapp.BackgroundService.Server.Server: cc.echonet.coolmicapp.BackgroundService.Server.Driver driver&gt;" Type="cc.echonet.coolmicapp.BackgroundService.Server.Driver" /> <Field Value="&lt;cc.echonet.coolmicapp.BackgroundService.Server.Driver: cc.echonet.coolmicapp.Configuration.Profile profile&gt;" Type="cc.echonet.coolmicapp.Configuration.Profile" /> <Field Value="&lt;cc.echonet.coolmicapp.Configuration.ProfileBase: android.content.SharedPreferences prefs&gt;" Type="android.content.SharedPreferences" /> </Fields> </AccessPath> </PathElement> <PathElement Statement="r0.&lt;cc.echonet.coolmicapp.Configuration.GlobalConfiguration: android.content.Context context&gt; = $r2" Method="&lt;cc.echonet.coolmicapp.Configuration.GlobalConfiguration: void &lt;init&gt;(android.content.Context)&gt;"> <AccessPath Value="r0" Type="cc.echonet.coolmicapp.Configuration.GlobalConfiguration" TaintSubFields="true"> <Fields> <Field Value="&lt;cc.echonet.coolmicapp.Configuration.GlobalConfiguration: android.content.Context context&gt;" Type="cc.echonet.coolmicapp.BackgroundService.Server.Server" /> <Field Value="&lt;cc.echonet.coolmicapp.BackgroundService.Server.Server: cc.echonet.coolmicapp.BackgroundService.Server.Driver driver&gt;" Type="cc.echonet.coolmicapp.BackgroundService.Server.Driver" /> <Field Value="&lt;cc.echonet.coolmicapp.BackgroundService.Server.Driver: cc.echonet.coolmicapp.Configuration.Profile profile&gt;" Type="cc.echonet.coolmicapp.Configuration.Profile" /> <Field Value="&lt;cc.echonet.coolmicapp.Configuration.ProfileBase: android.content.SharedPreferences prefs&gt;" Type="android.content.SharedPreferences" /> </Fields> </AccessPath> </PathElement> <PathElement Statement="specialinvoke r0.&lt;cc.echonet.coolmicapp.Configuration.GlobalConfiguration: void setDefaults()&gt;()" Method="&lt;cc.echonet.coolmicapp.Configuration.GlobalConfiguration: void &lt;init&gt;(android.content.Context)&gt;"> <AccessPath Value="r0" Type="cc.echonet.coolmicapp.Configuration.GlobalConfiguration" TaintSubFields="true"> <Fields> <Field Value="&lt;cc.echonet.coolmicapp.Configuration.GlobalConfiguration: android.content.Context context&gt;" Type="cc.echonet.coolmicapp.BackgroundService.Server.Server" /> <Field Value="&lt;cc.echonet.coolmicapp.BackgroundService.Server.Server: cc.echonet.coolmicapp.BackgroundService.Server.Driver driver&gt;" Type="cc.echonet.coolmicapp.BackgroundService.Server.Driver" /> <Field Value="&lt;cc.echonet.coolmicapp.BackgroundService.Server.Driver: cc.echonet.coolmicapp.Configuration.Profile profile&gt;" Type="cc.echonet.coolmicapp.Configuration.Profile" /> <Field Value="&lt;cc.echonet.coolmicapp.Configuration.ProfileBase: android.content.SharedPreferences prefs&gt;" Type="android.content.SharedPreferences" /> </Fields> </AccessPath> </PathElement> <PathElement Statement="return" Method="&lt;cc.echonet.coolmicapp.Configuration.GlobalConfiguration: void setDefaults()&gt;"> <AccessPath Value="r0" Type="cc.echonet.coolmicapp.Configuration.GlobalConfiguration" TaintSubFields="true"> <Fields> <Field Value="&lt;cc.echonet.coolmicapp.Configuration.GlobalConfiguration: android.content.Context context&gt;" Type="cc.echonet.coolmicapp.BackgroundService.Server.Server" /> <Field Value="&lt;cc.echonet.coolmicapp.BackgroundService.Server.Server: cc.echonet.coolmicapp.BackgroundService.Server.Driver driver&gt;" Type="cc.echonet.coolmicapp.BackgroundService.Server.Driver" /> <Field Value="&lt;cc.echonet.coolmicapp.BackgroundService.Server.Driver: cc.echonet.coolmicapp.Configuration.Profile profile&gt;" Type="cc.echonet.coolmicapp.Configuration.Profile" /> <Field Value="&lt;cc.echonet.coolmicapp.Configuration.ProfileBase: android.content.SharedPreferences prefs&gt;" Type="android.content.SharedPreferences" /> </Fields> </AccessPath> </PathElement> <PathElement Statement="return" Method="&lt;cc.echonet.coolmicapp.Configuration.GlobalConfiguration: void &lt;init&gt;(android.content.Context)&gt;"> <AccessPath Value="$r2" Type="cc.echonet.coolmicapp.Configuration.GlobalConfiguration" TaintSubFields="true"> <Fields> <Field Value="&lt;cc.echonet.coolmicapp.Configuration.GlobalConfiguration: android.content.Context context&gt;" Type="cc.echonet.coolmicapp.BackgroundService.Server.Server" /> <Field Value="&lt;cc.echonet.coolmicapp.BackgroundService.Server.Server: cc.echonet.coolmicapp.BackgroundService.Server.Driver driver&gt;" Type="cc.echonet.coolmicapp.BackgroundService.Server.Driver" /> <Field Value="&lt;cc.echonet.coolmicapp.BackgroundService.Server.Driver: cc.echonet.coolmicapp.Configuration.Profile profile&gt;" Type="cc.echonet.coolmicapp.Configuration.Profile" /> <Field Value="&lt;cc.echonet.coolmicapp.Configuration.ProfileBase: android.content.SharedPreferences prefs&gt;" Type="android.content.SharedPreferences" /> </Fields> </AccessPath> </PathElement> <PathElement Statement="r0.&lt;cc.echonet.coolmicapp.Configuration.Manager: cc.echonet.coolmicapp.Configuration.GlobalConfiguration globalConfiguration&gt; = $r2" Method="&lt;cc.echonet.coolmicapp.Configuration.Manager: void &lt;init&gt;(android.content.Context)&gt;"> <AccessPath Value="r0" Type="cc.echonet.coolmicapp.Configuration.Manager" TaintSubFields="true"> <Fields> <Field Value="&lt;cc.echonet.coolmicapp.Configuration.Manager: cc.echonet.coolmicapp.Configuration.GlobalConfiguration globalConfiguration&gt;" Type="cc.echonet.coolmicapp.Configuration.GlobalConfiguration" /> <Field Value="&lt;cc.echonet.coolmicapp.Configuration.GlobalConfiguration: android.content.Context context&gt;" Type="cc.echonet.coolmicapp.BackgroundService.Server.Server" /> <Field Value="&lt;cc.echonet.coolmicapp.BackgroundService.Server.Server: cc.echonet.coolmicapp.BackgroundService.Server.Driver driver&gt;" Type="cc.echonet.coolmicapp.BackgroundService.Server.Driver" /> <Field Value="&lt;cc.echonet.coolmicapp.BackgroundService.Server.Driver: cc.echonet.coolmicapp.Configuration.Profile profile&gt;" Type="cc.echonet.coolmicapp.Configuration.Profile" /> <Field Value="&lt;cc.echonet.coolmicapp.Configuration.ProfileBase: android.content.SharedPreferences prefs&gt;" Type="android.content.SharedPreferences" /> </Fields> </AccessPath> </PathElement> <PathElement Statement="return" Method="&lt;cc.echonet.coolmicapp.Configuration.Manager: void &lt;init&gt;(android.content.Context)&gt;"> <AccessPath Value="$r3" Type="cc.echonet.coolmicapp.Configuration.Manager" TaintSubFields="true"> <Fields> <Field Value="&lt;cc.echonet.coolmicapp.Configuration.Manager: cc.echonet.coolmicapp.Configuration.GlobalConfiguration globalConfiguration&gt;" Type="cc.echonet.coolmicapp.Configuration.GlobalConfiguration" /> <Field Value="&lt;cc.echonet.coolmicapp.Configuration.GlobalConfiguration: android.content.Context context&gt;" Type="cc.echonet.coolmicapp.BackgroundService.Server.Server" /> <Field Value="&lt;cc.echonet.coolmicapp.BackgroundService.Server.Server: cc.echonet.coolmicapp.BackgroundService.Server.Driver driver&gt;" Type="cc.echonet.coolmicapp.BackgroundService.Server.Driver" /> <Field Value="&lt;cc.echonet.coolmicapp.BackgroundService.Server.Driver: cc.echonet.coolmicapp.Configuration.Profile profile&gt;" Type="cc.echonet.coolmicapp.Configuration.Profile" /> <Field Value="&lt;cc.echonet.coolmicapp.Configuration.ProfileBase: android.content.SharedPreferences prefs&gt;" Type="android.content.SharedPreferences" /> </Fields> </AccessPath> </PathElement> <PathElement Statement="$r1 = virtualinvoke $r3.&lt;cc.echonet.coolmicapp.Configuration.Manager: cc.echonet.coolmicapp.Configuration.Profile getCurrentProfile()&gt;()" Method="&lt;cc.echonet.coolmicapp.BackgroundService.Server.Server: void attachBaseContext(android.content.Context)&gt;"> <AccessPath Value="r0" Type="cc.echonet.coolmicapp.Configuration.Manager" TaintSubFields="true"> <Fields> <Field Value="&lt;cc.echonet.coolmicapp.Configuration.Manager: cc.echonet.coolmicapp.Configuration.GlobalConfiguration globalConfiguration&gt;" Type="cc.echonet.coolmicapp.Configuration.GlobalConfiguration" /> <Field Value="&lt;cc.echonet.coolmicapp.Configuration.GlobalConfiguration: android.content.Context context&gt;" Type="cc.echonet.coolmicapp.BackgroundService.Server.Server" /> <Field Value="&lt;cc.echonet.coolmicapp.BackgroundService.Server.Server: cc.echonet.coolmicapp.BackgroundService.Server.Driver driver&gt;" Type="cc.echonet.coolmicapp.BackgroundService.Server.Driver" /> <Field Value="&lt;cc.echonet.coolmicapp.BackgroundService.Server.Driver: cc.echonet.coolmicapp.Configuration.Profile profile&gt;" Type="cc.echonet.coolmicapp.Configuration.Profile" /> <Field Value="&lt;cc.echonet.coolmicapp.Configuration.ProfileBase: android.content.SharedPreferences prefs&gt;" Type="android.content.SharedPreferences" /> </Fields> </AccessPath> </PathElement> <PathElement Statement="$r3 = virtualinvoke r0.&lt;cc.echonet.coolmicapp.Configuration.Manager: cc.echonet.coolmicapp.Configuration.Profile getProfile(java.lang.String)&gt;($r2)" Method="&lt;cc.echonet.coolmicapp.Configuration.Manager: cc.echonet.coolmicapp.Configuration.Profile getCurrentProfile()&gt;"> <AccessPath Value="r0" Type="cc.echonet.coolmicapp.Configuration.Manager" TaintSubFields="true"> <Fields> <Field Value="&lt;cc.echonet.coolmicapp.Configuration.Manager: cc.echonet.coolmicapp.Configuration.GlobalConfiguration globalConfiguration&gt;" Type="cc.echonet.coolmicapp.Configuration.GlobalConfiguration" /> <Field Value="&lt;cc.echonet.coolmicapp.Configuration.GlobalConfiguration: android.content.Context context&gt;" Type="cc.echonet.coolmicapp.BackgroundService.Server.Server" /> <Field Value="&lt;cc.echonet.coolmicapp.BackgroundService.Server.Server: cc.echonet.coolmicapp.BackgroundService.Server.Driver driver&gt;" Type="cc.echonet.coolmicapp.BackgroundService.Server.Driver" /> <Field Value="&lt;cc.echonet.coolmicapp.BackgroundService.Server.Driver: cc.echonet.coolmicapp.Configuration.Profile profile&gt;" Type="cc.echonet.coolmicapp.Configuration.Profile" /> <Field Value="&lt;cc.echonet.coolmicapp.Configuration.ProfileBase: android.content.SharedPreferences prefs&gt;" Type="android.content.SharedPreferences" /> </Fields> </AccessPath> </PathElement> <PathElement Statement="$r3 = r0.&lt;cc.echonet.coolmicapp.Configuration.Manager: android.content.Context context&gt;" Method="&lt;cc.echonet.coolmicapp.Configuration.Manager: cc.echonet.coolmicapp.Configuration.Profile getProfile(java.lang.String)&gt;"> <AccessPath Value="$r3" Type="android.content.Context" TaintSubFields="true"> <Fields> <Field Value="&lt;cc.echonet.coolmicapp.BackgroundService.Server.Server: cc.echonet.coolmicapp.BackgroundService.Server.Driver driver&gt;" Type="cc.echonet.coolmicapp.BackgroundService.Server.Driver" /> </Fields> </AccessPath> </PathElement> <PathElement Statement="specialinvoke $r2.&lt;cc.echonet.coolmicapp.Configuration.Profile: void &lt;init&gt;(android.content.Context,java.lang.String)&gt;($r3, $r1)" Method="&lt;cc.echonet.coolmicapp.Configuration.Manager: cc.echonet.coolmicapp.Configuration.Profile getProfile(java.lang.String)&gt;"> <AccessPath Value="$r1" Type="android.content.Context" TaintSubFields="true"> <Fields> <Field Value="&lt;cc.echonet.coolmicapp.BackgroundService.Server.Server: cc.echonet.coolmicapp.BackgroundService.Server.Driver driver&gt;" Type="cc.echonet.coolmicapp.BackgroundService.Server.Driver" /> </Fields> </AccessPath> </PathElement> <PathElement Statement="specialinvoke r0.&lt;cc.echonet.coolmicapp.Configuration.ProfileBase: void &lt;init&gt;(android.content.Context,java.lang.String)&gt;($r1, $r2)" Method="&lt;cc.echonet.coolmicapp.Configuration.Profile: void &lt;init&gt;(android.content.Context,java.lang.String)&gt;"> <AccessPath Value="$r2" Type="android.content.Context" TaintSubFields="true"> <Fields> <Field Value="&lt;cc.echonet.coolmicapp.BackgroundService.Server.Server: cc.echonet.coolmicapp.BackgroundService.Server.Driver driver&gt;" Type="cc.echonet.coolmicapp.BackgroundService.Server.Driver" /> </Fields> </AccessPath> </PathElement> <PathElement Statement="r0.&lt;cc.echonet.coolmicapp.Configuration.ProfileBase: android.content.Context context&gt; = $r2" Method="&lt;cc.echonet.coolmicapp.Configuration.ProfileBase: void &lt;init&gt;(android.content.Context,java.lang.String)&gt;"> <AccessPath Value="r0" Type="cc.echonet.coolmicapp.Configuration.ProfileBase" TaintSubFields="true"> <Fields> <Field Value="&lt;cc.echonet.coolmicapp.Configuration.ProfileBase: android.content.Context context&gt;" Type="cc.echonet.coolmicapp.BackgroundService.Server.Server" /> <Field Value="&lt;cc.echonet.coolmicapp.BackgroundService.Server.Server: cc.echonet.coolmicapp.BackgroundService.Server.Driver driver&gt;" Type="cc.echonet.coolmicapp.BackgroundService.Server.Driver" /> </Fields> </AccessPath> </PathElement> <PathElement Statement="return" Method="&lt;cc.echonet.coolmicapp.Configuration.ProfileBase: void &lt;init&gt;(android.content.Context,java.lang.String)&gt;"> <AccessPath Value="r0" Type="cc.echonet.coolmicapp.Configuration.Profile" TaintSubFields="true"> <Fields> <Field Value="&lt;cc.echonet.coolmicapp.Configuration.ProfileBase: android.content.Context context&gt;" Type="cc.echonet.coolmicapp.BackgroundService.Server.Server" /> <Field Value="&lt;cc.echonet.coolmicapp.BackgroundService.Server.Server: cc.echonet.coolmicapp.BackgroundService.Server.Driver driver&gt;" Type="cc.echonet.coolmicapp.BackgroundService.Server.Driver" /> </Fields> </AccessPath> </PathElement> <PathElement Statement="return" Method="&lt;cc.echonet.coolmicapp.Configuration.Profile: void &lt;init&gt;(android.content.Context,java.lang.String)&gt;"> <AccessPath Value="$r2" Type="cc.echonet.coolmicapp.Configuration.Profile" TaintSubFields="true"> <Fields> <Field Value="&lt;cc.echonet.coolmicapp.Configuration.ProfileBase: android.content.Context context&gt;" Type="cc.echonet.coolmicapp.BackgroundService.Server.Server" /> <Field Value="&lt;cc.echonet.coolmicapp.BackgroundService.Server.Server: cc.echonet.coolmicapp.BackgroundService.Server.Driver driver&gt;" Type="cc.echonet.coolmicapp.BackgroundService.Server.Driver" /> </Fields> </AccessPath> </PathElement> <PathElement Statement="return $r2" Method="&lt;cc.echonet.coolmicapp.Configuration.Manager: cc.echonet.coolmicapp.Configuration.Profile getProfile(java.lang.String)&gt;"> <AccessPath Value="$r3" Type="cc.echonet.coolmicapp.Configuration.Profile" TaintSubFields="true"> <Fields> <Field Value="&lt;cc.echonet.coolmicapp.Configuration.ProfileBase: android.content.Context context&gt;" Type="cc.echonet.coolmicapp.BackgroundService.Server.Server" /> <Field Value="&lt;cc.echonet.coolmicapp.BackgroundService.Server.Server: cc.echonet.coolmicapp.BackgroundService.Server.Driver driver&gt;" Type="cc.echonet.coolmicapp.BackgroundService.Server.Driver" /> </Fields> </AccessPath> </PathElement> <PathElement Statement="return $r3" Method="&lt;cc.echonet.coolmicapp.Configuration.Manager: cc.echonet.coolmicapp.Configuration.Profile getCurrentProfile()&gt;"> <AccessPath Value="$r1" Type="cc.echonet.coolmicapp.Configuration.Profile" TaintSubFields="true"> <Fields> <Field Value="&lt;cc.echonet.coolmicapp.Configuration.ProfileBase: android.content.Context context&gt;" Type="cc.echonet.coolmicapp.BackgroundService.Server.Server" /> <Field Value="&lt;cc.echonet.coolmicapp.BackgroundService.Server.Server: cc.echonet.coolmicapp.BackgroundService.Server.Driver driver&gt;" Type="cc.echonet.coolmicapp.BackgroundService.Server.Driver" /> </Fields> </AccessPath> </PathElement> <PathElement Statement="specialinvoke $r4.&lt;cc.echonet.coolmicapp.BackgroundService.Server.Driver: void &lt;init&gt;(android.content.Context,cc.echonet.coolmicapp.Configuration.Profile,cc.echonet.coolmicdspjava.CallbackHandler)&gt;(r0, $r1, r0)" Method="&lt;cc.echonet.coolmicapp.BackgroundService.Server.Server: void attachBaseContext(android.content.Context)&gt;"> <AccessPath Value="$r4" Type="cc.echonet.coolmicapp.Configuration.Profile" TaintSubFields="true"> <Fields> <Field Value="&lt;cc.echonet.coolmicapp.Configuration.ProfileBase: android.content.Context context&gt;" Type="cc.echonet.coolmicapp.BackgroundService.Server.Server" /> <Field Value="&lt;cc.echonet.coolmicapp.BackgroundService.Server.Server: cc.echonet.coolmicapp.BackgroundService.Server.Driver driver&gt;" Type="cc.echonet.coolmicapp.BackgroundService.Server.Driver" /> </Fields> </AccessPath> </PathElement> <PathElement Statement="r0.&lt;cc.echonet.coolmicapp.BackgroundService.Server.Driver: cc.echonet.coolmicapp.Configuration.Profile profile&gt; = $r4" Method="&lt;cc.echonet.coolmicapp.BackgroundService.Server.Driver: void &lt;init&gt;(android.content.Context,cc.echonet.coolmicapp.Configuration.Profile,cc.echonet.coolmicdspjava.CallbackHandler)&gt;"> <AccessPath Value="r0" Type="cc.echonet.coolmicapp.BackgroundService.Server.Driver" TaintSubFields="true" /> </PathElement> <PathElement Statement="return" Method="&lt;cc.echonet.coolmicapp.BackgroundService.Server.Driver: void &lt;init&gt;(android.content.Context,cc.echonet.coolmicapp.Configuration.Profile,cc.echonet.coolmicdspjava.CallbackHandler)&gt;"> <AccessPath Value="$r4" Type="cc.echonet.coolmicapp.BackgroundService.Server.Driver" TaintSubFields="true" /> </PathElement> <PathElement Statement="r0.&lt;cc.echonet.coolmicapp.BackgroundService.Server.Server: cc.echonet.coolmicapp.BackgroundService.Server.Driver driver&gt; = $r4" Method="&lt;cc.echonet.coolmicapp.BackgroundService.Server.Server: void attachBaseContext(android.content.Context)&gt;"> <AccessPath Value="r0" Type="cc.echonet.coolmicapp.BackgroundService.Server.Server" TaintSubFields="true"> <Fields> <Field Value="&lt;cc.echonet.coolmicapp.BackgroundService.Server.Server: cc.echonet.coolmicapp.BackgroundService.Server.Driver driver&gt;" Type="cc.echonet.coolmicapp.BackgroundService.Server.Driver" /> </Fields> </AccessPath> </PathElement> <PathElement Statement="return" Method="&lt;cc.echonet.coolmicapp.BackgroundService.Server.Server: void attachBaseContext(android.content.Context)&gt;"> <AccessPath Value="$r0" Type="cc.echonet.coolmicapp.BackgroundService.Server.Server" TaintSubFields="true"> <Fields> <Field Value="&lt;cc.echonet.coolmicapp.BackgroundService.Server.Server: cc.echonet.coolmicapp.BackgroundService.Server.Driver driver&gt;" Type="cc.echonet.coolmicapp.BackgroundService.Server.Driver" /> </Fields> </AccessPath> </PathElement> <PathElement Statement="virtualinvoke $r0.&lt;cc.echonet.coolmicapp.BackgroundService.Server.Server: boolean onUnbind(android.content.Intent)&gt;(null)" Method="&lt;dummyMainClass: cc.echonet.coolmicapp.BackgroundService.Server.Server dummyMainMethod_cc_echonet_coolmicapp_BackgroundService_Server_Server(android.content.Intent)&gt;"> <AccessPath Value="r0" Type="cc.echonet.coolmicapp.BackgroundService.Server.Server" TaintSubFields="true"> <Fields> <Field Value="&lt;cc.echonet.coolmicapp.BackgroundService.Server.Server: cc.echonet.coolmicapp.BackgroundService.Server.Driver driver&gt;" Type="cc.echonet.coolmicapp.BackgroundService.Server.Driver" /> </Fields> </AccessPath> </PathElement> <PathElement Statement="$r1 = virtualinvoke r0.&lt;cc.echonet.coolmicapp.BackgroundService.Server.Server: android.content.Intent getIntent()&gt;()" Method="&lt;cc.echonet.coolmicapp.BackgroundService.Server.Server: boolean onUnbind(android.content.Intent)&gt;"> <AccessPath Value="this" Type="cc.echonet.coolmicapp.BackgroundService.Server.Server" TaintSubFields="true"> <Fields> <Field Value="&lt;cc.echonet.coolmicapp.BackgroundService.Server.Server: cc.echonet.coolmicapp.BackgroundService.Server.Driver driver&gt;" Type="cc.echonet.coolmicapp.BackgroundService.Server.Driver" /> </Fields> </AccessPath> </PathElement> <PathElement Statement="return $r0" Method="&lt;cc.echonet.coolmicapp.BackgroundService.Server.Server: android.content.Intent getIntent()&gt;"> <AccessPath Value="r0" Type="cc.echonet.coolmicapp.BackgroundService.Server.Server" TaintSubFields="true"> <Fields> <Field Value="&lt;cc.echonet.coolmicapp.BackgroundService.Server.Server: cc.echonet.coolmicapp.BackgroundService.Server.Driver driver&gt;" Type="cc.echonet.coolmicapp.BackgroundService.Server.Driver" /> </Fields> </AccessPath> </PathElement> <PathElement Statement="return $z0" Method="&lt;cc.echonet.coolmicapp.BackgroundService.Server.Server: boolean onUnbind(android.content.Intent)&gt;"> <AccessPath Value="$r0" Type="cc.echonet.coolmicapp.BackgroundService.Server.Server" TaintSubFields="true"> <Fields> <Field Value="&lt;cc.echonet.coolmicapp.BackgroundService.Server.Server: cc.echonet.coolmicapp.BackgroundService.Server.Driver driver&gt;" Type="cc.echonet.coolmicapp.BackgroundService.Server.Driver" /> </Fields> </AccessPath> </PathElement> <PathElement Statement="virtualinvoke $r0.&lt;cc.echonet.coolmicapp.BackgroundService.Server.Server: void onDestroy()&gt;()" Method="&lt;dummyMainClass: cc.echonet.coolmicapp.BackgroundService.Server.Server dummyMainMethod_cc_echonet_coolmicapp_BackgroundService_Server_Server(android.content.Intent)&gt;"> <AccessPath Value="r0" Type="cc.echonet.coolmicapp.BackgroundService.Server.Server" TaintSubFields="true"> <Fields> <Field Value="&lt;cc.echonet.coolmicapp.BackgroundService.Server.Server: cc.echonet.coolmicapp.BackgroundService.Server.Driver driver&gt;" Type="cc.echonet.coolmicapp.BackgroundService.Server.Driver" /> </Fields> </AccessPath> </PathElement> <PathElement Statement="virtualinvoke r0.&lt;cc.echonet.coolmicapp.BackgroundService.Server.Server: void stopStream(android.os.Messenger)&gt;(null)" Method="&lt;cc.echonet.coolmicapp.BackgroundService.Server.Server: void onDestroy()&gt;"> <AccessPath Value="r0" Type="cc.echonet.coolmicapp.BackgroundService.Server.Server" TaintSubFields="true"> <Fields> <Field Value="&lt;cc.echonet.coolmicapp.BackgroundService.Server.Server: cc.echonet.coolmicapp.BackgroundService.Server.Driver driver&gt;" Type="cc.echonet.coolmicapp.BackgroundService.Server.Driver" /> </Fields> </AccessPath> </PathElement> <PathElement Statement="$r2 = r0.&lt;cc.echonet.coolmicapp.BackgroundService.Server.Server: cc.echonet.coolmicapp.BackgroundService.Server.Driver driver&gt;" Method="&lt;cc.echonet.coolmicapp.BackgroundService.Server.Server: void stopStream(android.os.Messenger)&gt;"> <AccessPath Value="$r2" Type="cc.echonet.coolmicapp.BackgroundService.Server.Driver" TaintSubFields="true" /> </PathElement> <PathElement Statement="$z0 = virtualinvoke $r2.&lt;cc.echonet.coolmicapp.BackgroundService.Server.Driver: boolean stopStream()&gt;()" Method="&lt;cc.echonet.coolmicapp.BackgroundService.Server.Server: void stopStream(android.os.Messenger)&gt;"> <AccessPath Value="r0" Type="cc.echonet.coolmicapp.BackgroundService.Server.Driver" TaintSubFields="true" /> </PathElement> <PathElement Statement="$z0 = virtualinvoke r0.&lt;cc.echonet.coolmicapp.BackgroundService.Server.Driver: boolean hasCore()&gt;()" Method="&lt;cc.echonet.coolmicapp.BackgroundService.Server.Driver: boolean stopStream()&gt;"> <AccessPath Value="r0" Type="cc.echonet.coolmicapp.BackgroundService.Server.Driver" TaintSubFields="true" /> </PathElement> <PathElement Statement="return 1" Method="&lt;cc.echonet.coolmicapp.BackgroundService.Server.Driver: boolean hasCore()&gt;"> <AccessPath Value="r0" Type="cc.echonet.coolmicapp.BackgroundService.Server.Driver" TaintSubFields="true" /> </PathElement> <PathElement Statement="$r1 = r0.&lt;cc.echonet.coolmicapp.BackgroundService.Server.Driver: cc.echonet.coolmicdspjava.Wrapper wrapper&gt;" Method="&lt;cc.echonet.coolmicapp.BackgroundService.Server.Driver: boolean stopStream()&gt;"> <AccessPath Value="$r1" Type="cc.echonet.coolmicdspjava.Wrapper" TaintSubFields="true" /> </PathElement> <PathElement Statement="virtualinvoke $r1.&lt;cc.echonet.coolmicdspjava.Wrapper: void close()&gt;()" Method="&lt;cc.echonet.coolmicapp.BackgroundService.Server.Driver: boolean stopStream()&gt;"> <AccessPath Value="r0" Type="cc.echonet.coolmicdspjava.Wrapper" TaintSubFields="true" /> </PathElement> <PathElement Statement="$l0 = r0.&lt;cc.echonet.coolmicdspjava.Wrapper: long nativeObject&gt;" Method="&lt;cc.echonet.coolmicdspjava.Wrapper: void close()&gt;"> <AccessPath Value="$l0" Type="long" TaintSubFields="true" /> </PathElement> <PathElement Statement="$r2 = staticinvoke &lt;java.lang.Long: java.lang.Long valueOf(long)&gt;($l0)" Method="&lt;cc.echonet.coolmicdspjava.Wrapper: void close()&gt;"> <AccessPath Value="$r2" Type="java.lang.Long" TaintSubFields="true" /> </PathElement> <PathElement Statement="$r1 = virtualinvoke $r2.&lt;java.lang.Long: java.lang.String toString()&gt;()" Method="&lt;cc.echonet.coolmicdspjava.Wrapper: void close()&gt;"> <AccessPath Value="$r1" Type="java.lang.String" TaintSubFields="true" /> </PathElement> <PathElement Statement="staticinvoke &lt;android.util.Log: int d(java.lang.String,java.lang.String)&gt;(&quot;wrapper.c&quot;, $r1)" Method="&lt;cc.echonet.coolmicdspjava.Wrapper: void close()&gt;"> <AccessPath Value="$r1" Type="java.lang.String" TaintSubFields="true" /> </PathElement> </TaintPath> </Source>
this.nativeObject -> log
public synchronized void close() { cc.echonet.coolmicdspjava.Wrapper $this; long $2; java.lang.Long boxed, boxed, boxed; int $opred, $7; java.lang.String $3_phi, $casted, $13_phi, $casted, $17_phi, $casted; $this := @this; $2 = $this.nativeObject; $3_phi = null; $opred = org.example.NativeSummaryAux.opaqueInt(); if $opred != 1 goto label1; boxed = java.lang.Long.valueOf($2); $casted = virtualinvoke boxed.toString(); $3_phi = $casted; goto label2; label1: if $opred != 2 goto label2; $3_phi = "wrapper=%p"; label2: android.util.Log.d("wrapper.c", $3_phi); $7 = org.example.NativeSummaryFuncs.calloc(1L, 56L); $this.nativeObject = $7; $13_phi = null; if $opred != 3 goto label3; $13_phi = "start unref"; goto label4; label3: if $opred != 4 goto label4; boxed = java.lang.Long.valueOf($2); $casted = virtualinvoke boxed.toString(); $13_phi = $casted; label4: android.util.Log.d("wrapper.c", $13_phi); $17_phi = null; if $opred != 5 goto label5; $17_phi = "unref bailing - no core obj"; goto label6; label5: if $opred != 6 goto label6; boxed = java.lang.Long.valueOf($2); $casted = virtualinvoke boxed.toString(); $17_phi = $casted; label6: android.util.Log.d("wrapper.c", $17_phi); org.example.NativeSummaryFuncs.free($2); $this.nativeObject = 0L; return; }
1 the Long field nativeObject is Logged log_sink
la.daube.photochiotte_32.apk Sink: <la.daube.photochiotte.MPVLib: int command(java.lang.String[],int)> staticinvoke <android.util.Log: int d(java.lang.String,java.lang.String)>("YYYplay", $r2) Source: <la.daube.photochiotte.ThreadMusic: boolean playmusicafterloadselection(java.lang.String,boolean)> $r8 = virtualinvoke $r7.<java.util.ArrayList: java.lang.Object get(int)>($i0)
https://gitlab.com/LaDaubePhotoChiotte/photochiotte/-/blob/master/app/src/main/cpp/player.cpp#L81 extern "C" JNIEXPORT jint JNICALL Java_la_daube_photochiotte_MPVLib_command(JNIEnv* env, jclass thisClass, jobjectArray jarray, jint id) { if (!nst[id].mpv) { return -1; } const char *arguments[128] = { 0 }; int len = env->GetArrayLength(jarray); if (len >= sizeof(arguments)/sizeof(arguments[0])) { return -2; } for (int i = 0; i < len; ++i) arguments[i] = env->GetStringUTFChars((jstring)env->GetObjectArrayElement(jarray, i), NULL); int ret = mpv_command(nst[id].mpv, arguments); if (ret < 0) ALOGV("--------------- error mpv command %s %d", arguments[0], ret); for (int i = 0; i < len; ++i) env->ReleaseStringUTFChars((jstring)env->GetObjectArrayElement(jarray, i), arguments[i]); return ret; }
virtualinvoke r0.<la.daube.photochiotte.MPVLib: int command(java.lang.String[])>($r2) $i0 = staticinvoke <la.daube.photochiotte.MPVLib: int command(java.lang.String[],int)>($r1, $i0)
<Source Statement="$r8 = virtualinvoke $r7.&lt;java.util.ArrayList: java.lang.Object get(int)&gt;($i0)" Method="&lt;la.daube.photochiotte.ThreadMusic: boolean playmusicafterloadselection(java.lang.String,boolean)&gt;"> <AccessPath Value="$r8" Type="java.lang.Object" TaintSubFields="true" /> <TaintPath> <PathElement Statement="$r8 = virtualinvoke $r7.&lt;java.util.ArrayList: java.lang.Object get(int)&gt;($i0)" Method="&lt;la.daube.photochiotte.ThreadMusic: boolean playmusicafterloadselection(java.lang.String,boolean)&gt;"> <AccessPath Value="$r8" Type="java.lang.Object" TaintSubFields="true" /> </PathElement> <PathElement Statement="$r4 = (java.lang.String) $r8" Method="&lt;la.daube.photochiotte.ThreadMusic: boolean playmusicafterloadselection(java.lang.String,boolean)&gt;"> <AccessPath Value="$r4" Type="java.lang.String" TaintSubFields="true" /> </PathElement> <PathElement Statement="virtualinvoke $r2.&lt;la.daube.photochiotte.MPVLib: void loadfile(java.lang.String,boolean)&gt;($r4, 0)" Method="&lt;la.daube.photochiotte.ThreadMusic: boolean playmusicafterloadselection(java.lang.String,boolean)&gt;"> <AccessPath Value="$r1" Type="java.lang.String" TaintSubFields="true" /> </PathElement> <PathElement Statement="$r2[1] = $r1" Method="&lt;la.daube.photochiotte.MPVLib: void loadfile(java.lang.String,boolean)&gt;"> <AccessPath Value="$r2" Type="java.lang.String[]" TaintSubFields="true" /> </PathElement> <PathElement Statement="virtualinvoke r0.&lt;la.daube.photochiotte.MPVLib: int command(java.lang.String[])&gt;($r2)" Method="&lt;la.daube.photochiotte.MPVLib: void loadfile(java.lang.String,boolean)&gt;"> <AccessPath Value="$r1" Type="java.lang.String[]" TaintSubFields="true" /> </PathElement> <PathElement Statement="$i0 = staticinvoke &lt;la.daube.photochiotte.MPVLib: int command(java.lang.String[],int)&gt;($r1, $i0)" Method="&lt;la.daube.photochiotte.MPVLib: int command(java.lang.String[])&gt;"> <AccessPath Value="$r0" Type="java.lang.String[]" TaintSubFields="true" /> </PathElement> <PathElement Statement="$r1 = $r0[0]" Method="&lt;la.daube.photochiotte.MPVLib: int command(java.lang.String[],int)&gt;"> <AccessPath Value="$r1" Type="java.lang.String" TaintSubFields="true" /> </PathElement> <PathElement Statement="$r2 = $r1" Method="&lt;la.daube.photochiotte.MPVLib: int command(java.lang.String[],int)&gt;"> <AccessPath Value="$r2" Type="java.lang.String" TaintSubFields="true" /> </PathElement> <PathElement Statement="staticinvoke &lt;android.util.Log: int d(java.lang.String,java.lang.String)&gt;(&quot;YYYplay&quot;, $r2)" Method="&lt;la.daube.photochiotte.MPVLib: int command(java.lang.String[],int)&gt;"> <AccessPath Value="$r2" Type="java.lang.String" TaintSubFields="true" /> </PathElement> </TaintPath> </Source>
param0 array -> index -> log
public static int command(java.lang.String[], int) { int $p1, $opred; java.lang.String[] $p0; java.lang.String $1, $4_phi, $8; $p0 := @parameter0; $p1 := @parameter1; org.example.NativeSummaryFuncs.GetArrayLength(null, $p0); $1 = $p0[0]; $4_phi = null; $opred = org.example.NativeSummaryAux.opaqueInt(); if $opred != 1 goto label1; $4_phi = $1; goto label3; label1: if $opred != 2 goto label2; $4_phi = null; goto label3; label2: if $opred != 3 goto label3; $4_phi = "--------------- error mpv command %s %d"; label3: android.util.Log.d("YYYplay", $4_phi); $8 = $p0[0]; return null; }
1 the array member is logged log_sink
com.intervigil.micdroid_34.apk Sink: <net.sourceforge.autotalent.Autotalent: void instantiateAutotalent(int)> staticinvoke <android.util.Log: int d(java.lang.String,java.lang.String)>("libautotalent.so", $r0) Source: <com.intervigil.micdroid.helper.PreferenceHelper: int getSampleRate(android.content.Context)> $i0 = staticinvoke <java.lang.Integer: int parseInt(java.lang.String)>($r2)
https://github.com/intervigilium/libautotalent/blob/842e489b5020bc7b9c50bc72498dc1657fa03918/jni/autotalent/autotalent-interface.c#L58 JNIEXPORT void JNICALL Java_net_sourceforge_autotalent_Autotalent_instantiateAutotalent(JNIEnv * env, jclass class, jint sampleRate) { if (instance == NULL) { instance = instantiateAutotalent(sampleRate); __android_log_print(ANDROID_LOG_DEBUG, "libautotalent.so", "instantiated autotalent with sample rate: %d", sampleRate); } }
staticinvoke <net.sourceforge.autotalent.Autotalent: void instantiateAutotalent(int)>($i2)
<Source Statement="$i0 = staticinvoke &lt;java.lang.Integer: int parseInt(java.lang.String)&gt;($r2)" Method="&lt;com.intervigil.micdroid.helper.PreferenceHelper: int getSampleRate(android.content.Context)&gt;"> <AccessPath Value="$i0" Type="int" TaintSubFields="true" /> <TaintPath> <PathElement Statement="$i0 = staticinvoke &lt;java.lang.Integer: int parseInt(java.lang.String)&gt;($r2)" Method="&lt;com.intervigil.micdroid.helper.PreferenceHelper: int getSampleRate(android.content.Context)&gt;"> <AccessPath Value="$i0" Type="int" TaintSubFields="true" /> </PathElement> <PathElement Statement="return $i0" Method="&lt;com.intervigil.micdroid.helper.PreferenceHelper: int getSampleRate(android.content.Context)&gt;"> <AccessPath Value="$i2" Type="int" TaintSubFields="true" /> </PathElement> <PathElement Statement="staticinvoke &lt;net.sourceforge.autotalent.Autotalent: void instantiateAutotalent(int)&gt;($i2)" Method="&lt;com.intervigil.micdroid.Mic: void updateAutoTalentPreferences()&gt;"> <AccessPath Value="$i0" Type="int" TaintSubFields="true" /> </PathElement> <PathElement Statement="$r1 = staticinvoke &lt;java.lang.Integer: java.lang.Integer valueOf(int)&gt;($i0)" Method="&lt;net.sourceforge.autotalent.Autotalent: void instantiateAutotalent(int)&gt;"> <AccessPath Value="$r1" Type="java.lang.Integer" TaintSubFields="true" /> </PathElement> <PathElement Statement="$r0 = virtualinvoke $r1.&lt;java.lang.Integer: java.lang.String toString()&gt;()" Method="&lt;net.sourceforge.autotalent.Autotalent: void instantiateAutotalent(int)&gt;"> <AccessPath Value="$r0" Type="java.lang.String" TaintSubFields="true" /> </PathElement> <PathElement Statement="staticinvoke &lt;android.util.Log: int d(java.lang.String,java.lang.String)&gt;(&quot;libautotalent.so&quot;, $r0)" Method="&lt;net.sourceforge.autotalent.Autotalent: void instantiateAutotalent(int)&gt;"> <AccessPath Value="$r0" Type="java.lang.String" TaintSubFields="true" /> </PathElement> </TaintPath> </Source>
param0- > log
public static void instantiateAutotalent(int) { long $1_phi, $3_phi, $5_phi, $15_phi, $18_phi, $20_phi, $23_phi, $25_phi, $27_phi, $29_phi, $31_phi, $33_phi; java.lang.Integer boxed, boxed; int $p0, $opred; java.lang.String $50_phi, $casted, $54_phi, $casted; $p0 := @parameter0; org.example.NativeSummaryFuncs.malloc(312L); $1_phi = 0; $opred = org.example.NativeSummaryAux.opaqueInt(); if $opred != 1 goto label01; $1_phi = 2048L; goto label03; label01: if $opred != 2 goto label02; $1_phi = 4096L; goto label03; label02: if $opred != 3 goto label03; $1_phi = 88199L; label03: org.example.NativeSummaryFuncs.calloc($1_phi, 4L); $3_phi = 0; if $opred != 4 goto label04; $3_phi = 2048L; goto label06; label04: if $opred != 5 goto label05; $3_phi = 4096L; goto label06; label05: if $opred != 6 goto label06; $3_phi = 88199L; label06: org.example.NativeSummaryFuncs.calloc($3_phi, 4L); $5_phi = 0; if $opred != 7 goto label07; $5_phi = 2048L; goto label09; label07: if $opred != 8 goto label08; $5_phi = 4096L; goto label09; label08: if $opred != 9 goto label09; $5_phi = 88199L; label09: org.example.NativeSummaryFuncs.calloc($5_phi, 4L); org.example.NativeSummaryFuncs.calloc(7L, 4L); org.example.NativeSummaryFuncs.calloc(7L, 4L); org.example.NativeSummaryFuncs.calloc(7L, 4L); org.example.NativeSummaryFuncs.calloc(7L, 4L); org.example.NativeSummaryFuncs.calloc(7L, 4L); org.example.NativeSummaryFuncs.calloc(7L, 4L); org.example.NativeSummaryFuncs.calloc(7L, 4L); org.example.NativeSummaryFuncs.malloc(28L); $15_phi = 0; if $opred != 10 goto label10; $15_phi = 2048L; goto label12; label10: if $opred != 11 goto label11; $15_phi = 4096L; goto label12; label11: if $opred != 12 goto label12; $15_phi = 88199L; label12: org.example.NativeSummaryFuncs.calloc($15_phi, 4L); org.example.NativeSummaryFuncs.calloc(7L, 4L); $18_phi = 0; if $opred != 13 goto label13; $18_phi = 2048L; goto label15; label13: if $opred != 14 goto label14; $18_phi = 4096L; goto label15; label14: if $opred != 15 goto label15; $18_phi = 88199L; label15: org.example.NativeSummaryFuncs.calloc($18_phi, 4L); $20_phi = 0; if $opred != 16 goto label16; $20_phi = 2048L; goto label18; label16: if $opred != 17 goto label17; $20_phi = 4096L; goto label18; label17: if $opred != 18 goto label18; $20_phi = 88199L; label18: org.example.NativeSummaryFuncs.calloc($20_phi, 4L); org.example.NativeSummaryFuncs.malloc(12L); $23_phi = 0; if $opred != 19 goto label19; $23_phi = 2048L; goto label21; label19: if $opred != 20 goto label20; $23_phi = 4096L; goto label21; label20: if $opred != 21 goto label21; $23_phi = 88199L; label21: org.example.NativeSummaryFuncs.calloc($23_phi, 4L); $25_phi = 0; if $opred != 22 goto label22; $25_phi = 2048L; goto label24; label22: if $opred != 23 goto label23; $25_phi = 4096L; goto label24; label23: if $opred != 24 goto label24; $25_phi = 88199L; label24: org.example.NativeSummaryFuncs.calloc($25_phi, 4L); $27_phi = 0; if $opred != 25 goto label25; $27_phi = 1025L; goto label27; label25: if $opred != 26 goto label26; $27_phi = 2049L; goto label27; label26: if $opred != 27 goto label27; $27_phi = 44100L; label27: org.example.NativeSummaryFuncs.calloc($27_phi, 4L); $29_phi = 0; if $opred != 28 goto label28; $29_phi = 1025L; goto label30; label28: if $opred != 29 goto label29; $29_phi = 2049L; goto label30; label29: if $opred != 30 goto label30; $29_phi = 44100L; label30: org.example.NativeSummaryFuncs.calloc($29_phi, 4L); $31_phi = 0; if $opred != 31 goto label31; $31_phi = 2048L; goto label33; label31: if $opred != 32 goto label32; $31_phi = 4096L; goto label33; label32: if $opred != 33 goto label33; $31_phi = 88199L; label33: org.example.NativeSummaryFuncs.calloc($31_phi, 4L); $33_phi = 0; if $opred != 34 goto label34; $33_phi = 2048L; goto label36; label34: if $opred != 35 goto label35; $33_phi = 4096L; goto label36; label35: if $opred != 36 goto label36; $33_phi = 88199L; label36: org.example.NativeSummaryFuncs.calloc($33_phi, 4L); org.example.NativeSummaryFuncs.malloc(4L); org.example.NativeSummaryFuncs.malloc(4L); org.example.NativeSummaryFuncs.malloc(4L); org.example.NativeSummaryFuncs.malloc(4L); org.example.NativeSummaryFuncs.malloc(4L); org.example.NativeSummaryFuncs.malloc(4L); org.example.NativeSummaryFuncs.malloc(4L); org.example.NativeSummaryFuncs.malloc(4L); org.example.NativeSummaryFuncs.malloc(4L); org.example.NativeSummaryFuncs.malloc(4L); org.example.NativeSummaryFuncs.malloc(4L); org.example.NativeSummaryFuncs.malloc(4L); org.example.NativeSummaryFuncs.malloc(4L); org.example.NativeSummaryFuncs.malloc(4L); org.example.NativeSummaryFuncs.malloc(4L); $50_phi = null; if $opred != 37 goto label37; boxed = java.lang.Integer.valueOf($p0); $casted = virtualinvoke boxed.toString(); $50_phi = $casted; goto label39; label37: if $opred != 38 goto label38; $50_phi = null; goto label39; label38: if $opred != 39 goto label39; $50_phi = "instantiated autotalent with sample rate: %d"; label39: android.util.Log.d("libautotalent.so", $50_phi); $54_phi = null; if $opred != 40 goto label40; boxed = java.lang.Integer.valueOf($p0); $casted = virtualinvoke boxed.toString(); $54_phi = $casted; goto label41; label40: if $opred != 41 goto label41; $54_phi = "instantiated autotalent with sample rate: %d"; label41: android.util.Log.d("libautotalent.so", $54_phi); return; }
1 the param0 int samplerate is logged in native log_sink
jp.sawada.np2android_20130429.apk Sink: <jp.sawada.np2android.SDLActivity: void onNativeFileDir(int,java.lang.String)> $i0 = staticinvoke <org.example.NativeSummaryFuncs: int fopen(java.lang.String,java.lang.String)>($r1, "rb+") Source: <jp.sawada.np2android.SDLActivity: void onFileSelected_by_SelectFileDialog(java.io.File,int)> $r2 = virtualinvoke $r1.<java.io.File: java.lang.String getAbsolutePath()>()
https://sourceforge.net/p/np2android/code/ci/master/tarball?path= JNIEXPORT void JNICALL Java_jp_sawada_np2android_SDLActivity_onNativeFileDir (JNIEnv *env, jclass jcls, jint device, jstring name) { const char *path = (*env)->GetStringUTFChars(env, name, 0); // __android_log_print(ANDROID_LOG_INFO, "SDL", "DISK-filepath=(%s)",path ); if (device == 0) { /* Set current directory */ chdir(path); } else if (device == 1) { /* Set SASI1 filepath */ diskdrv_sethdd(0, path); } else if (device == 2) { /* Set SASI2 filepath */ diskdrv_sethdd(1, path); } else if (device == 3) { /* Set FDD1 filepath */ diskdrv_setfdd(0, path, 0); } else if (device == 4) { /* Set FDD2 filepath */ diskdrv_setfdd(1, path, 0); } (*env)->ReleaseStringUTFChars(env, name, path); }
staticinvoke <jp.sawada.np2android.SDLActivity: void onNativeFileDir(int,java.lang.String)>($i0, $r2) $i0 = staticinvoke <org.example.NativeSummaryFuncs: int fopen(java.lang.String,java.lang.String)>($r1, "rb+")
<Source Statement="$r2 = virtualinvoke $r1.&lt;java.io.File: java.lang.String getAbsolutePath()&gt;()" Method="&lt;jp.sawada.np2android.SDLActivity: void onFileSelected_by_SelectFileDialog(java.io.File,int)&gt;"> <AccessPath Value="$r2" Type="java.lang.String" TaintSubFields="true" /> <TaintPath> <PathElement Statement="$r2 = virtualinvoke $r1.&lt;java.io.File: java.lang.String getAbsolutePath()&gt;()" Method="&lt;jp.sawada.np2android.SDLActivity: void onFileSelected_by_SelectFileDialog(java.io.File,int)&gt;"> <AccessPath Value="$r2" Type="java.lang.String" TaintSubFields="true" /> </PathElement> <PathElement Statement="staticinvoke &lt;jp.sawada.np2android.SDLActivity: void onNativeFileDir(int,java.lang.String)&gt;($i0, $r2)" Method="&lt;jp.sawada.np2android.SDLActivity: void onFileSelected_by_SelectFileDialog(java.io.File,int)&gt;"> <AccessPath Value="$r0" Type="java.lang.String" TaintSubFields="true" /> </PathElement> <PathElement Statement="$r1 = $r0" Method="&lt;jp.sawada.np2android.SDLActivity: void onNativeFileDir(int,java.lang.String)&gt;"> <AccessPath Value="$r1" Type="java.lang.String" TaintSubFields="true" /> </PathElement> <PathElement Statement="$i0 = staticinvoke &lt;org.example.NativeSummaryFuncs: int fopen(java.lang.String,java.lang.String)&gt;($r1, &quot;rb+&quot;)" Method="&lt;jp.sawada.np2android.SDLActivity: void onNativeFileDir(int,java.lang.String)&gt;"> <AccessPath Value="$r1" Type="java.lang.String" TaintSubFields="true" /> </PathElement> </TaintPath> </Source>
param0 path -> fopen
public static void onNativeFileDir(int, java.lang.String) { int $p0, $opred, $14, $17, $27; java.lang.String $p1, $2, $3_phi, $5_phi, $7_phi, $9_phi, $11_phi, $13_phi, $16_phi; $p0 := @parameter0; $p1 := @parameter1; $2 = org.example.NativeSummaryFuncs.fopen($p1, "rb+"); $3_phi = null; $opred = org.example.NativeSummaryAux.opaqueInt(); if $opred != 1 goto label01; $3_phi = $p1; goto label02; label01: if $opred != 2 goto label02; $3_phi = $2; label02: org.example.NativeSummaryFuncs.fread(null, 1L, 32L, $3_phi); $5_phi = null; if $opred != 3 goto label03; $5_phi = $p1; goto label04; label03: if $opred != 4 goto label04; $5_phi = $2; label04: org.example.NativeSummaryFuncs.fread(null, 1L, 512L, $5_phi); $7_phi = null; if $opred != 5 goto label05; $7_phi = $p1; goto label06; label05: if $opred != 6 goto label06; $7_phi = $2; label06: org.example.NativeSummaryFuncs.fread(null, 1L, 2L, $7_phi); $9_phi = null; if $opred != 7 goto label07; $9_phi = $p1; goto label08; label07: if $opred != 8 goto label08; $9_phi = $2; label08: org.example.NativeSummaryFuncs.fread(null, 1L, 220L, $9_phi); $11_phi = null; if $opred != 9 goto label09; $11_phi = $p1; goto label10; label09: if $opred != 10 goto label10; $11_phi = $2; label10: org.example.NativeSummaryFuncs.fclose($11_phi); $13_phi = null; if $opred != 11 goto label11; $13_phi = ""; goto label12; label11: if $opred != 12 goto label12; $13_phi = $p1; label12: $14 = org.example.NativeSummaryFuncs.fopen($13_phi, "rb+"); org.example.NativeSummaryFuncs.fread(null, 1L, 2048L, $14); $16_phi = null; if $opred != 13 goto label13; $16_phi = ""; goto label14; label13: if $opred != 14 goto label14; $16_phi = $p1; label14: $17 = org.example.NativeSummaryFuncs.fopen($16_phi, "rb+"); org.example.NativeSummaryFuncs.fread(null, 1L, 4L, $17); org.example.NativeSummaryFuncs.malloc(2080L); org.example.NativeSummaryFuncs.malloc(4908L); org.example.NativeSummaryFuncs.fread(null, 1L, 2048L, $14); org.example.NativeSummaryFuncs.fclose($14); org.example.NativeSummaryFuncs.fclose($17); org.example.NativeSummaryFuncs.fclose(null); org.example.NativeSummaryFuncs.free(null); $27 = org.example.NativeSummaryFuncs.fopen(null, "rb+"); org.example.NativeSummaryFuncs.fclose($27); org.example.NativeSummaryFuncs.fclose($27); return; }
1 the file is opened in native nsfunc_sink fopen
cx.hell.android.pdfview_40000.apk Sink: <cx.hell.android.lib.pdf.PDF: int parseFileDescriptor(java.io.FileDescriptor,int,java.lang.String)> staticinvoke <org.example.NativeSummaryFuncs: int fprintf(java.lang.Object,java.lang.String,int,int)>(null, "error: resize array (%d x %d bytes) failed (integer overflow)\n", $i3, $i4) Source: <cx.hell.android.pdfview.OpenFileActivity: void onCreate(android.os.Bundle)> $i0 = staticinvoke <java.lang.Integer: int parseInt(java.lang.String)>($r4)
https://github.com/chintanvyas89/android-pdf-viewer/blob/e06870b4e75b9f77a03744ce9c8ff0aa6bbb7106/pdfview/jni/pdfview2/pdfview2.c#L93 JNIEXPORT void JNICALL Java_cx_hell_android_lib_pdf_PDF_parseFileDescriptor( JNIEnv *env, jobject jthis, jobject fileDescriptor, jint box_type, jstring password ) { int fileno; jclass this_class; jfieldID pdf_field_id; pdf_t *pdf = NULL; jfieldID invalid_password_field_id; jboolean iscopy; const char* c_password; c_password = (*env)->GetStringUTFChars(env, password, &iscopy); this_class = (*env)->GetObjectClass(env, jthis); pdf_field_id = (*env)->GetFieldID(env, this_class, "pdf_ptr", "I"); invalid_password_field_id = (*env)->GetFieldID(env, this_class, "invalid_password", "I"); fileno = get_descriptor_from_file_descriptor(env, fileDescriptor); pdf = parse_pdf_file(NULL, fileno, c_password); if (pdf != NULL && pdf->invalid_password) { (*env)->SetIntField(env, jthis, invalid_password_field_id, 1); free_pdf_t(pdf); pdf = NULL; } else { (*env)->SetIntField(env, jthis, invalid_password_field_id, 0); } if (pdf != NULL) { if (NUM_BOXES <= box_type) strcpy(pdf->box, "CropBox"); else strcpy(pdf->box, boxes[box_type]); } (*env)->ReleaseStringUTFChars(env, password, c_password); (*env)->SetIntField(env, jthis, pdf_field_id, (int)pdf); }
specialinvoke r0.<cx.hell.android.lib.pdf.PDF: int parseFileDescriptor(java.io.FileDescriptor,int,java.lang.String)>($r2, $i0, "") staticinvoke <org.example.NativeSummaryFuncs: int fprintf(java.lang.Object,java.lang.String,int,int)>(null, "error: resize array (%d x %d bytes) failed (integer overflow)\n", $i3, $i4)
<Source Statement="$i0 = staticinvoke &lt;java.lang.Integer: int parseInt(java.lang.String)&gt;($r4)" Method="&lt;cx.hell.android.pdfview.OpenFileActivity: void onCreate(android.os.Bundle)&gt;"> <AccessPath Value="$i0" Type="int" TaintSubFields="true" /> <TaintPath> <PathElement Statement="$i0 = staticinvoke &lt;java.lang.Integer: int parseInt(java.lang.String)&gt;($r4)" Method="&lt;cx.hell.android.pdfview.OpenFileActivity: void onCreate(android.os.Bundle)&gt;"> <AccessPath Value="$i0" Type="int" TaintSubFields="true" /> </PathElement> <PathElement Statement="r0.&lt;cx.hell.android.pdfview.OpenFileActivity: int box&gt; = $i0" Method="&lt;cx.hell.android.pdfview.OpenFileActivity: void onCreate(android.os.Bundle)&gt;"> <AccessPath Value="r0" Type="cx.hell.android.pdfview.OpenFileActivity" TaintSubFields="true"> <Fields> <Field Value="&lt;cx.hell.android.pdfview.OpenFileActivity: int box&gt;" Type="int" /> </Fields> </AccessPath> </PathElement> <PathElement Statement="specialinvoke $r18.&lt;cx.hell.android.lib.pagesview.PagesView: void &lt;init&gt;(android.app.Activity)&gt;(r0)" Method="&lt;cx.hell.android.pdfview.OpenFileActivity: void onCreate(android.os.Bundle)&gt;"> <AccessPath Value="$r1" Type="cx.hell.android.pdfview.OpenFileActivity" TaintSubFields="true"> <Fields> <Field Value="&lt;cx.hell.android.pdfview.OpenFileActivity: int box&gt;" Type="int" /> </Fields> </AccessPath> </PathElement> <PathElement Statement="r0.&lt;cx.hell.android.lib.pagesview.PagesView: android.app.Activity activity&gt; = $r1" Method="&lt;cx.hell.android.lib.pagesview.PagesView: void &lt;init&gt;(android.app.Activity)&gt;"> <AccessPath Value="r0" Type="cx.hell.android.lib.pagesview.PagesView" TaintSubFields="true"> <Fields> <Field Value="&lt;cx.hell.android.lib.pagesview.PagesView: android.app.Activity activity&gt;" Type="cx.hell.android.pdfview.OpenFileActivity" /> <Field Value="&lt;cx.hell.android.pdfview.OpenFileActivity: int box&gt;" Type="int" /> </Fields> </AccessPath> </PathElement> <PathElement Statement="specialinvoke $r8.&lt;cx.hell.android.lib.pagesview.PagesView$1: void &lt;init&gt;(cx.hell.android.lib.pagesview.PagesView)&gt;(r0)" Method="&lt;cx.hell.android.lib.pagesview.PagesView: void &lt;init&gt;(android.app.Activity)&gt;"> <AccessPath Value="$r1" Type="cx.hell.android.lib.pagesview.PagesView" TaintSubFields="true"> <Fields> <Field Value="&lt;cx.hell.android.lib.pagesview.PagesView: android.app.Activity activity&gt;" Type="cx.hell.android.pdfview.OpenFileActivity" /> <Field Value="&lt;cx.hell.android.pdfview.OpenFileActivity: int box&gt;" Type="int" /> </Fields> </AccessPath> </PathElement> <PathElement Statement="return" Method="&lt;cx.hell.android.lib.pagesview.PagesView$1: void &lt;init&gt;(cx.hell.android.lib.pagesview.PagesView)&gt;"> <AccessPath Value="r0" Type="cx.hell.android.lib.pagesview.PagesView" TaintSubFields="true"> <Fields> <Field Value="&lt;cx.hell.android.lib.pagesview.PagesView: android.app.Activity activity&gt;" Type="cx.hell.android.pdfview.OpenFileActivity" /> <Field Value="&lt;cx.hell.android.pdfview.OpenFileActivity: int box&gt;" Type="int" /> </Fields> </AccessPath> </PathElement> <PathElement Statement="specialinvoke $r10.&lt;cx.hell.android.lib.pagesview.PagesView$2: void &lt;init&gt;(cx.hell.android.lib.pagesview.PagesView,cx.hell.android.pdfview.OpenFileActivity,cx.hell.android.lib.pagesview.PagesView)&gt;(r0, r6, r0)" Method="&lt;cx.hell.android.lib.pagesview.PagesView: void &lt;init&gt;(android.app.Activity)&gt;"> <AccessPath Value="$r1" Type="cx.hell.android.lib.pagesview.PagesView" TaintSubFields="true"> <Fields> <Field Value="&lt;cx.hell.android.lib.pagesview.PagesView: android.app.Activity activity&gt;" Type="cx.hell.android.pdfview.OpenFileActivity" /> <Field Value="&lt;cx.hell.android.pdfview.OpenFileActivity: int box&gt;" Type="int" /> </Fields> </AccessPath> </PathElement> <PathElement Statement="return" Method="&lt;cx.hell.android.lib.pagesview.PagesView$2: void &lt;init&gt;(cx.hell.android.lib.pagesview.PagesView,cx.hell.android.pdfview.OpenFileActivity,cx.hell.android.lib.pagesview.PagesView)&gt;"> <AccessPath Value="r0" Type="cx.hell.android.lib.pagesview.PagesView" TaintSubFields="true"> <Fields> <Field Value="&lt;cx.hell.android.lib.pagesview.PagesView: android.app.Activity activity&gt;" Type="cx.hell.android.pdfview.OpenFileActivity" /> <Field Value="&lt;cx.hell.android.pdfview.OpenFileActivity: int box&gt;" Type="int" /> </Fields> </AccessPath> </PathElement> <PathElement Statement="return" Method="&lt;cx.hell.android.lib.pagesview.PagesView: void &lt;init&gt;(android.app.Activity)&gt;"> <AccessPath Value="$r18" Type="cx.hell.android.lib.pagesview.PagesView" TaintSubFields="true"> <Fields> <Field Value="&lt;cx.hell.android.lib.pagesview.PagesView: android.app.Activity activity&gt;" Type="cx.hell.android.pdfview.OpenFileActivity" /> <Field Value="&lt;cx.hell.android.pdfview.OpenFileActivity: int box&gt;" Type="int" /> </Fields> </AccessPath> </PathElement> <PathElement Statement="r0.&lt;cx.hell.android.pdfview.OpenFileActivity: cx.hell.android.lib.pagesview.PagesView pagesView&gt; = $r18" Method="&lt;cx.hell.android.pdfview.OpenFileActivity: void onCreate(android.os.Bundle)&gt;"> <AccessPath Value="r0" Type="cx.hell.android.pdfview.OpenFileActivity" TaintSubFields="true"> <Fields> <Field Value="&lt;cx.hell.android.pdfview.OpenFileActivity: int box&gt;" Type="int" /> </Fields> </AccessPath> </PathElement> <PathElement Statement="specialinvoke $r18.&lt;cx.hell.android.lib.pagesview.PagesView: void &lt;init&gt;(android.app.Activity)&gt;(r0)" Method="&lt;cx.hell.android.pdfview.OpenFileActivity: void onCreate(android.os.Bundle)&gt;"> <AccessPath Value="$r1" Type="cx.hell.android.pdfview.OpenFileActivity" TaintSubFields="true"> <Fields> <Field Value="&lt;cx.hell.android.pdfview.OpenFileActivity: int box&gt;" Type="int" /> </Fields> </AccessPath> </PathElement> <PathElement Statement="return" Method="&lt;cx.hell.android.lib.pagesview.PagesView: void &lt;init&gt;(android.app.Activity)&gt;"> <AccessPath Value="r0" Type="cx.hell.android.pdfview.OpenFileActivity" TaintSubFields="true"> <Fields> <Field Value="&lt;cx.hell.android.pdfview.OpenFileActivity: int box&gt;" Type="int" /> </Fields> </AccessPath> </PathElement> <PathElement Statement="specialinvoke r0.&lt;cx.hell.android.pdfview.OpenFileActivity: void startPDF(android.content.SharedPreferences)&gt;($r5)" Method="&lt;cx.hell.android.pdfview.OpenFileActivity: void onCreate(android.os.Bundle)&gt;"> <AccessPath Value="r0" Type="cx.hell.android.pdfview.OpenFileActivity" TaintSubFields="true"> <Fields> <Field Value="&lt;cx.hell.android.pdfview.OpenFileActivity: int box&gt;" Type="int" /> </Fields> </AccessPath> </PathElement> <PathElement Statement="$r2 = specialinvoke r0.&lt;cx.hell.android.pdfview.OpenFileActivity: cx.hell.android.lib.pdf.PDF getPDF()&gt;()" Method="&lt;cx.hell.android.pdfview.OpenFileActivity: void startPDF(android.content.SharedPreferences)&gt;"> <AccessPath Value="r0" Type="cx.hell.android.pdfview.OpenFileActivity" TaintSubFields="true"> <Fields> <Field Value="&lt;cx.hell.android.pdfview.OpenFileActivity: int box&gt;" Type="int" /> </Fields> </AccessPath> </PathElement> <PathElement Statement="$i0 = r0.&lt;cx.hell.android.pdfview.OpenFileActivity: int box&gt;" Method="&lt;cx.hell.android.pdfview.OpenFileActivity: cx.hell.android.lib.pdf.PDF getPDF()&gt;"> <AccessPath Value="$i0" Type="int" TaintSubFields="true" /> </PathElement> <PathElement Statement="specialinvoke $r6.&lt;cx.hell.android.lib.pdf.PDF: void &lt;init&gt;(android.os.ParcelFileDescriptor,int)&gt;($r9, $i0)" Method="&lt;cx.hell.android.pdfview.OpenFileActivity: cx.hell.android.lib.pdf.PDF getPDF()&gt;"> <AccessPath Value="$i0" Type="int" TaintSubFields="true" /> </PathElement> <PathElement Statement="specialinvoke r0.&lt;cx.hell.android.lib.pdf.PDF: int parseFileDescriptor(java.io.FileDescriptor,int,java.lang.String)&gt;($r2, $i0, &quot;&quot;)" Method="&lt;cx.hell.android.lib.pdf.PDF: void &lt;init&gt;(android.os.ParcelFileDescriptor,int)&gt;"> <AccessPath Value="$i0" Type="int" TaintSubFields="true" /> </PathElement> <PathElement Statement="$i4 = $i0" Method="&lt;cx.hell.android.lib.pdf.PDF: int parseFileDescriptor(java.io.FileDescriptor,int,java.lang.String)&gt;"> <AccessPath Value="$i4" Type="int" TaintSubFields="true" /> </PathElement> <PathElement Statement="staticinvoke &lt;org.example.NativeSummaryFuncs: int fprintf(java.lang.Object,java.lang.String,int,int)&gt;(null, &quot;error: resize array (%d x %d bytes) failed (integer overflow)\n&quot;, $i3, $i4)" Method="&lt;cx.hell.android.lib.pdf.PDF: int parseFileDescriptor(java.io.FileDescriptor,int,java.lang.String)&gt;"> <AccessPath Value="$i4" Type="int" TaintSubFields="true" /> </PathElement> </TaintPath> </Source>
p1 box_type -> log
private synchronized int parseFileDescriptor(java.io.FileDescriptor, int, java.lang.String) { cx.hell.android.lib.pdf.PDF $this; int $p1, $opred, $12, $39_phi, $40_phi; java.lang.String $p2, $6_phi, $14_phi, $19_phi, $24_phi, $30_phi, $35_phi, $43_phi, $48_phi, $54_phi, $59_phi, $64_phi, $69_phi, $74_phi, $79_phi, $84_phi, $89_phi, $94_phi, $99_phi, $104_phi, $109_phi, $114_phi, $119_phi, $124_phi, $129_phi, $134_phi, $139_phi, $144_phi, $149_phi, $154_phi, $159_phi, $164_phi, $171_phi, $176_phi; java.io.FileDescriptor $p0; $this := @this; $p0 := @parameter0; $p1 := @parameter1; $p2 := @parameter2; $6_phi = null; $opred = org.example.NativeSummaryAux.opaqueInt(); if $opred != 1 goto label01; $6_phi = "cached descriptor field id %d"; goto label02; label01: if $opred != 2 goto label02; $6_phi = null; label02: android.util.Log.d("cx.hell.android.pdfview", $6_phi); org.example.NativeSummaryFuncs.malloc(40L); $12 = org.example.NativeSummaryFuncs.raise(8L); org.example.NativeSummaryFuncs.fprintf(null, "warning: ... repeated %d times ...\n", null, null, null); $14_phi = null; if $opred != 3 goto label03; $14_phi = "warning: ... repeated %d times ...\n"; goto label04; label03: if $opred != 4 goto label04; $14_phi = null; label04: android.util.Log.e("libmupdf", $14_phi); org.example.NativeSummaryFuncs.fprintf(null, "error: %s\n", null); $19_phi = null; if $opred != 5 goto label05; $19_phi = null; goto label06; label05: if $opred != 6 goto label06; $19_phi = "error: %s\n"; label06: android.util.Log.e("libmupdf", $19_phi); org.example.NativeSummaryFuncs.fprintf(null, "uncaught exception: %s\n", null, null, null); $24_phi = null; if $opred != 7 goto label07; $24_phi = null; goto label08; label07: if $opred != 8 goto label08; $24_phi = "uncaught exception: %s\n"; label08: android.util.Log.e("libmupdf", $24_phi); org.example.NativeSummaryFuncs.exit(1L); org.example.NativeSummaryFuncs.fprintf(null, "warning: ... repeated %d times ...\n", null, null, null); $30_phi = null; if $opred != 9 goto label09; $30_phi = "warning: ... repeated %d times ...\n"; goto label10; label09: if $opred != 10 goto label10; $30_phi = null; label10: android.util.Log.e("libmupdf", $30_phi); org.example.NativeSummaryFuncs.fprintf(null, "warning: %s\n", null); $35_phi = null; if $opred != 11 goto label11; $35_phi = null; goto label12; label11: if $opred != 12 goto label12; $35_phi = "warning: %s\n"; label12: android.util.Log.e("libmupdf", $35_phi); $39_phi = 0; if $opred != 13 goto label13; $39_phi = $p1; goto label15; label13: if $opred != 14 goto label14; $39_phi = null; goto label15; label14: if $opred != 15 goto label15; $39_phi = $12; label15: $40_phi = 0; if $opred != 16 goto label16; $40_phi = $p1; goto label18; label16: if $opred != 17 goto label17; $40_phi = null; goto label18; label17: if $opred != 18 goto label18; $40_phi = $12; label18: org.example.NativeSummaryFuncs.fprintf(null, "error: resize array (%d x %d bytes) failed (integer overflow)\n", $39_phi, $40_phi); org.example.NativeSummaryFuncs.fprintf(null, "error: %s\n", null); $43_phi = null; if $opred != 19 goto label19; $43_phi = null; goto label20; label19: if $opred != 20 goto label20; $43_phi = "error: %s\n"; label20: android.util.Log.e("libmupdf", $43_phi); org.example.NativeSummaryFuncs.fprintf(null, "uncaught exception: %s\n", null, null, null); $48_phi = null; if $opred != 21 goto label21; $48_phi = "uncaught exception: %s\n"; goto label22; label21: if $opred != 22 goto label22; $48_phi = null; label22: android.util.Log.e("libmupdf", $48_phi); org.example.NativeSummaryFuncs.exit(1L); org.example.NativeSummaryFuncs.fprintf(null, "warning: %s\n", null); $54_phi = null; if $opred != 23 goto label23; $54_phi = null; goto label24; label23: if $opred != 24 goto label24; $54_phi = "warning: %s\n"; label24: android.util.Log.e("libmupdf", $54_phi); org.example.NativeSummaryFuncs.fprintf(null, "warning: %s\n", null); $59_phi = null; if $opred != 25 goto label25; $59_phi = null; goto label26; label25: if $opred != 26 goto label26; $59_phi = "warning: %s\n"; label26: android.util.Log.e("libmupdf", $59_phi); org.example.NativeSummaryFuncs.fprintf(null, "warning: %s\n", null); $64_phi = null; if $opred != 27 goto label27; $64_phi = null; goto label28; label27: if $opred != 28 goto label28; $64_phi = "warning: %s\n"; label28: android.util.Log.e("libmupdf", $64_phi); org.example.NativeSummaryFuncs.fprintf(null, "error: %s\n", null); $69_phi = null; if $opred != 29 goto label29; $69_phi = null; goto label30; label29: if $opred != 30 goto label30; $69_phi = "error: %s\n"; label30: android.util.Log.e("libmupdf", $69_phi); org.example.NativeSummaryFuncs.fprintf(null, "error: %s\n", null); $74_phi = null; if $opred != 31 goto label31; $74_phi = null; goto label32; label31: if $opred != 32 goto label32; $74_phi = "error: %s\n"; label32: android.util.Log.e("libmupdf", $74_phi); org.example.NativeSummaryFuncs.fprintf(null, "error: %s\n", null); $79_phi = null; if $opred != 33 goto label33; $79_phi = null; goto label34; label33: if $opred != 34 goto label34; $79_phi = "error: %s\n"; label34: android.util.Log.e("libmupdf", $79_phi); org.example.NativeSummaryFuncs.fprintf(null, "error: %s\n", null); $84_phi = null; if $opred != 35 goto label35; $84_phi = null; goto label36; label35: if $opred != 36 goto label36; $84_phi = "error: %s\n"; label36: android.util.Log.e("libmupdf", $84_phi); org.example.NativeSummaryFuncs.fprintf(null, "warning: %s\n", null); $89_phi = null; if $opred != 37 goto label37; $89_phi = null; goto label38; label37: if $opred != 38 goto label38; $89_phi = "warning: %s\n"; label38: android.util.Log.e("libmupdf", $89_phi); org.example.NativeSummaryFuncs.fprintf(null, "warning: %s\n", null); $94_phi = null; if $opred != 39 goto label39; $94_phi = null; goto label40; label39: if $opred != 40 goto label40; $94_phi = "warning: %s\n"; label40: android.util.Log.e("libmupdf", $94_phi); org.example.NativeSummaryFuncs.fprintf(null, "error: %s\n", null); $99_phi = null; if $opred != 41 goto label41; $99_phi = null; goto label42; label41: if $opred != 42 goto label42; $99_phi = "error: %s\n"; label42: android.util.Log.e("libmupdf", $99_phi); org.example.NativeSummaryFuncs.fprintf(null, "error: %s\n", null); $104_phi = null; if $opred != 43 goto label43; $104_phi = null; goto label44; label43: if $opred != 44 goto label44; $104_phi = "error: %s\n"; label44: android.util.Log.e("libmupdf", $104_phi); org.example.NativeSummaryFuncs.fprintf(null, "error: %s\n", null); $109_phi = null; if $opred != 45 goto label45; $109_phi = null; goto label46; label45: if $opred != 46 goto label46; $109_phi = "error: %s\n"; label46: android.util.Log.e("libmupdf", $109_phi); org.example.NativeSummaryFuncs.fprintf(null, "warning: %s\n", null); $114_phi = null; if $opred != 47 goto label47; $114_phi = null; goto label48; label47: if $opred != 48 goto label48; $114_phi = "warning: %s\n"; label48: android.util.Log.e("libmupdf", $114_phi); org.example.NativeSummaryFuncs.fprintf(null, "error: %s\n", null); $119_phi = null; if $opred != 49 goto label49; $119_phi = null; goto label50; label49: if $opred != 50 goto label50; $119_phi = "error: %s\n"; label50: android.util.Log.e("libmupdf", $119_phi); org.example.NativeSummaryFuncs.fprintf(null, "error: %s\n", null); $124_phi = null; if $opred != 51 goto label51; $124_phi = null; goto label52; label51: if $opred != 52 goto label52; $124_phi = "error: %s\n"; label52: android.util.Log.e("libmupdf", $124_phi); org.example.NativeSummaryFuncs.fprintf(null, "error: %s\n", null); $129_phi = null; if $opred != 53 goto label53; $129_phi = null; goto label54; label53: if $opred != 54 goto label54; $129_phi = "error: %s\n"; label54: android.util.Log.e("libmupdf", $129_phi); org.example.NativeSummaryFuncs.fprintf(null, "error: %s\n", null); $134_phi = null; if $opred != 55 goto label55; $134_phi = null; goto label56; label55: if $opred != 56 goto label56; $134_phi = "error: %s\n"; label56: android.util.Log.e("libmupdf", $134_phi); org.example.NativeSummaryFuncs.fprintf(null, "error: %s\n", null); $139_phi = null; if $opred != 57 goto label57; $139_phi = null; goto label58; label57: if $opred != 58 goto label58; $139_phi = "error: %s\n"; label58: android.util.Log.e("libmupdf", $139_phi); org.example.NativeSummaryFuncs.fprintf(null, "error: %s\n", null); $144_phi = null; if $opred != 59 goto label59; $144_phi = null; goto label60; label59: if $opred != 60 goto label60; $144_phi = "error: %s\n"; label60: android.util.Log.e("libmupdf", $144_phi); org.example.NativeSummaryFuncs.fprintf(null, "error: %s\n", null); $149_phi = null; if $opred != 61 goto label61; $149_phi = null; goto label62; label61: if $opred != 62 goto label62; $149_phi = "error: %s\n"; label62: android.util.Log.e("libmupdf", $149_phi); org.example.NativeSummaryFuncs.fprintf(null, "warning: %s\n", null); $154_phi = null; if $opred != 63 goto label63; $154_phi = null; goto label64; label63: if $opred != 64 goto label64; $154_phi = "warning: %s\n"; label64: android.util.Log.e("libmupdf", $154_phi); org.example.NativeSummaryFuncs.fprintf(null, "warning: %s\n", null); $159_phi = null; if $opred != 65 goto label65; $159_phi = null; goto label66; label65: if $opred != 66 goto label66; $159_phi = "warning: %s\n"; label66: android.util.Log.e("libmupdf", $159_phi); $164_phi = null; if $opred != 67 goto label67; $164_phi = null; goto label68; label67: if $opred != 68 goto label68; $164_phi = "warning: %s\n"; label68: android.util.Log.e("libmupdf", $164_phi); org.example.NativeSummaryFuncs.fprintf(null, "warning: %s\n", null); $171_phi = null; if $opred != 69 goto label69; $171_phi = null; goto label70; label69: if $opred != 70 goto label70; $171_phi = "warning: %s\n"; label70: android.util.Log.e("libmupdf", $171_phi); org.example.NativeSummaryFuncs.fprintf(null, "error: %s\n", null); $176_phi = null; if $opred != 71 goto label71; $176_phi = null; goto label72; label71: if $opred != 72 goto label72; $176_phi = "error: %s\n"; label72: android.util.Log.e("libmupdf", $176_phi); return null; }
1 param1 logged in native log_sink
la.daube.photochiotte_32.apk Sink: <la.daube.photochiotte.MPVLib: void parsetracklist(java.lang.String)> interfaceinvoke $r3.<java.util.Map: java.lang.Object put(java.lang.Object,java.lang.Object)>($r4, $r2) Source: <la.daube.photochiotte.MPVLib: void parsetracklist(java.lang.String)> $r9 = interfaceinvoke $r2.<java.util.Map: java.lang.Object get(java.lang.Object)>("demux-h")
https://gitlab.com/LaDaubePhotoChiotte/photochiotte/-/blob/master/app/src/main/cpp/player.cpp#L228 extern "C" JNIEXPORT jstring JNICALL Java_la_daube_photochiotte_MPVLib_getProperty(JNIEnv* env, jclass thisClass, jstring jproperty, jint id) { if (!nst[id].mpv) { return NULL; } const char *prop = env->GetStringUTFChars(jproperty, NULL); char *output = mpv_get_property_string(nst[id].mpv, prop); env->ReleaseStringUTFChars(jproperty, prop); if (output == NULL) { mpv_free(output); return NULL; } jstring jvalue = env->NewStringUTF(output); mpv_free(output); return jvalue; }
$r1 = virtualinvoke r0.<la.daube.photochiotte.MPVLib: java.lang.String getProperty(java.lang.String)>("vid") $r1 = virtualinvoke r0.<la.daube.photochiotte.MPVLib: java.lang.String getProperty(java.lang.String)>("aid") $r1 = virtualinvoke r0.<la.daube.photochiotte.MPVLib: java.lang.String getProperty(java.lang.String)>("sid")
<Source Statement="$r9 = interfaceinvoke $r2.&lt;java.util.Map: java.lang.Object get(java.lang.Object)&gt;(&quot;demux-h&quot;)" Method="&lt;la.daube.photochiotte.MPVLib: void parsetracklist(java.lang.String)&gt;"> <AccessPath Value="$r9" Type="java.lang.Object" TaintSubFields="true" /> <TaintPath> <PathElement Statement="$r9 = interfaceinvoke $r2.&lt;java.util.Map: java.lang.Object get(java.lang.Object)&gt;(&quot;demux-h&quot;)" Method="&lt;la.daube.photochiotte.MPVLib: void parsetracklist(java.lang.String)&gt;"> <AccessPath Value="$r9" Type="java.lang.Object" TaintSubFields="true" /> </PathElement> <PathElement Statement="$r1 = (java.lang.String) $r9" Method="&lt;la.daube.photochiotte.MPVLib: void parsetracklist(java.lang.String)&gt;"> <AccessPath Value="$r1" Type="java.lang.String" TaintSubFields="true" /> </PathElement> <PathElement Statement="virtualinvoke $r10.&lt;java.lang.StringBuilder: java.lang.StringBuilder append(java.lang.String)&gt;($r1)" Method="&lt;la.daube.photochiotte.MPVLib: void parsetracklist(java.lang.String)&gt;"> <AccessPath Value="$r10" Type="java.lang.StringBuilder" TaintSubFields="true" /> </PathElement> <PathElement Statement="$r1 = virtualinvoke $r10.&lt;java.lang.StringBuilder: java.lang.String toString()&gt;()" Method="&lt;la.daube.photochiotte.MPVLib: void parsetracklist(java.lang.String)&gt;"> <AccessPath Value="$r1" Type="java.lang.String" TaintSubFields="true" /> </PathElement> <PathElement Statement="interfaceinvoke $r2.&lt;java.util.Map: java.lang.Object put(java.lang.Object,java.lang.Object)&gt;(&quot;pprint&quot;, $r1)" Method="&lt;la.daube.photochiotte.MPVLib: void parsetracklist(java.lang.String)&gt;"> <AccessPath Value="$r2" Type="java.util.HashMap" TaintSubFields="true"> <Fields> <Field Value="&lt;java.util.Map: java.lang.Object[] values&gt;" Type="java.lang.Object[]" /> </Fields> </AccessPath> </PathElement> <PathElement Statement="interfaceinvoke $r3.&lt;java.util.Map: java.lang.Object put(java.lang.Object,java.lang.Object)&gt;($r4, $r2)" Method="&lt;la.daube.photochiotte.MPVLib: void parsetracklist(java.lang.String)&gt;"> <AccessPath Value="$r3" Type="java.util.Map" TaintSubFields="true"> <Fields> <Field Value="&lt;java.util.Map: java.lang.Object[] values&gt;" Type="java.lang.Object[]" /> </Fields> </AccessPath> </PathElement> <PathElement Statement="$r3 = r0.&lt;la.daube.photochiotte.MPVLib: java.util.Map vida&gt;" Method="&lt;la.daube.photochiotte.MPVLib: void parsetracklist(java.lang.String)&gt;"> <AccessPath Value="r0" Type="la.daube.photochiotte.MPVLib" TaintSubFields="true"> <Fields> <Field Value="&lt;la.daube.photochiotte.MPVLib: java.util.Map vida&gt;" Type="java.util.Map" /> <Field Value="&lt;java.util.Map: java.lang.Object[] values&gt;" Type="java.lang.Object[]" /> </Fields> </AccessPath> </PathElement> <PathElement Statement="return" Method="&lt;la.daube.photochiotte.MPVLib: void parsetracklist(java.lang.String)&gt;"> <AccessPath Value="r0" Type="la.daube.photochiotte.MPVLib" TaintSubFields="true"> <Fields> <Field Value="&lt;la.daube.photochiotte.MPVLib: java.util.Map vida&gt;" Type="java.util.Map" /> <Field Value="&lt;java.util.Map: java.lang.Object[] values&gt;" Type="java.lang.Object[]" /> </Fields> </AccessPath> </PathElement> <PathElement Statement="virtualinvoke r0.&lt;la.daube.photochiotte.MPVLib: void getvid()&gt;()" Method="&lt;la.daube.photochiotte.MPVLib: java.util.ArrayList getEvents(java.nio.ByteBuffer)&gt;"> <AccessPath Value="r0" Type="la.daube.photochiotte.MPVLib" TaintSubFields="true"> <Fields> <Field Value="&lt;la.daube.photochiotte.MPVLib: java.util.Map vida&gt;" Type="java.util.Map" /> <Field Value="&lt;java.util.Map: java.lang.Object[] values&gt;" Type="java.lang.Object[]" /> </Fields> </AccessPath> </PathElement> <PathElement Statement="$r1 = virtualinvoke r0.&lt;la.daube.photochiotte.MPVLib: java.lang.String getProperty(java.lang.String)&gt;(&quot;vid&quot;)" Method="&lt;la.daube.photochiotte.MPVLib: void getvid()&gt;"> <AccessPath Value="r0" Type="la.daube.photochiotte.MPVLib" TaintSubFields="true"> <Fields> <Field Value="&lt;la.daube.photochiotte.MPVLib: java.util.Map vida&gt;" Type="java.util.Map" /> <Field Value="&lt;java.util.Map: java.lang.Object[] values&gt;" Type="java.lang.Object[]" /> </Fields> </AccessPath> </PathElement> <PathElement Statement="return $r1" Method="&lt;la.daube.photochiotte.MPVLib: java.lang.String getProperty(java.lang.String)&gt;"> <AccessPath Value="r0" Type="la.daube.photochiotte.MPVLib" TaintSubFields="true"> <Fields> <Field Value="&lt;la.daube.photochiotte.MPVLib: java.util.Map vida&gt;" Type="java.util.Map" /> <Field Value="&lt;java.util.Map: java.lang.Object[] values&gt;" Type="java.lang.Object[]" /> </Fields> </AccessPath> </PathElement> <PathElement Statement="return" Method="&lt;la.daube.photochiotte.MPVLib: void getvid()&gt;"> <AccessPath Value="r0" Type="la.daube.photochiotte.MPVLib" TaintSubFields="true"> <Fields> <Field Value="&lt;la.daube.photochiotte.MPVLib: java.util.Map vida&gt;" Type="java.util.Map" /> <Field Value="&lt;java.util.Map: java.lang.Object[] values&gt;" Type="java.lang.Object[]" /> </Fields> </AccessPath> </PathElement> <PathElement Statement="virtualinvoke r0.&lt;la.daube.photochiotte.MPVLib: void getaid()&gt;()" Method="&lt;la.daube.photochiotte.MPVLib: java.util.ArrayList getEvents(java.nio.ByteBuffer)&gt;"> <AccessPath Value="r0" Type="la.daube.photochiotte.MPVLib" TaintSubFields="true"> <Fields> <Field Value="&lt;la.daube.photochiotte.MPVLib: java.util.Map vida&gt;" Type="java.util.Map" /> <Field Value="&lt;java.util.Map: java.lang.Object[] values&gt;" Type="java.lang.Object[]" /> </Fields> </AccessPath> </PathElement> <PathElement Statement="$r1 = virtualinvoke r0.&lt;la.daube.photochiotte.MPVLib: java.lang.String getProperty(java.lang.String)&gt;(&quot;aid&quot;)" Method="&lt;la.daube.photochiotte.MPVLib: void getaid()&gt;"> <AccessPath Value="r0" Type="la.daube.photochiotte.MPVLib" TaintSubFields="true"> <Fields> <Field Value="&lt;la.daube.photochiotte.MPVLib: java.util.Map vida&gt;" Type="java.util.Map" /> <Field Value="&lt;java.util.Map: java.lang.Object[] values&gt;" Type="java.lang.Object[]" /> </Fields> </AccessPath> </PathElement> <PathElement Statement="return $r1" Method="&lt;la.daube.photochiotte.MPVLib: java.lang.String getProperty(java.lang.String)&gt;"> <AccessPath Value="r0" Type="la.daube.photochiotte.MPVLib" TaintSubFields="true"> <Fields> <Field Value="&lt;la.daube.photochiotte.MPVLib: java.util.Map vida&gt;" Type="java.util.Map" /> <Field Value="&lt;java.util.Map: java.lang.Object[] values&gt;" Type="java.lang.Object[]" /> </Fields> </AccessPath> </PathElement> <PathElement Statement="return" Method="&lt;la.daube.photochiotte.MPVLib: void getaid()&gt;"> <AccessPath Value="r0" Type="la.daube.photochiotte.MPVLib" TaintSubFields="true"> <Fields> <Field Value="&lt;la.daube.photochiotte.MPVLib: java.util.Map vida&gt;" Type="java.util.Map" /> <Field Value="&lt;java.util.Map: java.lang.Object[] values&gt;" Type="java.lang.Object[]" /> </Fields> </AccessPath> </PathElement> <PathElement Statement="virtualinvoke r0.&lt;la.daube.photochiotte.MPVLib: void getsid()&gt;()" Method="&lt;la.daube.photochiotte.MPVLib: java.util.ArrayList getEvents(java.nio.ByteBuffer)&gt;"> <AccessPath Value="r0" Type="la.daube.photochiotte.MPVLib" TaintSubFields="true"> <Fields> <Field Value="&lt;la.daube.photochiotte.MPVLib: java.util.Map vida&gt;" Type="java.util.Map" /> <Field Value="&lt;java.util.Map: java.lang.Object[] values&gt;" Type="java.lang.Object[]" /> </Fields> </AccessPath> </PathElement> <PathElement Statement="$r1 = virtualinvoke r0.&lt;la.daube.photochiotte.MPVLib: java.lang.String getProperty(java.lang.String)&gt;(&quot;sid&quot;)" Method="&lt;la.daube.photochiotte.MPVLib: void getsid()&gt;"> <AccessPath Value="r0" Type="la.daube.photochiotte.MPVLib" TaintSubFields="true"> <Fields> <Field Value="&lt;la.daube.photochiotte.MPVLib: java.util.Map vida&gt;" Type="java.util.Map" /> <Field Value="&lt;java.util.Map: java.lang.Object[] values&gt;" Type="java.lang.Object[]" /> </Fields> </AccessPath> </PathElement> <PathElement Statement="return $r1" Method="&lt;la.daube.photochiotte.MPVLib: java.lang.String getProperty(java.lang.String)&gt;"> <AccessPath Value="r0" Type="la.daube.photochiotte.MPVLib" TaintSubFields="true"> <Fields> <Field Value="&lt;la.daube.photochiotte.MPVLib: java.util.Map vida&gt;" Type="java.util.Map" /> <Field Value="&lt;java.util.Map: java.lang.Object[] values&gt;" Type="java.lang.Object[]" /> </Fields> </AccessPath> </PathElement> <PathElement Statement="return" Method="&lt;la.daube.photochiotte.MPVLib: void getsid()&gt;"> <AccessPath Value="r0" Type="la.daube.photochiotte.MPVLib" TaintSubFields="true"> <Fields> <Field Value="&lt;la.daube.photochiotte.MPVLib: java.util.Map vida&gt;" Type="java.util.Map" /> <Field Value="&lt;java.util.Map: java.lang.Object[] values&gt;" Type="java.lang.Object[]" /> </Fields> </AccessPath> </PathElement> <PathElement Statement="virtualinvoke r0.&lt;la.daube.photochiotte.MPVLib: void parsetracklist(java.lang.String)&gt;($r5)" Method="&lt;la.daube.photochiotte.MPVLib: java.util.ArrayList getEvents(java.nio.ByteBuffer)&gt;"> <AccessPath Value="r0" Type="la.daube.photochiotte.MPVLib" TaintSubFields="true"> <Fields> <Field Value="&lt;la.daube.photochiotte.MPVLib: java.util.Map vida&gt;" Type="java.util.Map" /> <Field Value="&lt;java.util.Map: java.lang.Object[] values&gt;" Type="java.lang.Object[]" /> </Fields> </AccessPath> </PathElement> <PathElement Statement="$r3 = r0.&lt;la.daube.photochiotte.MPVLib: java.util.Map vida&gt;" Method="&lt;la.daube.photochiotte.MPVLib: void parsetracklist(java.lang.String)&gt;"> <AccessPath Value="$r3" Type="java.util.Map" TaintSubFields="true"> <Fields> <Field Value="&lt;java.util.Map: java.lang.Object[] values&gt;" Type="java.lang.Object[]" /> </Fields> </AccessPath> </PathElement> <PathElement Statement="interfaceinvoke $r3.&lt;java.util.Map: java.lang.Object put(java.lang.Object,java.lang.Object)&gt;($r4, $r2)" Method="&lt;la.daube.photochiotte.MPVLib: void parsetracklist(java.lang.String)&gt;"> <AccessPath Value="$r3" Type="java.util.Map" TaintSubFields="true"> <Fields> <Field Value="&lt;java.util.Map: java.lang.Object[] values&gt;" Type="java.lang.Object[]" /> </Fields> </AccessPath> </PathElement> </TaintPath> </Source>
instance -> instance
public static java.lang.String getProperty(java.lang.String, int) { int $p1; java.lang.String $p0; $p0 := @parameter0; $p1 := @parameter1; return null; }
1 the dataflow is not related with native code none
org.echoline.drawterm_2.apk Sink: <org.echoline.drawterm.MainActivity: void setMouse(int[])> staticinvoke <org.example.NativeSummaryFuncs: int GetArrayLength(java.lang.Object,int[])>(null, $r1) Source: <org.echoline.drawterm.MySurfaceView$1: boolean onTouch(android.view.View,android.view.MotionEvent)> $f0 = virtualinvoke $r2.<android.view.MotionEvent: float getX()>()
https://github.com/echoline/drawterm-android/blob/44a6233949f975bc04b4052650c818cf24247e1a/gui-android/cpp/native-lib.c#L122 JNIEXPORT void JNICALL Java_org_echoline_drawterm_MainActivity_setMouse( JNIEnv *env, jobject obj, jintArray args) { jboolean isCopy; jint *data; if ((*env)->GetArrayLength(env, args) < 3) return; data = (*env)->GetIntArrayElements(env, args, &isCopy); mousept.x = (int)(data[0] / ws); mousept.y = (int)(data[1] / hs); buttons = data[2]; (*env)->ReleaseIntArrayElements(env, args, data, 0); absmousetrack(mousept.x, mousept.y, buttons, ticks()); }
virtualinvoke $r4.<org.echoline.drawterm.MainActivity: void setMouse(int[])>($r10) staticinvoke <org.example.NativeSummaryFuncs: int GetArrayLength(java.lang.Object,int[])>(null, $r1)
<Source Statement="$f0 = virtualinvoke $r2.&lt;android.view.MotionEvent: float getX()&gt;()" Method="&lt;org.echoline.drawterm.MySurfaceView$1: boolean onTouch(android.view.View,android.view.MotionEvent)&gt;"> <AccessPath Value="$f0" Type="float" TaintSubFields="true" /> <TaintPath> <PathElement Statement="$f0 = virtualinvoke $r2.&lt;android.view.MotionEvent: float getX()&gt;()" Method="&lt;org.echoline.drawterm.MySurfaceView$1: boolean onTouch(android.view.View,android.view.MotionEvent)&gt;"> <AccessPath Value="$f0" Type="float" TaintSubFields="true" /> </PathElement> <PathElement Statement="$i2 = staticinvoke &lt;java.lang.Math: int round(float)&gt;($f0)" Method="&lt;org.echoline.drawterm.MySurfaceView$1: boolean onTouch(android.view.View,android.view.MotionEvent)&gt;"> <AccessPath Value="$i2" Type="int" TaintSubFields="true" /> </PathElement> <PathElement Statement="$r10[0] = $i2" Method="&lt;org.echoline.drawterm.MySurfaceView$1: boolean onTouch(android.view.View,android.view.MotionEvent)&gt;"> <AccessPath Value="$r10" Type="int[]" TaintSubFields="true" /> </PathElement> <PathElement Statement="$r10 = r0.&lt;org.echoline.drawterm.MySurfaceView$1: int[] mouse&gt;" Method="&lt;org.echoline.drawterm.MySurfaceView$1: boolean onTouch(android.view.View,android.view.MotionEvent)&gt;"> <AccessPath Value="r0" Type="org.echoline.drawterm.MySurfaceView$1" TaintSubFields="true"> <Fields> <Field Value="&lt;org.echoline.drawterm.MySurfaceView$1: int[] mouse&gt;" Type="int[]" /> </Fields> </AccessPath> </PathElement> <PathElement Statement="$r10 = r0.&lt;org.echoline.drawterm.MySurfaceView$1: int[] mouse&gt;" Method="&lt;org.echoline.drawterm.MySurfaceView$1: boolean onTouch(android.view.View,android.view.MotionEvent)&gt;"> <AccessPath Value="$r10" Type="int[]" TaintSubFields="true" /> </PathElement> <PathElement Statement="virtualinvoke $r4.&lt;org.echoline.drawterm.MainActivity: void setMouse(int[])&gt;($r10)" Method="&lt;org.echoline.drawterm.MySurfaceView$1: boolean onTouch(android.view.View,android.view.MotionEvent)&gt;"> <AccessPath Value="$r1" Type="int[]" TaintSubFields="true" /> </PathElement> <PathElement Statement="staticinvoke &lt;org.example.NativeSummaryFuncs: int GetArrayLength(java.lang.Object,int[])&gt;(null, $r1)" Method="&lt;org.echoline.drawterm.MainActivity: void setMouse(int[])&gt;"> <AccessPath Value="$r1" Type="int[]" TaintSubFields="true" /> </PathElement> </TaintPath> </Source>
the param1 -> GetArrayLength
public void setMouse(int[]) { org.echoline.drawterm.MainActivity $this; int[] $p0; $this := @this; $p0 := @parameter0; org.example.NativeSummaryFuncs.GetArrayLength(null, $p0); org.example.NativeSummaryFuncs.write(2L, null, null); return; }
1 get the length of jarray param0 nsfunc_sink
com.jecelyin.editor_39.apk Sink: <org.mozilla.charsetdetector.CharsetDetector: java.lang.String get_encoding(java.lang.String)> $i0 = staticinvoke <org.example.NativeSummaryFuncs: int fopen(java.lang.String,java.lang.String)>($r0, "rb") Source: <com.jecelyin.editor.AsyncReadFile$1: void run()> $r8 = virtualinvoke r7.<java.io.File: java.lang.String getAbsolutePath()>()
https://github.com/arfoll/920-Text-Editor/blob/954e3ccbeb2f7bc6f70fbe5259bff5563ef7c51e/jni/charset-detector/org_mozilla_charsetdetector_CharsetDetector.cpp#L8 JNIEXPORT jstring JNICALL Java_org_mozilla_charsetdetector_CharsetDetector_get_1encoding( JNIEnv *env, jclass jclazz, jstring file) { const char * path; jboolean iscopy; path = env->GetStringUTFChars(file, &iscopy); char buf[4096]; char encoding[CHARDET_MAX_ENCODING_NAME]; size_t len; int res = 0; chardet_t det = NULL; FILE* fp = NULL; chardet_create(&det); fp = fopen(path, "rb"); do { len = fread(buf, 1, sizeof(buf), fp); res = chardet_handle_data(det, buf, len); } while (res==CHARDET_RESULT_OK && feof(fp)==0); fclose(fp); chardet_data_end(det); int result = chardet_get_charset(det, encoding, CHARDET_MAX_ENCODING_NAME); chardet_destroy(det); env->ReleaseStringUTFChars(file, path); if (result == CHARDET_RESULT_OK) { return env->NewStringUTF(encoding); } return 0; }
$r0 = staticinvoke <org.mozilla.charsetdetector.CharsetDetector: java.lang.String get_encoding(java.lang.String)>($r0) $i0 = staticinvoke <org.example.NativeSummaryFuncs: int fopen(java.lang.String,java.lang.String)>($r0, "rb")
<Source Statement="$r8 = virtualinvoke r7.&lt;java.io.File: java.lang.String getAbsolutePath()&gt;()" Method="&lt;com.jecelyin.editor.AsyncReadFile$1: void run()&gt;"> <AccessPath Value="$r8" Type="java.lang.String" TaintSubFields="true" /> <TaintPath> <PathElement Statement="$r8 = virtualinvoke r7.&lt;java.io.File: java.lang.String getAbsolutePath()&gt;()" Method="&lt;com.jecelyin.editor.AsyncReadFile$1: void run()&gt;"> <AccessPath Value="$r8" Type="java.lang.String" TaintSubFields="true" /> </PathElement> <PathElement Statement="r9 = $r8" Method="&lt;com.jecelyin.editor.AsyncReadFile$1: void run()&gt;"> <AccessPath Value="r9" Type="java.lang.String" TaintSubFields="true" /> </PathElement> <PathElement Statement="$r8 = staticinvoke &lt;com.jecelyin.editor.AsyncReadFile: java.lang.String access$200(com.jecelyin.editor.AsyncReadFile,java.lang.String)&gt;($r2, r9)" Method="&lt;com.jecelyin.editor.AsyncReadFile$1: void run()&gt;"> <AccessPath Value="$r1" Type="java.lang.String" TaintSubFields="true" /> </PathElement> <PathElement Statement="$r1 = specialinvoke $r0.&lt;com.jecelyin.editor.AsyncReadFile: java.lang.String getEncoding(java.lang.String)&gt;($r1)" Method="&lt;com.jecelyin.editor.AsyncReadFile: java.lang.String access$200(com.jecelyin.editor.AsyncReadFile,java.lang.String)&gt;"> <AccessPath Value="$r1" Type="java.lang.String" TaintSubFields="true" /> </PathElement> <PathElement Statement="$r1 = staticinvoke &lt;org.mozilla.charsetdetector.CharsetDetector: java.lang.String getEncoding(java.lang.String)&gt;($r1)" Method="&lt;com.jecelyin.editor.AsyncReadFile: java.lang.String getEncoding(java.lang.String)&gt;"> <AccessPath Value="$r0" Type="java.lang.String" TaintSubFields="true" /> </PathElement> <PathElement Statement="$r0 = staticinvoke &lt;org.mozilla.charsetdetector.CharsetDetector: java.lang.String get_encoding(java.lang.String)&gt;($r0)" Method="&lt;org.mozilla.charsetdetector.CharsetDetector: java.lang.String getEncoding(java.lang.String)&gt;"> <AccessPath Value="$r0" Type="java.lang.String" TaintSubFields="true" /> </PathElement> <PathElement Statement="$i0 = staticinvoke &lt;org.example.NativeSummaryFuncs: int fopen(java.lang.String,java.lang.String)&gt;($r0, &quot;rb&quot;)" Method="&lt;org.mozilla.charsetdetector.CharsetDetector: java.lang.String get_encoding(java.lang.String)&gt;"> <AccessPath Value="$r0" Type="java.lang.String" TaintSubFields="true" /> </PathElement> </TaintPath> </Source>
param0 path -> fopen
private static java.lang.String get_encoding(java.lang.String) { int $3, $4, $35; java.lang.String $p0; $p0 := @parameter0; org.example.NativeSummaryFuncs.operator.new(44L); $3 = org.example.NativeSummaryFuncs.fopen($p0, "rb"); $4 = org.example.NativeSummaryFuncs.fread(null, 1L, 4096L, $3); org.example.NativeSummaryFuncs.operator.new(52L); org.example.NativeSummaryFuncs.operator.new(16L); org.example.NativeSummaryFuncs.operator.new(16L); org.example.NativeSummaryFuncs.operator.new(88L); org.example.NativeSummaryFuncs.operator.new(16L); org.example.NativeSummaryFuncs.operator.new(88L); org.example.NativeSummaryFuncs.operator.new(16L); org.example.NativeSummaryFuncs.operator.new(44L); org.example.NativeSummaryFuncs.operator.new(16L); org.example.NativeSummaryFuncs.operator.new(44L); org.example.NativeSummaryFuncs.operator.new(16L); org.example.NativeSummaryFuncs.operator.new(44L); org.example.NativeSummaryFuncs.operator.new(16L); org.example.NativeSummaryFuncs.operator.new(44L); org.example.NativeSummaryFuncs.operator.new(16L); org.example.NativeSummaryFuncs.operator.new(84L); org.example.NativeSummaryFuncs.operator.new(48L); org.example.NativeSummaryFuncs.operator.new(48L); org.example.NativeSummaryFuncs.operator.new(48L); org.example.NativeSummaryFuncs.operator.new(48L); org.example.NativeSummaryFuncs.operator.new(48L); org.example.NativeSummaryFuncs.operator.new(48L); org.example.NativeSummaryFuncs.operator.new(48L); org.example.NativeSummaryFuncs.operator.new(48L); org.example.NativeSummaryFuncs.operator.new(48L); org.example.NativeSummaryFuncs.operator.new(48L); org.example.NativeSummaryFuncs.operator.new(24L); org.example.NativeSummaryFuncs.operator.new(48L); org.example.NativeSummaryFuncs.operator.new(48L); org.example.NativeSummaryFuncs.operator.new(28L); $35 = org.example.NativeSummaryFuncs.malloc($4); org.example.NativeSummaryFuncs.free($35); org.example.NativeSummaryFuncs.operator.new(32L); org.example.NativeSummaryFuncs.operator.new(16L); org.example.NativeSummaryFuncs.operator.new(16L); org.example.NativeSummaryFuncs.operator.new(16L); org.example.NativeSummaryFuncs.operator.new(16L); org.example.NativeSummaryFuncs.fclose($3); org.example.NativeSummaryFuncs.strdup($4); return null; }
1 the path is opened in native nsfunc_sink fopen
cc.echonet.coolmicapp_10300.apk Sink: <cc.echonet.coolmicdspjava.Wrapper: int setReconnectionProfile(java.lang.String)> staticinvoke <android.util.Log: int d(java.lang.String,java.lang.String)>("wrapper.c", $r2) Source: <cc.echonet.coolmicapp.BackgroundService.Server.Driver: cc.echonet.coolmicdspjava.WrapperConstants$WrapperInitializationStatus initWrapper()> $r3 = virtualinvoke $r3.<android.content.Context: android.content.Context getApplicationContext()>()
https://github.com/CoolMicApp/CoolMicApp-Android/blob/4810d260d8f405ecadb6eef92da701f20d8e3dff/app/src/main/jni/libcoolmic-dsp-java/wrapper.c#L477 JNIEXPORT jint JNICALL Java_cc_echonet_coolmicdspjava_Wrapper_setReconnectionProfile(JNIEnv *env, jobject obj, jstring profile_) { wrapper_t * wrapper = get_wrapper_t(env, obj); const char *profile = (*env)->GetStringUTFChars(env, profile_, 0); LOGI("setReconnectionProfile profile=%s", profile); if (wrapper->coolmic_simple_obj == NULL) { LOGI("setReconnectionProfile bailing - no core obj"); return -999666; } jint result = coolmic_simple_set_reconnection_profile(wrapper->coolmic_simple_obj, profile); (*env)->ReleaseStringUTFChars(env, profile_, profile); LOGI("setReconnectionProfile result=%i", (int)result); return result; } static wrapper_t *get_wrapper_t(JNIEnv *env, jobject obj) { jclass cls = (*env)->GetObjectClass(env, obj); jfieldID fidNativeObject = (*env)->GetFieldID(env, cls, "nativeObject", "J"); wrapper_t * wrapper = (void*)(jlong)(*env)->GetLongField(env, obj, fidNativeObject); LOGI("wrapper=%p", wrapper); if (wrapper == NULL) { wrapper = calloc(1, sizeof(wrapper_t)); wrapper->vumeter_result_class = (*env)->NewGlobalRef(env, (*env)->FindClass(env, "cc/echonet/coolmicdspjava/VUMeterResult")); wrapper->wrapper_callback_events_class = (*env)->NewGlobalRef(env, (*env)->FindClass(env, "cc/echonet/coolmicdspjava/WrapperConstants$WrapperCallbackEvents")); (*env)->SetLongField(env, obj, fidNativeObject, wrapper); } return wrapper; }
virtualinvoke $r10.<cc.echonet.coolmicdspjava.Wrapper: int setReconnectionProfile(java.lang.String)>("enabled")
<Source Statement="$r3 = virtualinvoke $r3.&lt;android.content.Context: android.content.Context getApplicationContext()&gt;()" Method="&lt;cc.echonet.coolmicapp.BackgroundService.Server.Driver: cc.echonet.coolmicdspjava.WrapperConstants$WrapperInitializationStatus initWrapper()&gt;"> <AccessPath Value="$r3" Type="android.content.Context" TaintSubFields="true" /> <TaintPath> <PathElement Statement="$r3 = virtualinvoke $r3.&lt;android.content.Context: android.content.Context getApplicationContext()&gt;()" Method="&lt;cc.echonet.coolmicapp.BackgroundService.Server.Driver: cc.echonet.coolmicdspjava.WrapperConstants$WrapperInitializationStatus initWrapper()&gt;"> <AccessPath Value="$r3" Type="android.content.Context" TaintSubFields="true" /> </PathElement> <PathElement Statement="$r3 = r0.&lt;cc.echonet.coolmicapp.BackgroundService.Server.Driver: android.content.Context context&gt;" Method="&lt;cc.echonet.coolmicapp.BackgroundService.Server.Driver: cc.echonet.coolmicdspjava.WrapperConstants$WrapperInitializationStatus initWrapper()&gt;"> <AccessPath Value="r0" Type="cc.echonet.coolmicapp.BackgroundService.Server.Driver" TaintSubFields="true"> <Fields> <Field Value="&lt;cc.echonet.coolmicapp.BackgroundService.Server.Driver: android.content.Context context&gt;" Type="android.content.Context" /> </Fields> </AccessPath> </PathElement> <PathElement Statement="r0 := @this: cc.echonet.coolmicapp.BackgroundService.Server.Driver" Method="&lt;cc.echonet.coolmicapp.BackgroundService.Server.Driver: cc.echonet.coolmicdspjava.WrapperConstants$WrapperInitializationStatus initWrapper()&gt;"> <AccessPath Value="r0" Type="cc.echonet.coolmicapp.BackgroundService.Server.Driver" TaintSubFields="true"> <Fields> <Field Value="&lt;cc.echonet.coolmicapp.BackgroundService.Server.Driver: android.content.Context context&gt;" Type="android.content.Context" /> </Fields> </AccessPath> </PathElement> <PathElement Statement="r0.&lt;cc.echonet.coolmicapp.BackgroundService.Server.Driver: android.content.Context context&gt; = $r3" Method="&lt;cc.echonet.coolmicapp.BackgroundService.Server.Driver: void &lt;init&gt;(android.content.Context,cc.echonet.coolmicapp.Configuration.Profile,cc.echonet.coolmicdspjava.CallbackHandler)&gt;"> <AccessPath Value="$r3" Type="android.content.Context" TaintSubFields="true" /> </PathElement> <PathElement Statement="r0 := @this: cc.echonet.coolmicapp.BackgroundService.Server.Driver" Method="&lt;cc.echonet.coolmicapp.BackgroundService.Server.Driver: void &lt;init&gt;(android.content.Context,cc.echonet.coolmicapp.Configuration.Profile,cc.echonet.coolmicdspjava.CallbackHandler)&gt;"> <AccessPath Value="r0" Type="cc.echonet.coolmicapp.BackgroundService.Server.Server" TaintSubFields="true" /> </PathElement> <PathElement Statement="specialinvoke $r3.&lt;cc.echonet.coolmicapp.Configuration.Manager: void &lt;init&gt;(android.content.Context)&gt;(r0)" Method="&lt;cc.echonet.coolmicapp.BackgroundService.Server.Server: void attachBaseContext(android.content.Context)&gt;"> <AccessPath Value="$r1" Type="cc.echonet.coolmicapp.BackgroundService.Server.Server" TaintSubFields="true" /> </PathElement> <PathElement Statement="specialinvoke $r2.&lt;cc.echonet.coolmicapp.Configuration.GlobalConfiguration: void &lt;init&gt;(android.content.Context)&gt;($r1)" Method="&lt;cc.echonet.coolmicapp.Configuration.Manager: void &lt;init&gt;(android.content.Context)&gt;"> <AccessPath Value="$r2" Type="cc.echonet.coolmicapp.BackgroundService.Server.Server" TaintSubFields="true" /> </PathElement> <PathElement Statement="r0 := @this: cc.echonet.coolmicapp.Configuration.GlobalConfiguration" Method="&lt;cc.echonet.coolmicapp.Configuration.GlobalConfiguration: void &lt;init&gt;(android.content.Context)&gt;"> <AccessPath Value="$r1" Type="cc.echonet.coolmicapp.BackgroundService.Server.Server" TaintSubFields="true" /> </PathElement> <PathElement Statement="r0 := @this: cc.echonet.coolmicapp.Configuration.Manager" Method="&lt;cc.echonet.coolmicapp.Configuration.Manager: void &lt;init&gt;(android.content.Context)&gt;"> <AccessPath Value="r0" Type="cc.echonet.coolmicapp.BackgroundService.Server.Server" TaintSubFields="true" /> </PathElement> <PathElement Statement="r0 := @this: cc.echonet.coolmicapp.BackgroundService.Server.Server" Method="&lt;cc.echonet.coolmicapp.BackgroundService.Server.Server: void attachBaseContext(android.content.Context)&gt;"> <AccessPath Value="$r0" Type="cc.echonet.coolmicapp.BackgroundService.Server.Server" TaintSubFields="true" /> </PathElement> <PathElement Statement="specialinvoke $r0.&lt;cc.echonet.coolmicapp.BackgroundService.Server.Server: void &lt;init&gt;()&gt;()" Method="&lt;dummyMainClass: cc.echonet.coolmicapp.BackgroundService.Server.Server dummyMainMethod_cc_echonet_coolmicapp_BackgroundService_Server_Server(android.content.Intent)&gt;"> <AccessPath Value="r0" Type="cc.echonet.coolmicapp.BackgroundService.Server.Server" TaintSubFields="true" /> </PathElement> <PathElement Statement="specialinvoke $r1.&lt;cc.echonet.coolmicapp.BackgroundService.Server.Server$IncomingHandler: void &lt;init&gt;(cc.echonet.coolmicapp.BackgroundService.Server.Server)&gt;(r0)" Method="&lt;cc.echonet.coolmicapp.BackgroundService.Server.Server: void &lt;init&gt;()&gt;"> <AccessPath Value="$r1" Type="cc.echonet.coolmicapp.BackgroundService.Server.Server" TaintSubFields="true" /> </PathElement> <PathElement Statement="r0 := @this: cc.echonet.coolmicapp.BackgroundService.Server.Server$IncomingHandler" Method="&lt;cc.echonet.coolmicapp.BackgroundService.Server.Server$IncomingHandler: void &lt;init&gt;(cc.echonet.coolmicapp.BackgroundService.Server.Server)&gt;"> <AccessPath Value="r0" Type="cc.echonet.coolmicapp.BackgroundService.Server.Server" TaintSubFields="true" /> </PathElement> <PathElement Statement="r0 := @this: cc.echonet.coolmicapp.BackgroundService.Server.Server" Method="&lt;cc.echonet.coolmicapp.BackgroundService.Server.Server: void &lt;init&gt;()&gt;"> <AccessPath Value="$r0" Type="cc.echonet.coolmicapp.BackgroundService.Server.Server" TaintSubFields="true" /> </PathElement> <PathElement Statement="virtualinvoke $r0.&lt;cc.echonet.coolmicapp.BackgroundService.Server.Server: int onStartCommand(android.content.Intent,int,int)&gt;(null, 0, 0)" Method="&lt;dummyMainClass: cc.echonet.coolmicapp.BackgroundService.Server.Server dummyMainMethod_cc_echonet_coolmicapp_BackgroundService_Server_Server(android.content.Intent)&gt;"> <AccessPath Value="r0" Type="cc.echonet.coolmicapp.BackgroundService.Server.Server" TaintSubFields="true" /> </PathElement> <PathElement Statement="$r6 = r0.&lt;cc.echonet.coolmicapp.BackgroundService.Server.Server: cc.echonet.coolmicapp.BackgroundService.Server.Server$IncomingHandler mIncomingHandler&gt;" Method="&lt;cc.echonet.coolmicapp.BackgroundService.Server.Server: int onStartCommand(android.content.Intent,int,int)&gt;"> <AccessPath Value="$r6" Type="cc.echonet.coolmicapp.BackgroundService.Server.Server$IncomingHandler" TaintSubFields="true" /> </PathElement> <PathElement Statement="virtualinvoke $r6.&lt;cc.echonet.coolmicapp.BackgroundService.Server.Server$IncomingHandler: void handleMessage(android.os.Message)&gt;($r4)" Method="&lt;cc.echonet.coolmicapp.BackgroundService.Server.Server: int onStartCommand(android.content.Intent,int,int)&gt;"> <AccessPath Value="r0" Type="cc.echonet.coolmicapp.BackgroundService.Server.Server$IncomingHandler" TaintSubFields="true" /> </PathElement> <PathElement Statement="$r1 = r0.&lt;cc.echonet.coolmicapp.BackgroundService.Server.Server$IncomingHandler: cc.echonet.coolmicapp.BackgroundService.Server.Server service&gt;" Method="&lt;cc.echonet.coolmicapp.BackgroundService.Server.Server$IncomingHandler: void handleMessage(android.os.Message)&gt;"> <AccessPath Value="$r1" Type="cc.echonet.coolmicapp.BackgroundService.Server.Server" TaintSubFields="true" /> </PathElement> <PathElement Statement="$r9 = staticinvoke &lt;cc.echonet.coolmicapp.BackgroundService.Server.Server: cc.echonet.coolmicapp.BackgroundService.Server.Driver access$400(cc.echonet.coolmicapp.BackgroundService.Server.Server)&gt;($r1)" Method="&lt;cc.echonet.coolmicapp.BackgroundService.Server.Server$IncomingHandler: void handleMessage(android.os.Message)&gt;"> <AccessPath Value="$r1" Type="cc.echonet.coolmicapp.BackgroundService.Server.Server" TaintSubFields="true" /> </PathElement> <PathElement Statement="$r0 = specialinvoke $r1.&lt;cc.echonet.coolmicapp.BackgroundService.Server.Server: cc.echonet.coolmicapp.BackgroundService.Server.Driver getDriver()&gt;()" Method="&lt;cc.echonet.coolmicapp.BackgroundService.Server.Server: cc.echonet.coolmicapp.BackgroundService.Server.Driver access$400(cc.echonet.coolmicapp.BackgroundService.Server.Server)&gt;"> <AccessPath Value="r0" Type="cc.echonet.coolmicapp.BackgroundService.Server.Server" TaintSubFields="true" /> </PathElement> <PathElement Statement="r1 = r0.&lt;cc.echonet.coolmicapp.BackgroundService.Server.Server: cc.echonet.coolmicapp.BackgroundService.Server.Driver driver&gt;" Method="&lt;cc.echonet.coolmicapp.BackgroundService.Server.Server: cc.echonet.coolmicapp.BackgroundService.Server.Driver getDriver()&gt;"> <AccessPath Value="r1" Type="cc.echonet.coolmicapp.BackgroundService.Server.Driver" TaintSubFields="true" /> </PathElement> <PathElement Statement="return r1" Method="&lt;cc.echonet.coolmicapp.BackgroundService.Server.Server: cc.echonet.coolmicapp.BackgroundService.Server.Driver getDriver()&gt;"> <AccessPath Value="$r0" Type="cc.echonet.coolmicapp.BackgroundService.Server.Driver" TaintSubFields="true" /> </PathElement> <PathElement Statement="return $r0" Method="&lt;cc.echonet.coolmicapp.BackgroundService.Server.Server: cc.echonet.coolmicapp.BackgroundService.Server.Driver access$400(cc.echonet.coolmicapp.BackgroundService.Server.Server)&gt;"> <AccessPath Value="$r9" Type="cc.echonet.coolmicapp.BackgroundService.Server.Driver" TaintSubFields="true" /> </PathElement> <PathElement Statement="virtualinvoke $r9.&lt;cc.echonet.coolmicapp.BackgroundService.Server.Driver: void reloadParameters(boolean)&gt;(1)" Method="&lt;cc.echonet.coolmicapp.BackgroundService.Server.Server$IncomingHandler: void handleMessage(android.os.Message)&gt;"> <AccessPath Value="r0" Type="cc.echonet.coolmicapp.BackgroundService.Server.Driver" TaintSubFields="true" /> </PathElement> <PathElement Statement="$r10 = r0.&lt;cc.echonet.coolmicapp.BackgroundService.Server.Driver: cc.echonet.coolmicdspjava.Wrapper wrapper&gt;" Method="&lt;cc.echonet.coolmicapp.BackgroundService.Server.Driver: void reloadParameters(boolean)&gt;"> <AccessPath Value="$r10" Type="cc.echonet.coolmicdspjava.Wrapper" TaintSubFields="true" /> </PathElement> <PathElement Statement="virtualinvoke $r10.&lt;cc.echonet.coolmicdspjava.Wrapper: int setReconnectionProfile(java.lang.String)&gt;(&quot;enabled&quot;)" Method="&lt;cc.echonet.coolmicapp.BackgroundService.Server.Driver: void reloadParameters(boolean)&gt;"> <AccessPath Value="r1" Type="cc.echonet.coolmicdspjava.Wrapper" TaintSubFields="true" /> </PathElement> <PathElement Statement="$l0 = r1.&lt;cc.echonet.coolmicdspjava.Wrapper: long nativeObject&gt;" Method="&lt;cc.echonet.coolmicdspjava.Wrapper: int setReconnectionProfile(java.lang.String)&gt;"> <AccessPath Value="$l0" Type="long" TaintSubFields="true" /> </PathElement> <PathElement Statement="$r3 = staticinvoke &lt;java.lang.Long: java.lang.Long valueOf(long)&gt;($l0)" Method="&lt;cc.echonet.coolmicdspjava.Wrapper: int setReconnectionProfile(java.lang.String)&gt;"> <AccessPath Value="$r3" Type="java.lang.Long" TaintSubFields="true" /> </PathElement> <PathElement Statement="$r2 = virtualinvoke $r3.&lt;java.lang.Long: java.lang.String toString()&gt;()" Method="&lt;cc.echonet.coolmicdspjava.Wrapper: int setReconnectionProfile(java.lang.String)&gt;"> <AccessPath Value="$r2" Type="java.lang.String" TaintSubFields="true" /> </PathElement> <PathElement Statement="staticinvoke &lt;android.util.Log: int d(java.lang.String,java.lang.String)&gt;(&quot;wrapper.c&quot;, $r2)" Method="&lt;cc.echonet.coolmicdspjava.Wrapper: int setReconnectionProfile(java.lang.String)&gt;"> <AccessPath Value="$r2" Type="java.lang.String" TaintSubFields="true" /> </PathElement> </TaintPath> </Source>
this.nativeObject -> Log
public synchronized int setReconnectionProfile(java.lang.String) { cc.echonet.coolmicdspjava.Wrapper $this; long $2; java.lang.Long boxed; int $opred, $7; java.lang.String $p0, $3_phi, $casted, $15_phi, $20_phi, $26_phi; $this := @this; $p0 := @parameter0; $2 = $this.nativeObject; $3_phi = null; $opred = org.example.NativeSummaryAux.opaqueInt(); if $opred != 1 goto label1; boxed = java.lang.Long.valueOf($2); $casted = virtualinvoke boxed.toString(); $3_phi = $casted; goto label2; label1: if $opred != 2 goto label2; $3_phi = "wrapper=%p"; label2: android.util.Log.d("wrapper.c", $3_phi); $7 = org.example.NativeSummaryFuncs.calloc(1L, 56L); $this.nativeObject = $7; $15_phi = null; if $opred != 3 goto label3; $15_phi = "setReconnectionProfile profile=%s"; goto label4; label3: if $opred != 4 goto label4; $15_phi = $p0; label4: android.util.Log.d("wrapper.c", $15_phi); $20_phi = null; if $opred != 5 goto label5; $20_phi = "setReconnectionProfile bailing - no core obj"; goto label6; label5: if $opred != 6 goto label6; $20_phi = $p0; label6: android.util.Log.d("wrapper.c", $20_phi); $26_phi = null; if $opred != 7 goto label7; $26_phi = "setReconnectionProfile result=%i"; goto label8; label7: if $opred != 8 goto label8; $26_phi = null; label8: android.util.Log.d("wrapper.c", $26_phi); return null; }
1 the Long field nativeObject is logged by native log function log_sink
la.daube.photochiotte_32.apk Sink: <la.daube.photochiotte.TorService: boolean mainConfigurationSetCommandLine(java.lang.String[])> staticinvoke <org.example.NativeSummaryFuncs: int strdup(java.lang.String)>($r2) Source: <la.daube.photochiotte.TorService$1: void run()> $r15 = virtualinvoke $r8.<java.util.ArrayList: java.lang.Object get(int)>($i0)
https://github.com/guardianproject/tor/blob/86771dade0937520a0a164ca571c5c7a8a1c20cc/src/feature/api/org_torproject_jni_TorService.c#L221 JNIEXPORT jboolean JNICALL Java_org_torproject_jni_TorService_mainConfigurationSetCommandLine (JNIEnv *env, jobject thisObj, jobjectArray arrArgv) { return SetCommandLine(env, thisObj, arrArgv); } static bool SetCommandLine(JNIEnv *env, jobject thisObj, jobjectArray arrArgv) { tor_main_configuration_t *cfg = GetConfiguration(env, thisObj); if (cfg == NULL) { fprintf(stderr, "SetCommandLine: The Tor configuration is NULL!\n"); return -1; } jsize arrArgvLen = (*env)->GetArrayLength(env, arrArgv); if (arrArgvLen > (INT_MAX-1)) { fprintf(stderr, "Too many args\n"); return false; } argc = (int) arrArgvLen; argv = (char**) tor_malloc(argc * sizeof(char*)); if (argv == NULL) { return false; } for (jsize i=0; i<argc; i++) { jobject objElm = (*env)->GetObjectArrayElement(env, arrArgv, i); jstring argElm = (jstring) objElm; const char *arg = (*env)->GetStringUTFChars(env, argElm, NULL); argv[i] = strdup(arg); } if (tor_main_configuration_set_command_line(cfg, argc, argv)) { fprintf(stderr, "Setting the command line config failed\n"); return false; } return true; }
$z0 = specialinvoke $r1.<la.daube.photochiotte.TorService: boolean mainConfigurationSetCommandLine(java.lang.String[])>($r0) staticinvoke <org.example.NativeSummaryFuncs: int strdup(java.lang.String)>($r2)
<Source Statement="$r15 = virtualinvoke $r8.&lt;java.util.ArrayList: java.lang.Object get(int)&gt;($i0)" Method="&lt;la.daube.photochiotte.TorService$1: void run()&gt;"> <AccessPath Value="$r15" Type="java.lang.Object" TaintSubFields="true" /> <TaintPath> <PathElement Statement="$r15 = virtualinvoke $r8.&lt;java.util.ArrayList: java.lang.Object get(int)&gt;($i0)" Method="&lt;la.daube.photochiotte.TorService$1: void run()&gt;"> <AccessPath Value="$r15" Type="java.lang.Object" TaintSubFields="true" /> </PathElement> <PathElement Statement="$r1 = (java.lang.String) $r15" Method="&lt;la.daube.photochiotte.TorService$1: void run()&gt;"> <AccessPath Value="$r1" Type="java.lang.String" TaintSubFields="true" /> </PathElement> <PathElement Statement="$r9[$i1] = $r1" Method="&lt;la.daube.photochiotte.TorService$1: void run()&gt;"> <AccessPath Value="$r9" Type="java.lang.String[]" TaintSubFields="true" /> </PathElement> <PathElement Statement="$z0 = staticinvoke &lt;la.daube.photochiotte.TorService: boolean '-$$Nest$mmainConfigurationSetCommandLine'(la.daube.photochiotte.TorService,java.lang.String[])&gt;($r4, $r9)" Method="&lt;la.daube.photochiotte.TorService$1: void run()&gt;"> <AccessPath Value="$r0" Type="java.lang.String[]" TaintSubFields="true" /> </PathElement> <PathElement Statement="$z0 = specialinvoke $r1.&lt;la.daube.photochiotte.TorService: boolean mainConfigurationSetCommandLine(java.lang.String[])&gt;($r0)" Method="&lt;la.daube.photochiotte.TorService: boolean '-$$Nest$mmainConfigurationSetCommandLine'(la.daube.photochiotte.TorService,java.lang.String[])&gt;"> <AccessPath Value="$r1" Type="java.lang.String[]" TaintSubFields="true" /> </PathElement> <PathElement Statement="$r2 = $r1[0]" Method="&lt;la.daube.photochiotte.TorService: boolean mainConfigurationSetCommandLine(java.lang.String[])&gt;"> <AccessPath Value="$r2" Type="java.lang.String" TaintSubFields="true" /> </PathElement> <PathElement Statement="staticinvoke &lt;org.example.NativeSummaryFuncs: int strdup(java.lang.String)&gt;($r2)" Method="&lt;la.daube.photochiotte.TorService: boolean mainConfigurationSetCommandLine(java.lang.String[])&gt;"> <AccessPath Value="$r2" Type="java.lang.String" TaintSubFields="true" /> </PathElement> </TaintPath> </Source>
param string -> strdup
private boolean mainConfigurationSetCommandLine(java.lang.String[]) { la.daube.photochiotte.TorService $this; java.lang.String[] $p0; long $10_phi, $14_phi; int $opred; java.lang.String $18, $22_phi, $27_phi, $31_phi, $35_phi; boolean $39_phi; $this := @this; $p0 := @parameter0; org.example.NativeSummaryFuncs.GetArrayLength(null, $p0); org.example.NativeSummaryFuncs.malloc(1L); org.example.NativeSummaryFuncs.write(null, null, 64L); org.example.NativeSummaryFuncs.write(null, null, null); org.example.NativeSummaryFuncs.write(null, null, 1L); org.example.NativeSummaryFuncs.write(null, null, 40L); org.example.NativeSummaryFuncs.write(null, null, null); $10_phi = 0; $opred = org.example.NativeSummaryAux.opaqueInt(); if $opred != 1 goto label01; $10_phi = 33L; goto label02; label01: if $opred != 2 goto label02; $10_phi = null; label02: org.example.NativeSummaryFuncs.write(null, null, $10_phi); org.example.NativeSummaryFuncs.write(null, null, 1L); org.example.NativeSummaryFuncs.write(null, null, 1L); $14_phi = 0; if $opred != 3 goto label03; $14_phi = 33L; goto label04; label03: if $opred != 4 goto label04; $14_phi = null; label04: org.example.NativeSummaryFuncs.write(null, null, $14_phi); org.example.NativeSummaryFuncs.write(null, null, 1L); org.example.NativeSummaryFuncs.write(null, null, 1L); $18 = $p0[0]; org.example.NativeSummaryFuncs.strdup($18); $22_phi = null; if $opred != 5 goto label05; $22_phi = "Too many args\n"; goto label06; label05: if $opred != 6 goto label06; $22_phi = "J"; label06: android.util.Log.e("Tor-api", $22_phi); $27_phi = null; if $opred != 7 goto label07; $27_phi = "The fieldID is NULL\n"; goto label09; label07: if $opred != 8 goto label08; $27_phi = "GetObjectClass returned NULL\n"; goto label09; label08: if $opred != 9 goto label09; $27_phi = "J"; label09: android.util.Log.e("Tor-api", $27_phi); $31_phi = null; if $opred != 10 goto label10; $31_phi = "The long is 0\n"; goto label11; label10: if $opred != 11 goto label11; $31_phi = "J"; label11: android.util.Log.e("Tor-api", $31_phi); $35_phi = null; if $opred != 12 goto label12; $35_phi = "SetCommandLine: The Tor configuration is NULL!\n"; goto label13; label12: if $opred != 13 goto label13; $35_phi = "J"; label13: android.util.Log.e("Tor-api", $35_phi); $39_phi = 0; if $opred != 14 goto label14; $39_phi = 1L; goto label15; label14: if $opred != 15 goto label15; $39_phi = null; label15: return $39_phi; }
1 the param string is dupped using strdup nsfunc_sink
org.hystudio.android.dosbox_20500.apk Sink: <org.hystudio.android.dosbox.DemoGLSurfaceView: void nativeMouse(int,int,int,int,int,int)> staticinvoke <org.example.NativeSummaryFuncs: int snprintf(java.lang.Object,int,java.lang.Object,java.lang.Object,int,java.lang.Object)>(null, $i5, null, null, $i2, null) Source: <org.hystudio.android.dosbox.DifferentTouchInput$SingleTouchInput: void process(android.view.MotionEvent)> $f0 = virtualinvoke $r1.<android.view.MotionEvent: float getX()>()
JNIEXPORT void JNICALL JAVA_EXPORT_NAME(DemoGLSurfaceView_nativeMouse) ( JNIEnv* env, jobject thiz, jint x, jint y, jint action, jint pointerId, jint force, jint radius ) { int i; #if SDL_VERSION_ATLEAST(1,3,0) SDL_Window * window = SDL_GetFocusWindow(); if( !window ) return; #define SDL_ANDROID_sFakeWindowWidth window->w #define SDL_ANDROID_sFakeWindowHeight window->h #else if( !SDL_CurrentVideoSurface ) return; #endif if(pointerId < 0) pointerId = 0; if(pointerId > MAX_MULTITOUCH_POINTERS) pointerId = MAX_MULTITOUCH_POINTERS; // The touch is passed either to on-screen keyboard or as mouse event for all duration of touch between down and up, // even if the finger is not anymore above screen kb button it will not acr as mouse event, and if it's initially // touches the screen outside of screen kb it won't trigger button keypress - // I think it's more logical this way if( SDL_ANDROID_isTouchscreenKeyboardUsed && ( action == MOUSE_DOWN || touchPointers[pointerId] == TOUCH_PTR_SCREENKB ) ) { if( SDL_ANDROID_processTouchscreenKeyboard(x, y, action, pointerId) && action == MOUSE_DOWN ) touchPointers[pointerId] = TOUCH_PTR_SCREENKB; if( touchPointers[pointerId] == TOUCH_PTR_SCREENKB ) { if( action == MOUSE_UP ) touchPointers[pointerId] = TOUCH_PTR_UP; return; } } if( action == MOUSE_DOWN ) { touchPointers[pointerId] = TOUCH_PTR_MOUSE; firstMousePointerId = -1; for( i = 0; i < MAX_MULTITOUCH_POINTERS; i++ ) { if( touchPointers[i] == TOUCH_PTR_MOUSE ) { firstMousePointerId = i; break; } } } x -= SDL_ANDROID_TouchscreenCalibrationX; y -= SDL_ANDROID_TouchscreenCalibrationY; #if SDL_VIDEO_RENDER_RESIZE // Translate mouse coordinates x = x * SDL_ANDROID_sFakeWindowWidth / SDL_ANDROID_TouchscreenCalibrationWidth; y = y * SDL_ANDROID_sFakeWindowHeight / SDL_ANDROID_TouchscreenCalibrationHeight; if( x < 0 ) x = 0; if( x > SDL_ANDROID_sFakeWindowWidth ) x = SDL_ANDROID_sFakeWindowWidth; if( y < 0 ) y = 0; if( y > SDL_ANDROID_sFakeWindowHeight ) y = SDL_ANDROID_sFakeWindowHeight; #else x = x * SDL_ANDROID_sRealWindowWidth / SDL_ANDROID_TouchscreenCalibrationWidth; y = y * SDL_ANDROID_sRealWindowHeight / SDL_ANDROID_TouchscreenCalibrationHeight; #endif if( action == MOUSE_UP ) { multitouchGestureX = -1; multitouchGestureY = -1; multitouchGestureDist = -1; for(i = 0; i < MAX_MULTITOUCH_GESTURES; i++) { if( multitouchGestureKeyPressed[i] ) { multitouchGestureKeyPressed[i] = 0; SDL_ANDROID_MainThreadPushKeyboardKey( SDL_RELEASED, multitouchGestureKeycode[i] ); } } } else { if( firstMousePointerId != pointerId ) { multitouchGestureX = x; multitouchGestureY = y; } if( firstMousePointerId == pointerId && multitouchGestureX >= 0 ) { int dist = abs( x - multitouchGestureX ) + abs( y - multitouchGestureY ); int angle = atan2i( y - multitouchGestureY, x - multitouchGestureX ); if( multitouchGestureDist < 0 ) { multitouchGestureDist = dist; multitouchGestureAngle = angle; } else { int distMaxDiff = SDL_ANDROID_sFakeWindowHeight / ( 1 + (1 + multitouchGestureSensitivity) * 2 ); int angleMaxDiff = atan2i_PI / ( 1 + (1 + multitouchGestureSensitivity) * 2 ); if( dist - multitouchGestureDist > distMaxDiff ) { multitouchGestureKeyPressed[0] = 1; SDL_ANDROID_MainThreadPushKeyboardKey( SDL_PRESSED, multitouchGestureKeycode[0] ); } else if( multitouchGestureKeyPressed[0] ) { multitouchGestureKeyPressed[0] = 0; SDL_ANDROID_MainThreadPushKeyboardKey( SDL_RELEASED, multitouchGestureKeycode[0] ); } if( multitouchGestureDist - dist > distMaxDiff ) { multitouchGestureKeyPressed[1] = 1; SDL_ANDROID_MainThreadPushKeyboardKey( SDL_PRESSED, multitouchGestureKeycode[1] ); } else if( multitouchGestureKeyPressed[1] ) { multitouchGestureKeyPressed[1] = 0; SDL_ANDROID_MainThreadPushKeyboardKey( SDL_RELEASED, multitouchGestureKeycode[1] ); } int angleDiff = angle - multitouchGestureAngle; while( angleDiff < atan2i_PI ) angleDiff += atan2i_PI * 2; while( angleDiff > atan2i_PI ) angleDiff -= atan2i_PI * 2; if( angleDiff < -angleMaxDiff ) { multitouchGestureKeyPressed[2] = 1; SDL_ANDROID_MainThreadPushKeyboardKey( SDL_PRESSED, multitouchGestureKeycode[2] ); } else if( multitouchGestureKeyPressed[2] ) { multitouchGestureKeyPressed[2] = 0; SDL_ANDROID_MainThreadPushKeyboardKey( SDL_RELEASED, multitouchGestureKeycode[2] ); } if( angleDiff > angleMaxDiff ) { multitouchGestureKeyPressed[3] = 1; SDL_ANDROID_MainThreadPushKeyboardKey( SDL_PRESSED, multitouchGestureKeycode[3] ); } else if( multitouchGestureKeyPressed[3] ) { multitouchGestureKeyPressed[3] = 0; SDL_ANDROID_MainThreadPushKeyboardKey( SDL_RELEASED, multitouchGestureKeycode[3] ); } } } } if( isMultitouchUsed ) { #if SDL_VERSION_ATLEAST(1,3,0) // Use nifty SDL 1.3 multitouch API if( action == MOUSE_MOVE ) SDL_ANDROID_MainThreadPushMultitouchMotion(pointerId, x, y, force*radius / 16); else SDL_ANDROID_MainThreadPushMultitouchButton(pointerId, action == MOUSE_DOWN ? 1 : 0, x, y, force*radius / 16); #endif SDL_ANDROID_MainThreadPushJoystickAxis(pointerId+1, 0, x); SDL_ANDROID_MainThreadPushJoystickAxis(pointerId+1, 1, y); SDL_ANDROID_MainThreadPushJoystickAxis(pointerId+1, 2, force); SDL_ANDROID_MainThreadPushJoystickAxis(pointerId+1, 3, radius); if( action == MOUSE_DOWN ) SDL_ANDROID_MainThreadPushJoystickButton(pointerId+1, 0, SDL_PRESSED); if( action == MOUSE_UP ) SDL_ANDROID_MainThreadPushJoystickButton(pointerId+1, 0, SDL_RELEASED); } if( !isMouseUsed && !SDL_ANDROID_isTouchscreenKeyboardUsed ) { SDL_keysym keysym; if( action != MOUSE_MOVE ) SDL_ANDROID_MainThreadPushKeyboardKey( action == MOUSE_DOWN ? SDL_PRESSED : SDL_RELEASED, SDL_ANDROID_GetScreenKeyboardButtonKey(SDL_ANDROID_SCREENKEYBOARD_BUTTON_0) ); return; } if( !isMouseUsed ) return; if( pointerId == firstMousePointerId ) { if( relativeMovement ) { if( action == MOUSE_DOWN ) { relativeMovementX = oldMouseX - x; relativeMovementY = oldMouseY - y; } x += relativeMovementX; y += relativeMovementY; int diffX = x - oldMouseX; int diffY = y - oldMouseY; int coeff = relativeMovementSpeed + 2; if( relativeMovementSpeed > 2 ) coeff += relativeMovementSpeed - 2; diffX = diffX * coeff / 4; diffY = diffY * coeff / 4; if( relativeMovementAccel > 0 ) { unsigned int newTime = SDL_GetTicks(); if( newTime - relativeMovementTime > 0 ) { diffX += diffX * ( relativeMovementAccel * 30 ) / (int)(newTime - relativeMovementTime); diffY += diffY * ( relativeMovementAccel * 30 ) / (int)(newTime - relativeMovementTime); } relativeMovementTime = newTime; } diffX -= x - oldMouseX; diffY -= y - oldMouseY; x += diffX; y += diffY; relativeMovementX += diffX; relativeMovementY += diffY; diffX = x; diffY = y; if( x < 0 ) x = 0; if( x > SDL_ANDROID_sFakeWindowWidth ) x = SDL_ANDROID_sFakeWindowWidth; if( y < 0 ) y = 0; if( y > SDL_ANDROID_sFakeWindowHeight ) y = SDL_ANDROID_sFakeWindowHeight; relativeMovementX += x - diffX; relativeMovementY += y - diffY; } if( action == MOUSE_UP ) { SDL_ANDROID_MainThreadPushMouseButton( SDL_RELEASED, SDL_BUTTON_RIGHT ); if( mouseInitialX >= 0 && mouseInitialY >= 0 && ( leftClickMethod == LEFT_CLICK_WITH_TAP || leftClickMethod == LEFT_CLICK_WITH_TAP_OR_TIMEOUT ) && abs(mouseInitialX - x) < SDL_ANDROID_sFakeWindowHeight / 16 && abs(mouseInitialY - y) < SDL_ANDROID_sFakeWindowHeight / 16 && SDL_GetTicks() - mouseInitialTime < 700 ) { SDL_ANDROID_MainThreadPushMouseMotion(mouseInitialX, mouseInitialY); SDL_ANDROID_MainThreadPushMouseButton( SDL_PRESSED, SDL_BUTTON_LEFT ); deferredMouseTap = 2; mouseInitialX = -1; mouseInitialY = -1; } else { SDL_ANDROID_MainThreadPushMouseButton( SDL_RELEASED, SDL_BUTTON_LEFT ); } SDL_ANDROID_ShowScreenUnderFingerRect.w = SDL_ANDROID_ShowScreenUnderFingerRect.h = 0; SDL_ANDROID_ShowScreenUnderFingerRectSrc.w = SDL_ANDROID_ShowScreenUnderFingerRectSrc.h = 0; if( SDL_ANDROID_ShowScreenUnderFinger ) { // Move mouse by 1 pixel so it will force screen update and mouse-under-finger window will be removed if( moveMouseWithKbX >= 0 ) SDL_ANDROID_MainThreadPushMouseMotion(moveMouseWithKbX > 0 ? moveMouseWithKbX-1 : 0, moveMouseWithKbY); else SDL_ANDROID_MainThreadPushMouseMotion(x > 0 ? x-1 : 0, y); } moveMouseWithKbX = -1; moveMouseWithKbY = -1; moveMouseWithKbSpeedX = 0; moveMouseWithKbSpeedY = 0; } if( action == MOUSE_DOWN ) { if( (moveMouseWithKbX >= 0 || leftClickMethod == LEFT_CLICK_NEAR_CURSOR) && abs(oldMouseX - x) < SDL_ANDROID_sFakeWindowWidth / 4 && abs(oldMouseY - y) < SDL_ANDROID_sFakeWindowHeight / 4 ) { SDL_ANDROID_MainThreadPushMouseButton( SDL_PRESSED, SDL_BUTTON_LEFT ); moveMouseWithKbX = oldMouseX; moveMouseWithKbY = oldMouseX; action == MOUSE_MOVE; } else if( leftClickMethod == LEFT_CLICK_NORMAL ) { SDL_ANDROID_MainThreadPushMouseMotion(x, y); SDL_ANDROID_MainThreadPushMouseButton( SDL_PRESSED, SDL_BUTTON_LEFT ); } else { SDL_ANDROID_MainThreadPushMouseMotion(x, y); action == MOUSE_MOVE; mouseInitialX = x; mouseInitialY = y; mouseInitialTime = SDL_GetTicks(); } UpdateScreenUnderFingerRect(x, y); } if( action == MOUSE_MOVE ) { if( moveMouseWithKbX >= 0 ) { if( abs(moveMouseWithKbX - x) > SDL_ANDROID_sFakeWindowWidth / 10 ) moveMouseWithKbSpeedX += moveMouseWithKbX > x ? -1 : 1; else moveMouseWithKbSpeedX = moveMouseWithKbSpeedX * 2 / 3; if( abs(moveMouseWithKbY - y) > SDL_ANDROID_sFakeWindowHeight / 10 ) moveMouseWithKbSpeedY += moveMouseWithKbY > y ? -1 : 1; else moveMouseWithKbSpeedY = moveMouseWithKbSpeedY * 2 / 3; moveMouseWithKbX += moveMouseWithKbSpeedX; moveMouseWithKbY += moveMouseWithKbSpeedY; if( abs(moveMouseWithKbX - x) > SDL_ANDROID_sFakeWindowWidth / 5 || abs(moveMouseWithKbY - y) > SDL_ANDROID_sFakeWindowHeight / 5 ) { moveMouseWithKbX = -1; moveMouseWithKbY = -1; moveMouseWithKbSpeedX = 0; moveMouseWithKbSpeedY = 0; SDL_ANDROID_MainThreadPushMouseMotion(x, y); } else SDL_ANDROID_MainThreadPushMouseMotion(moveMouseWithKbX, moveMouseWithKbY); } else SDL_ANDROID_MainThreadPushMouseMotion(x, y); if( rightClickMethod == RIGHT_CLICK_WITH_PRESSURE || leftClickMethod == LEFT_CLICK_WITH_PRESSURE ) { int button = (leftClickMethod == LEFT_CLICK_WITH_PRESSURE) ? SDL_BUTTON_LEFT : SDL_BUTTON_RIGHT; int buttonState = ( force > maxForce || radius > maxRadius ); if( button == SDL_BUTTON_RIGHT ) SDL_ANDROID_MainThreadPushMouseButton( SDL_RELEASED, SDL_BUTTON_LEFT ); SDL_ANDROID_MainThreadPushMouseButton( buttonState ? SDL_PRESSED : SDL_RELEASED, button ); } if( mouseInitialX >= 0 && mouseInitialY >= 0 && ( leftClickMethod == LEFT_CLICK_WITH_TIMEOUT || leftClickMethod == LEFT_CLICK_WITH_TAP || leftClickMethod == LEFT_CLICK_WITH_TAP_OR_TIMEOUT || rightClickMethod == RIGHT_CLICK_WITH_TIMEOUT ) ) { if( abs(mouseInitialX - x) >= SDL_ANDROID_sFakeWindowHeight / 10 || abs(mouseInitialY - y) >= SDL_ANDROID_sFakeWindowHeight / 10 ) { mouseInitialX = -1; mouseInitialY = -1; } else { if( leftClickMethod == LEFT_CLICK_WITH_TIMEOUT || leftClickMethod == LEFT_CLICK_WITH_TAP_OR_TIMEOUT ) { if( SDL_GetTicks() - mouseInitialTime > leftClickTimeout ) { SDL_ANDROID_MainThreadPushMouseMotion(mouseInitialX, mouseInitialY); SDL_ANDROID_MainThreadPushMouseButton( SDL_PRESSED, SDL_BUTTON_LEFT ); mouseInitialX = -1; mouseInitialY = -1; } } if( rightClickMethod == RIGHT_CLICK_WITH_TIMEOUT ) { if( SDL_GetTicks() - mouseInitialTime > rightClickTimeout ) { SDL_ANDROID_MainThreadPushMouseMotion(mouseInitialX, mouseInitialY); SDL_ANDROID_MainThreadPushMouseButton( SDL_PRESSED, SDL_BUTTON_RIGHT ); mouseInitialX = -1; mouseInitialY = -1; } } } } UpdateScreenUnderFingerRect(x, y); } } if( pointerId != firstMousePointerId && (action == MOUSE_DOWN || action == MOUSE_UP) ) { if( leftClickMethod == LEFT_CLICK_WITH_MULTITOUCH ) { SDL_ANDROID_MainThreadPushMouseButton( (action == MOUSE_DOWN) ? SDL_PRESSED : SDL_RELEASED, SDL_BUTTON_LEFT ); } else if( rightClickMethod == RIGHT_CLICK_WITH_MULTITOUCH ) { SDL_ANDROID_MainThreadPushMouseButton( SDL_RELEASED, SDL_BUTTON_LEFT ); SDL_ANDROID_MainThreadPushMouseButton( (action == MOUSE_DOWN) ? SDL_PRESSED : SDL_RELEASED, SDL_BUTTON_RIGHT ); } } if( action == MOUSE_UP ) { touchPointers[pointerId] = TOUCH_PTR_UP; firstMousePointerId = -1; for( i = 0; i < MAX_MULTITOUCH_POINTERS; i++ ) { if( touchPointers[i] == TOUCH_PTR_MOUSE ) { firstMousePointerId = i; break; } } } }
staticinvoke <org.hystudio.android.dosbox.DemoGLSurfaceView: void nativeMouse(int,int,int,int,int,int)>($i1, $i2, b0, 0, $i3, $i4) staticinvoke <org.example.NativeSummaryFuncs: int snprintf(java.lang.Object,int,java.lang.Object,java.lang.Object,int,java.lang.Object)>(null, $i5, null, null, $i2, null)
<Source Statement="$f0 = virtualinvoke $r1.&lt;android.view.MotionEvent: float getX()&gt;()" Method="&lt;org.hystudio.android.dosbox.DifferentTouchInput$SingleTouchInput: void process(android.view.MotionEvent)&gt;"> <AccessPath Value="$f0" Type="float" TaintSubFields="true" /> <TaintPath> <PathElement Statement="$f0 = virtualinvoke $r1.&lt;android.view.MotionEvent: float getX()&gt;()" Method="&lt;org.hystudio.android.dosbox.DifferentTouchInput$SingleTouchInput: void process(android.view.MotionEvent)&gt;"> <AccessPath Value="$f0" Type="float" TaintSubFields="true" /> </PathElement> <PathElement Statement="$i1 = (int) $f0" Method="&lt;org.hystudio.android.dosbox.DifferentTouchInput$SingleTouchInput: void process(android.view.MotionEvent)&gt;"> <AccessPath Value="$i1" Type="int" TaintSubFields="true" /> </PathElement> <PathElement Statement="staticinvoke &lt;org.hystudio.android.dosbox.DemoGLSurfaceView: void nativeMouse(int,int,int,int,int,int)&gt;($i1, $i2, b0, 0, $i3, $i4)" Method="&lt;org.hystudio.android.dosbox.DifferentTouchInput$SingleTouchInput: void process(android.view.MotionEvent)&gt;"> <AccessPath Value="$i0" Type="int" TaintSubFields="true" /> </PathElement> <PathElement Statement="$i5 = $i0" Method="&lt;org.hystudio.android.dosbox.DemoGLSurfaceView: void nativeMouse(int,int,int,int,int,int)&gt;"> <AccessPath Value="$i5" Type="int" TaintSubFields="true" /> </PathElement> <PathElement Statement="staticinvoke &lt;org.example.NativeSummaryFuncs: int snprintf(java.lang.Object,int,java.lang.Object,java.lang.Object,int,java.lang.Object)&gt;(null, $i5, null, null, $i2, null)" Method="&lt;org.hystudio.android.dosbox.DemoGLSurfaceView: void nativeMouse(int,int,int,int,int,int)&gt;"> <AccessPath Value="$i5" Type="int" TaintSubFields="true" /> </PathElement> </TaintPath> </Source>
param1 -> snprintf
public static void nativeMouse(int, int, int, int, int, int) { java.lang.Long boxed, boxed, boxed, boxed, boxed, boxed, boxed; int $p0, $p1, $p2, $p3, $p4, $p5, $0, $2_phi, $opred, $29_phi; java.lang.String $11_phi, $casted, $15_phi, $casted, $21_phi, $casted, $25_phi, $casted, $42_phi, $casted, $67_phi, $casted, $71_phi, $casted; $p0 := @parameter0; $p1 := @parameter1; $p2 := @parameter2; $p3 := @parameter3; $p4 := @parameter4; $p5 := @parameter5; $0 = org.example.NativeSummaryFuncs.raise(8L); $2_phi = 0; $opred = org.example.NativeSummaryAux.opaqueInt(); if $opred != 1 goto label01; $2_phi = null; goto label05; label01: if $opred != 2 goto label02; $2_phi = $p0; goto label05; label02: if $opred != 3 goto label03; $2_phi = $0; goto label05; label03: if $opred != 4 goto label04; $2_phi = $p1; goto label05; label04: if $opred != 5 goto label05; $2_phi = $p2; label05: org.example.NativeSummaryFuncs.snprintf(null, $2_phi, null, null, $p2, null); $11_phi = null; if $opred != 26 goto label06; $11_phi = "ERROR: %s"; goto label07; label06: if $opred != 27 goto label07; boxed = java.lang.Long.valueOf(295352L); $casted = virtualinvoke boxed.toString(); $11_phi = $casted; label07: android.util.Log.e("libSDL", $11_phi); $15_phi = null; if $opred != 28 goto label08; $15_phi = "ERROR: %s"; goto label09; label08: if $opred != 29 goto label09; boxed = java.lang.Long.valueOf(295352L); $casted = virtualinvoke boxed.toString(); $15_phi = $casted; label09: android.util.Log.e("libSDL", $15_phi); org.example.NativeSummaryFuncs.raise(8L); org.example.NativeSummaryFuncs.calloc(1L, 4L); $21_phi = null; if $opred != 30 goto label10; $21_phi = "ERROR: %s"; goto label11; label10: if $opred != 31 goto label11; boxed = java.lang.Long.valueOf(295352L); $casted = virtualinvoke boxed.toString(); $21_phi = $casted; label11: android.util.Log.e("libSDL", $21_phi); $25_phi = null; if $opred != 32 goto label12; $25_phi = "ERROR: %s"; goto label13; label12: if $opred != 33 goto label13; boxed = java.lang.Long.valueOf(295352L); $casted = virtualinvoke boxed.toString(); $25_phi = $casted; label13: android.util.Log.e("libSDL", $25_phi); $29_phi = 0; if $opred != 34 goto label14; $29_phi = $p0; goto label17; label14: if $opred != 35 goto label15; $29_phi = $0; goto label17; label15: if $opred != 36 goto label16; $29_phi = $p1; goto label17; label16: if $opred != 37 goto label17; $29_phi = $p2; label17: org.example.NativeSummaryFuncs.free($29_phi); org.example.NativeSummaryFuncs.malloc(null); org.example.NativeSummaryFuncs.malloc(null); org.example.NativeSummaryFuncs.malloc(null); org.example.NativeSummaryFuncs.malloc(null); org.example.NativeSummaryFuncs.free(null); org.example.NativeSummaryFuncs.malloc(null); org.example.NativeSummaryFuncs.malloc(null); org.example.NativeSummaryFuncs.free(null); org.example.NativeSummaryFuncs.realloc(null, null); org.example.NativeSummaryFuncs.free(null); $42_phi = null; if $opred != 38 goto label18; $42_phi = "ERROR: %s"; goto label19; label18: if $opred != 39 goto label19; boxed = java.lang.Long.valueOf(295352L); $casted = virtualinvoke boxed.toString(); $42_phi = $casted; label19: android.util.Log.e("libSDL", $42_phi); org.example.NativeSummaryFuncs.malloc(null); org.example.NativeSummaryFuncs.malloc(null); org.example.NativeSummaryFuncs.free(null); org.example.NativeSummaryFuncs.free(null); org.example.NativeSummaryFuncs.malloc(null); org.example.NativeSummaryFuncs.malloc(null); org.example.NativeSummaryFuncs.malloc(256L); org.example.NativeSummaryFuncs.malloc(null); org.example.NativeSummaryFuncs.malloc(null); org.example.NativeSummaryFuncs.free(null); org.example.NativeSummaryFuncs.malloc(null); org.example.NativeSummaryFuncs.free(null); org.example.NativeSummaryFuncs.realloc(null, null); org.example.NativeSummaryFuncs.malloc(null); org.example.NativeSummaryFuncs.free(null); org.example.NativeSummaryFuncs.realloc(null, null); org.example.NativeSummaryFuncs.free(null); $67_phi = null; if $opred != 40 goto label20; $67_phi = "ERROR: %s"; goto label21; label20: if $opred != 41 goto label21; boxed = java.lang.Long.valueOf(295352L); $casted = virtualinvoke boxed.toString(); $67_phi = $casted; label21: android.util.Log.e("libSDL", $67_phi); $71_phi = null; if $opred != 42 goto label22; $71_phi = "ERROR: %s"; goto label23; label22: if $opred != 43 goto label23; boxed = java.lang.Long.valueOf(295352L); $casted = virtualinvoke boxed.toString(); $71_phi = $casted; label23: android.util.Log.e("libSDL", $71_phi); return; }
1 the param1 is passed to snprintf nsfunc_sink

Verified Native Related Flows for AppShark

APK Source and Sink Source Code Native Parts Full Flow Dataflow Comment Jimple code Correct? Comment Dataflow Type
org.bottiger.podcast_424.apk Source: $r6 = staticinvoke <android.net.Uri: android.net.Uri parse(java.lang.String)>($r5) Sink: staticinvoke <android.util.Log: int e(java.lang.String,java.lang.String)>("MediaMetadataRetrieverJNI", $r3_3)
https://github.com/wseemann/FFmpegMediaMetadataRetriever/blob/6e2d7fd8ea1b25f94ad3ac5b69fae2d5456933b4/native/src/main/jni/metadata/wseemann_media_MediaMetadataRetriever.cpp#L218-L245 static void wseemann_media_FFmpegMediaMetadataRetriever_setDataSourceFD(JNIEnv *env, jobject thiz, jobject fileDescriptor, jlong offset, jlong length) { __android_log_write(ANDROID_LOG_VERBOSE, LOG_TAG, "setDataSource"); MediaMetadataRetriever* retriever = getRetriever(env, thiz); if (retriever == 0) { jniThrowException(env, "java/lang/IllegalStateException", "No retriever available"); return; } if (!fileDescriptor) { jniThrowException(env, "java/lang/IllegalArgumentException", NULL); return; } int fd = jniGetFDFromFileDescriptor(env, fileDescriptor); if (offset < 0 || length < 0 || fd < 0) { if (offset < 0) { __android_log_print(ANDROID_LOG_ERROR, LOG_TAG, "negative offset (%lld)", offset); } if (length < 0) { __android_log_print(ANDROID_LOG_ERROR, LOG_TAG, "negative length (%lld)", length); } if (fd < 0) { __android_log_write(ANDROID_LOG_ERROR, LOG_TAG, "invalid file descriptor"); } jniThrowException(env, "java/lang/IllegalArgumentException", NULL); return; } process_media_retriever_call(env, retriever->setDataSource(fd, offset, length), "java/lang/RuntimeException", "setDataSource failed"); } static int jniGetFDFromFileDescriptor(JNIEnv * env, jobject fileDescriptor) { jint fd = -1; jclass fdClass = env->FindClass("java/io/FileDescriptor"); if (fdClass != NULL) { jfieldID fdClassDescriptorFieldID = env->GetFieldID(fdClass, "descriptor", "I"); if (fdClassDescriptorFieldID != NULL && fileDescriptor != NULL) { fd = env->GetIntField(fileDescriptor, fdClassDescriptorFieldID); } } return fd; }
virtualinvoke r0.<wseemann.media.FFmpegMediaMetadataRetriever: void setDataSource(java.io.FileDescriptor,long,long)>($r11, $l0_3, $l2)
$r6 = staticinvoke <android.net.Uri: android.net.Uri parse(java.lang.String)>($r5) virtualinvoke $r3.<wseemann.media.FFmpegMediaMetadataRetriever: void a(android.content.Context,android.net.Uri)>($r0, $r6) $r2 := @parameter1: android.net.Uri $r7 = virtualinvoke $r6.<android.content.ContentResolver: android.content.res.AssetFileDescriptor openAssetFileDescriptor(android.net.Uri,java.lang.String)>($r2, "r") $l0_3 = virtualinvoke $r7.<android.content.res.AssetFileDescriptor: long getStartOffset()>() virtualinvoke r0.<wseemann.media.FFmpegMediaMetadataRetriever: void setDataSource(java.io.FileDescriptor,long,long)>($r11, $l0_3, $l2) $l0 := @parameter1: long $r4 = staticinvoke <java.lang.Long: java.lang.Long valueOf(long)>($l0) $r3_3 = virtualinvoke $r4.<java.lang.Long: java.lang.String toString()>() staticinvoke <android.util.Log: int e(java.lang.String,java.lang.String)>("MediaMetadataRetrieverJNI", $r3_3)
param0 -> log
public void setDataSource(java.lang.String) throws java.lang.IllegalArgumentException { java.lang.String $p0; wseemann.media.FFmpegMediaMetadataRetriever $this; java.lang.IllegalArgumentException $3; $this := @this; $p0 := @parameter0; $3 = new java.lang.IllegalArgumentException; specialinvoke $3.<init>("Invalid pathname"); throw $3; }
0 more argument is estimated by the log function log_sink
cx.mccormick.pddroidparty_2.apk Source: $i0 = staticinvoke <java.lang.Integer: int parseInt(java.lang.String)>($r4) Sink: staticinvoke <android.util.Log: int i(java.lang.String,java.lang.String)>("opensl_stream", $r1_18)
https://github.com/libpd/libpd/blob/b195702388cda3b52142266312dc2c069e575421/jni/z_jni_pa.c#L51C1-L69C2 JNIEXPORT jint JNICALL Java_org_puredata_core_PdBase_openAudio(JNIEnv *env, jclass cls, jint inChans, jint outChans, jint sRate, jobject x) { Java_org_puredata_core_PdBase_closeAudio(env, cls); pthread_mutex_lock(&mutex); jint err = libpd_init_audio(inChans, outChans, sRate); pthread_mutex_unlock(&mutex); if (err) return err; PaError pa_err = Pa_Initialize(); if (pa_err != paNoError) return pa_err; pa_err = Pa_OpenDefaultStream(&pa_stream, inChans, outChans, paFloat32, sRate, NTICKS * libpd_blocksize(), pa_callback, NULL); if (pa_err == paNoError) { return 0; } else { Pa_Terminate(); return pa_err; } } https://github.com/nettoyeurny/opensl_stream/blob/5f3930698569754c519f5b3e4cc7691223bc99a8/opensl_stream.c#L414 LOGI("Created OPENSL_STREAM(%d, %d, %d, %d)", sampleRate, inChans, outChans, callbackBufferFrames); LOGI("numBuffers: %d", OUTPUT_BUFFERS);
$i2 = staticinvoke <org.puredata.core.PdBase: int openAudio(int,int,int,java.util.Map)>($i0, $i1, $i3, null)
$i0 = staticinvoke <java.lang.Integer: int parseInt(java.lang.String)>($r4) $i1 = $i0 $i1_3 = $i1 specialinvoke $r9.<org.puredata.android.io.AudioParameters$JellyBeanMR1OpenSLParameters: void <init>(int,int,int,int,boolean)>($i1_3, 64, 64, $i3_4, $z0) $i0 := @parameter0: int r0.<org.puredata.android.io.AudioParameters$JellyBeanMR1OpenSLParameters: int sampleRate> = $i0 i0 = r0.<org.puredata.android.io.AudioParameters$JellyBeanMR1OpenSLParameters: int sampleRate> return i0 return $i0 $i0_5 = staticinvoke <org.puredata.android.io.AudioParameters: int suggestSampleRate()>() staticinvoke <org.puredata.android.io.PdAudio: void initAudio(int,int,int,int,boolean)>($i0_5, $i1_5, $i2_5, $i3_9, 1) $i3 := @parameter0: int $i2 = staticinvoke <org.puredata.core.PdBase: int openAudio(int,int,int,java.util.Map)>($i0, $i1, $i3, null) $i2 := @parameter2: int $r2_5 = staticinvoke <java.lang.Integer: java.lang.Integer valueOf(int)>($i2) $r1_18 = virtualinvoke $r2_5.<java.lang.Integer: java.lang.String toString()>() staticinvoke <android.util.Log: int i(java.lang.String,java.lang.String)>("opensl_stream", $r1_18)
param2 -> log
public static int openAudio(int, int, int, java.util.Map) { java.lang.Integer boxed, boxed, boxed, boxed, boxed, boxed; java.lang.Long boxed, boxed; java.util.Map $p3; int $p0, $p1, $p2, $opred; java.lang.String $0_phi, $4_phi, $8_phi, $23_phi, $casted, $casted, $casted, $casted, $27_phi, $casted; $p0 := @parameter0; $p1 := @parameter1; $p2 := @parameter2; $p3 := @parameter3; $0_phi = null; $opred = org.example.NativeSummaryAux.opaqueInt(); if $opred != 1 goto label01; $0_phi = "Input buffer size estimate: %d"; goto label02; label01: if $opred != 2 goto label02; $0_phi = null; label02: android.util.Log.i("opensl_stream", $0_phi); $4_phi = null; if $opred != 3 goto label03; $4_phi = null; goto label04; label03: if $opred != 4 goto label04; $4_phi = "Output buffer size estimate: %d"; label04: android.util.Log.i("opensl_stream", $4_phi); $8_phi = null; if $opred != 5 goto label05; $8_phi = null; goto label06; label05: if $opred != 6 goto label06; $8_phi = "Lowest margin: %d"; label06: android.util.Log.i("opensl_stream", $8_phi); org.example.NativeSummaryFuncs.usleep(100000L); org.example.NativeSummaryFuncs.free(null); org.example.NativeSummaryFuncs.free(null); org.example.NativeSummaryFuncs.free(null); org.example.NativeSummaryFuncs.free(null); if $opred != 7 goto label07; boxed = java.lang.Integer.valueOf($p0); virtualinvoke boxed.toString(); goto label09; label07: if $opred != 8 goto label08; boxed = java.lang.Integer.valueOf($p2); virtualinvoke boxed.toString(); goto label09; label08: if $opred != 9 goto label09; boxed = java.lang.Integer.valueOf($p1); virtualinvoke boxed.toString(); label09: $23_phi = null; if $opred != 10 goto label10; $23_phi = "Created OPENSL_STREAM(%d, %d, %d, %d)"; goto label14; label10: if $opred != 11 goto label11; boxed = java.lang.Integer.valueOf($p0); $casted = virtualinvoke boxed.toString(); $23_phi = $casted; goto label14; label11: if $opred != 12 goto label12; boxed = java.lang.Integer.valueOf($p2); $casted = virtualinvoke boxed.toString(); $23_phi = $casted; goto label14; label12: if $opred != 13 goto label13; boxed = java.lang.Integer.valueOf($p1); $casted = virtualinvoke boxed.toString(); $23_phi = $casted; goto label14; label13: if $opred != 14 goto label14; boxed = java.lang.Long.valueOf(1146888L); $casted = virtualinvoke boxed.toString(); $23_phi = $casted; label14: android.util.Log.i("opensl_stream", $23_phi); $27_phi = null; if $opred != 15 goto label15; $27_phi = "numBuffers: %d"; goto label16; label15: if $opred != 16 goto label16; boxed = java.lang.Long.valueOf(2L); $casted = virtualinvoke boxed.toString(); $27_phi = $casted; label16: android.util.Log.i("opensl_stream", $27_phi); org.example.NativeSummaryFuncs.free(null); org.example.NativeSummaryFuncs.free(null); org.example.NativeSummaryFuncs.free(null); org.example.NativeSummaryFuncs.free(null); return $p0; }
1 the sample rate param is logged log_sink
com.osfans.trime_20230101.apk Source: $z0_2 = staticinvoke <java.lang.Boolean: boolean parseBoolean(java.lang.String)>($r0_1) Sink: staticinvoke <org.example.NativeSummaryFuncs: int fprintf(java.lang.Object,boolean,boolean,boolean)>(null, $z2_15, $z3_15, $z4_15)
https://github.com/rime/librime/blob/1f3bf35691a5ad066ef36775e289525f3b092e28/src/rime/context.cc#L289 void Context::set_option(const string& name, bool value) { options_[name] = value; DLOG(INFO) << "Context::set_option " << name << " = " << value; option_update_notifier_(this, name); }
staticinvoke <com.osfans.trime.core.Rime: void set_option(java.lang.String,boolean)>($r0, $z0) staticinvoke <org.example.NativeSummaryFuncs: int fprintf(java.lang.Object,boolean,boolean,boolean)>(null, $z2_15, $z3_15, $z4_15)
$z0_2 = staticinvoke <java.lang.Boolean: boolean parseBoolean(java.lang.String)>($r0_1) return $z0_2 $z0 = staticinvoke <com.osfans.trime.util.CollectionUtils: boolean obtainBoolean(java.util.Map,java.lang.String,boolean)>($r3, $r1, 0) return $z0 $z0_2 = virtualinvoke $r5.<com.osfans.trime.data.theme.Config$Style: boolean getBoolean(java.lang.String)>("horizontal") staticinvoke <com.osfans.trime.core.Rime: void setOption(java.lang.String,boolean)>("_horizontal", $z0_2) $z0 := @parameter1: boolean staticinvoke <com.osfans.trime.core.Rime: void set_option(java.lang.String,boolean)>($r0, $z0) $z0 := @parameter1: boolean $z2_15 = $z0 staticinvoke <org.example.NativeSummaryFuncs: int fprintf(java.lang.Object,boolean,boolean,boolean)>(null, $z2_15, $z3_15, $z4_15)
the param1 printed by printf
public static void set_option(java.lang.String, boolean) { boolean $p1, $58, $73_phi, $74_phi, $75_phi, $84_phi, $85_phi, $86_phi, $94_phi, $95_phi, $96_phi, $106_phi, $107_phi, $108_phi, $116_phi, $117_phi, $118_phi, $126_phi, $127_phi, $128_phi, $136_phi, $137_phi, $138_phi, $144, $145, $150_phi, $151_phi, $152_phi, $160_phi, $161_phi, $162_phi, $170_phi, $171_phi, $172_phi, $181_phi, $182_phi, $183_phi, $191_phi, $192_phi, $193_phi, $203_phi, $204_phi, $205_phi, $213_phi, $214_phi, $215_phi, $235, $236, $310_phi, $340_phi; int $17, $opred; java.lang.String $p0; $p0 := @parameter0; $p1 := @parameter1; org.example.NativeSummaryFuncs.malloc(1L); org.example.NativeSummaryFuncs.free(null); org.example.NativeSummaryFuncs.free(null); org.example.NativeSummaryFuncs.malloc(1L); org.example.NativeSummaryFuncs.malloc(1L); org.example.NativeSummaryFuncs.free(null); org.example.NativeSummaryFuncs.malloc(1L); org.example.NativeSummaryFuncs.malloc(1L); org.example.NativeSummaryFuncs.free(null); org.example.NativeSummaryFuncs.free(null); org.example.NativeSummaryFuncs.free(null); org.example.NativeSummaryFuncs.free(null); org.example.NativeSummaryFuncs.free(null); org.example.NativeSummaryFuncs.free(null); org.example.NativeSummaryFuncs.free(null); $17 = org.example.NativeSummaryFuncs.malloc(1L); org.example.NativeSummaryFuncs.malloc(1L); org.example.NativeSummaryFuncs.free(null); org.example.NativeSummaryFuncs.free(null); org.example.NativeSummaryFuncs.free(null); org.example.NativeSummaryFuncs.free(null); org.example.NativeSummaryFuncs.free(null); org.example.NativeSummaryFuncs.free(null); org.example.NativeSummaryFuncs.free(null); org.example.NativeSummaryFuncs.free(null); org.example.NativeSummaryFuncs.free(null); org.example.NativeSummaryFuncs.free(null); org.example.NativeSummaryFuncs.free(null); org.example.NativeSummaryFuncs.malloc(1L); org.example.NativeSummaryFuncs.free(null); org.example.NativeSummaryFuncs.free(null); org.example.NativeSummaryFuncs.free(null); org.example.NativeSummaryFuncs.free(null); org.example.NativeSummaryFuncs.free(null); org.example.NativeSummaryFuncs.free(null); org.example.NativeSummaryFuncs.free($17); org.example.NativeSummaryFuncs.free(null); org.example.NativeSummaryFuncs.free(null); org.example.NativeSummaryFuncs.free(null); org.example.NativeSummaryFuncs.free(null); org.example.NativeSummaryFuncs.free(null); org.example.NativeSummaryFuncs.malloc(1L); org.example.NativeSummaryFuncs.malloc(1L); org.example.NativeSummaryFuncs.malloc(128L); org.example.NativeSummaryFuncs.malloc(16L); org.example.NativeSummaryFuncs.malloc(128L); org.example.NativeSummaryFuncs.malloc(16L); org.example.NativeSummaryFuncs.malloc(128L); org.example.NativeSummaryFuncs.malloc(30343L); org.example.NativeSummaryFuncs.malloc(1L); org.example.NativeSummaryFuncs.free(null); $58 = org.example.NativeSummaryFuncs.getpid(); org.example.NativeSummaryFuncs.getpid(); org.example.NativeSummaryFuncs.fprintf(null, "libunwind: %s - %s\n", "getRegister", "unsupported arm64 register"); org.example.NativeSummaryFuncs.fprintf(null, "libunwind: %s - %s\n", "getULEB128", "malformed uleb128 expression"); org.example.NativeSummaryFuncs.fprintf(null, "libunwind: %s - %s\n", "getULEB128", "truncated uleb128 expression"); org.example.NativeSummaryFuncs.fprintf(null, "libunwind: %s - %s\n", "getULEB128", "malformed uleb128 expression"); org.example.NativeSummaryFuncs.fprintf(null, "libunwind: %s - %s\n", "getULEB128", "truncated uleb128 expression"); org.example.NativeSummaryFuncs.fprintf(null, "libunwind: %s - %s\n", "getULEB128", "malformed uleb128 expression"); org.example.NativeSummaryFuncs.fprintf(null, "libunwind: %s - %s\n", "getULEB128", "truncated uleb128 expression"); org.example.NativeSummaryFuncs.fprintf(null, "libunwind: %s - %s\n", "getSLEB128", "truncated sleb128 expression"); org.example.NativeSummaryFuncs.fprintf(null, "libunwind: %s - %s\n", "getULEB128", "malformed uleb128 expression"); org.example.NativeSummaryFuncs.fprintf(null, "libunwind: %s - %s\n", "getULEB128", "truncated uleb128 expression"); org.example.NativeSummaryFuncs.fprintf(null, "libunwind: %s - %s\n", "getEncodedP", "DW_EH_PE_textrel pointer encoding not supported"); org.example.NativeSummaryFuncs.fprintf(null, "libunwind: %s - %s\n", "getEncodedP", "unknown pointer encoding"); org.example.NativeSummaryFuncs.fprintf(null, "libunwind: %s - %s\n", "getEncodedP", "DW_EH_PE_aligned pointer encoding not supported"); $73_phi = 0; $opred = org.example.NativeSummaryAux.opaqueInt(); if $opred != 1 goto label01; $73_phi = null; goto label02; label01: if $opred != 2 goto label02; $73_phi = $p1; label02: $74_phi = 0; if $opred != 3 goto label03; $74_phi = null; goto label04; label03: if $opred != 4 goto label04; $74_phi = $p1; label04: $75_phi = 0; if $opred != 5 goto label05; $75_phi = null; goto label06; label05: if $opred != 6 goto label06; $75_phi = $p1; label06: org.example.NativeSummaryFuncs.fprintf(null, $73_phi, $74_phi, $75_phi); org.example.NativeSummaryFuncs.fprintf(null, "libunwind: %s - %s\n", "getEncodedP", "DW_EH_PE_datarel is invalid with a datarelBase of 0"); org.example.NativeSummaryFuncs.fprintf(null, "libunwind: %s - %s\n", "getEncodedP", "unknown pointer encoding"); org.example.NativeSummaryFuncs.fprintf(null, "libunwind: %s - %s\n", "getSLEB128", "truncated sleb128 expression"); org.example.NativeSummaryFuncs.fprintf(null, "libunwind: %s - %s\n", "getSLEB128", "truncated sleb128 expression"); org.example.NativeSummaryFuncs.fprintf(null, "libunwind: %s - %s\n", "getEncodedP", "DW_EH_PE_textrel pointer encoding not supported"); org.example.NativeSummaryFuncs.fprintf(null, "libunwind: %s - %s\n", "getEncodedP", "unknown pointer encoding"); org.example.NativeSummaryFuncs.fprintf(null, "libunwind: %s - %s\n", "getEncodedP", "DW_EH_PE_aligned pointer encoding not supported"); $84_phi = 0; if $opred != 7 goto label07; $84_phi = null; goto label08; label07: if $opred != 8 goto label08; $84_phi = $p1; label08: $85_phi = 0; if $opred != 9 goto label09; $85_phi = null; goto label10; label09: if $opred != 10 goto label10; $85_phi = $p1; label10: $86_phi = 0; if $opred != 11 goto label11; $86_phi = null; goto label12; label11: if $opred != 12 goto label12; $86_phi = $p1; label12: org.example.NativeSummaryFuncs.fprintf(null, $84_phi, $85_phi, $86_phi); org.example.NativeSummaryFuncs.fprintf(null, "libunwind: %s - %s\n", "getEncodedP", "DW_EH_PE_datarel is invalid with a datarelBase of 0"); org.example.NativeSummaryFuncs.fprintf(null, "libunwind: %s - %s\n", "getEncodedP", "unknown pointer encoding"); org.example.NativeSummaryFuncs.fprintf(null, "libunwind: %s - %s\n", "getSLEB128", "truncated sleb128 expression"); org.example.NativeSummaryFuncs.fprintf(null, "libunwind: %s - %s\n", "getEncodedP", "DW_EH_PE_textrel pointer encoding not supported"); org.example.NativeSummaryFuncs.fprintf(null, "libunwind: %s - %s\n", "getEncodedP", "unknown pointer encoding"); org.example.NativeSummaryFuncs.fprintf(null, "libunwind: %s - %s\n", "getEncodedP", "DW_EH_PE_aligned pointer encoding not supported"); $94_phi = 0; if $opred != 13 goto label13; $94_phi = null; goto label14; label13: if $opred != 14 goto label14; $94_phi = $p1; label14: $95_phi = 0; if $opred != 15 goto label15; $95_phi = null; goto label16; label15: if $opred != 16 goto label16; $95_phi = $p1; label16: $96_phi = 0; if $opred != 17 goto label17; $96_phi = null; goto label18; label17: if $opred != 18 goto label18; $96_phi = $p1; label18: org.example.NativeSummaryFuncs.fprintf(null, $94_phi, $95_phi, $96_phi); org.example.NativeSummaryFuncs.fprintf(null, "libunwind: %s - %s\n", "getEncodedP", "DW_EH_PE_datarel is invalid with a datarelBase of 0"); org.example.NativeSummaryFuncs.fprintf(null, "libunwind: %s - %s\n", "getEncodedP", "unknown pointer encoding"); org.example.NativeSummaryFuncs.fprintf(null, "libunwind: %s - %s\n", "getULEB128", "malformed uleb128 expression"); org.example.NativeSummaryFuncs.fprintf(null, "libunwind: %s - %s\n", "getULEB128", "truncated uleb128 expression"); org.example.NativeSummaryFuncs.fprintf(null, "libunwind: %s - %s\n", "getSLEB128", "truncated sleb128 expression"); org.example.NativeSummaryFuncs.fprintf(null, "libunwind: %s - %s\n", "getEncodedP", "DW_EH_PE_textrel pointer encoding not supported"); org.example.NativeSummaryFuncs.fprintf(null, "libunwind: %s - %s\n", "getEncodedP", "unknown pointer encoding"); org.example.NativeSummaryFuncs.fprintf(null, "libunwind: %s - %s\n", "getEncodedP", "DW_EH_PE_aligned pointer encoding not supported"); $106_phi = 0; if $opred != 19 goto label19; $106_phi = null; goto label20; label19: if $opred != 20 goto label20; $106_phi = $p1; label20: $107_phi = 0; if $opred != 21 goto label21; $107_phi = null; goto label22; label21: if $opred != 22 goto label22; $107_phi = $p1; label22: $108_phi = 0; if $opred != 23 goto label23; $108_phi = null; goto label24; label23: if $opred != 24 goto label24; $108_phi = $p1; label24: org.example.NativeSummaryFuncs.fprintf(null, $106_phi, $107_phi, $108_phi); org.example.NativeSummaryFuncs.fprintf(null, "libunwind: %s - %s\n", "getEncodedP", "DW_EH_PE_datarel is invalid with a datarelBase of 0"); org.example.NativeSummaryFuncs.fprintf(null, "libunwind: %s - %s\n", "getEncodedP", "unknown pointer encoding"); org.example.NativeSummaryFuncs.fprintf(null, "libunwind: %s - %s\n", "getSLEB128", "truncated sleb128 expression"); org.example.NativeSummaryFuncs.fprintf(null, "libunwind: %s - %s\n", "getEncodedP", "DW_EH_PE_textrel pointer encoding not supported"); org.example.NativeSummaryFuncs.fprintf(null, "libunwind: %s - %s\n", "getEncodedP", "unknown pointer encoding"); org.example.NativeSummaryFuncs.fprintf(null, "libunwind: %s - %s\n", "getEncodedP", "DW_EH_PE_aligned pointer encoding not supported"); $116_phi = 0; if $opred != 25 goto label25; $116_phi = null; goto label26; label25: if $opred != 26 goto label26; $116_phi = $p1; label26: $117_phi = 0; if $opred != 27 goto label27; $117_phi = null; goto label28; label27: if $opred != 28 goto label28; $117_phi = $p1; label28: $118_phi = 0; if $opred != 29 goto label29; $118_phi = null; goto label30; label29: if $opred != 30 goto label30; $118_phi = $p1; label30: org.example.NativeSummaryFuncs.fprintf(null, $116_phi, $117_phi, $118_phi); org.example.NativeSummaryFuncs.fprintf(null, "libunwind: %s - %s\n", "getEncodedP", "DW_EH_PE_datarel is invalid with a datarelBase of 0"); org.example.NativeSummaryFuncs.fprintf(null, "libunwind: %s - %s\n", "getEncodedP", "unknown pointer encoding"); org.example.NativeSummaryFuncs.fprintf(null, "libunwind: %s - %s\n", "getSLEB128", "truncated sleb128 expression"); org.example.NativeSummaryFuncs.fprintf(null, "libunwind: %s - %s\n", "getEncodedP", "DW_EH_PE_textrel pointer encoding not supported"); org.example.NativeSummaryFuncs.fprintf(null, "libunwind: %s - %s\n", "getEncodedP", "unknown pointer encoding"); org.example.NativeSummaryFuncs.fprintf(null, "libunwind: %s - %s\n", "getEncodedP", "DW_EH_PE_aligned pointer encoding not supported"); $126_phi = 0; if $opred != 31 goto label31; $126_phi = null; goto label32; label31: if $opred != 32 goto label32; $126_phi = $p1; label32: $127_phi = 0; if $opred != 33 goto label33; $127_phi = null; goto label34; label33: if $opred != 34 goto label34; $127_phi = $p1; label34: $128_phi = 0; if $opred != 35 goto label35; $128_phi = null; goto label36; label35: if $opred != 36 goto label36; $128_phi = $p1; label36: org.example.NativeSummaryFuncs.fprintf(null, $126_phi, $127_phi, $128_phi); org.example.NativeSummaryFuncs.fprintf(null, "libunwind: %s - %s\n", "getEncodedP", "DW_EH_PE_datarel is invalid with a datarelBase of 0"); org.example.NativeSummaryFuncs.fprintf(null, "libunwind: %s - %s\n", "getEncodedP", "unknown pointer encoding"); org.example.NativeSummaryFuncs.fprintf(null, "libunwind: %s - %s\n", "getSLEB128", "truncated sleb128 expression"); org.example.NativeSummaryFuncs.fprintf(null, "libunwind: %s - %s\n", "getEncodedP", "DW_EH_PE_textrel pointer encoding not supported"); org.example.NativeSummaryFuncs.fprintf(null, "libunwind: %s - %s\n", "getEncodedP", "unknown pointer encoding"); org.example.NativeSummaryFuncs.fprintf(null, "libunwind: %s - %s\n", "getEncodedP", "DW_EH_PE_aligned pointer encoding not supported"); $136_phi = 0; if $opred != 37 goto label37; $136_phi = null; goto label38; label37: if $opred != 38 goto label38; $136_phi = $p1; label38: $137_phi = 0; if $opred != 39 goto label39; $137_phi = null; goto label40; label39: if $opred != 40 goto label40; $137_phi = $p1; label40: $138_phi = 0; if $opred != 41 goto label41; $138_phi = null; goto label42; label41: if $opred != 42 goto label42; $138_phi = $p1; label42: org.example.NativeSummaryFuncs.fprintf(null, $136_phi, $137_phi, $138_phi); org.example.NativeSummaryFuncs.fprintf(null, "libunwind: %s - %s\n", "getEncodedP", "DW_EH_PE_datarel is invalid with a datarelBase of 0"); $144 = org.example.NativeSummaryFuncs.fprintf(null, "libunwind: %s - %s\n", "getTableEntrySize", "Unknown DWARF encoding for search table."); $145 = org.example.NativeSummaryFuncs.fprintf(null, "libunwind: %s - %s\n", "getTableEntrySize", "Can\'t binary search on variable length encoded data."); org.example.NativeSummaryFuncs.fprintf(null, "libunwind: %s - %s\n", "getSLEB128", "truncated sleb128 expression"); org.example.NativeSummaryFuncs.fprintf(null, "libunwind: %s - %s\n", "getEncodedP", "DW_EH_PE_textrel pointer encoding not supported"); org.example.NativeSummaryFuncs.fprintf(null, "libunwind: %s - %s\n", "getEncodedP", "unknown pointer encoding"); org.example.NativeSummaryFuncs.fprintf(null, "libunwind: %s - %s\n", "getEncodedP", "DW_EH_PE_aligned pointer encoding not supported"); $150_phi = 0; if $opred != 45 goto label43; $150_phi = null; goto label44; label43: if $opred != 46 goto label44; $150_phi = $p1; label44: $151_phi = 0; if $opred != 47 goto label45; $151_phi = null; goto label46; label45: if $opred != 48 goto label46; $151_phi = $p1; label46: $152_phi = 0; if $opred != 49 goto label47; $152_phi = null; goto label48; label47: if $opred != 50 goto label48; $152_phi = $p1; label48: org.example.NativeSummaryFuncs.fprintf(null, $150_phi, $151_phi, $152_phi); org.example.NativeSummaryFuncs.fprintf(null, "libunwind: %s - %s\n", "getEncodedP", "DW_EH_PE_datarel is invalid with a datarelBase of 0"); org.example.NativeSummaryFuncs.fprintf(null, "libunwind: %s - %s\n", "getEncodedP", "unknown pointer encoding"); org.example.NativeSummaryFuncs.fprintf(null, "libunwind: %s - %s\n", "getSLEB128", "truncated sleb128 expression"); org.example.NativeSummaryFuncs.fprintf(null, "libunwind: %s - %s\n", "getEncodedP", "DW_EH_PE_textrel pointer encoding not supported"); org.example.NativeSummaryFuncs.fprintf(null, "libunwind: %s - %s\n", "getEncodedP", "unknown pointer encoding"); org.example.NativeSummaryFuncs.fprintf(null, "libunwind: %s - %s\n", "getEncodedP", "DW_EH_PE_aligned pointer encoding not supported"); $160_phi = 0; if $opred != 51 goto label49; $160_phi = null; goto label50; label49: if $opred != 52 goto label50; $160_phi = $p1; label50: $161_phi = 0; if $opred != 53 goto label51; $161_phi = null; goto label52; label51: if $opred != 54 goto label52; $161_phi = $p1; label52: $162_phi = 0; if $opred != 55 goto label53; $162_phi = null; goto label54; label53: if $opred != 56 goto label54; $162_phi = $p1; label54: org.example.NativeSummaryFuncs.fprintf(null, $160_phi, $161_phi, $162_phi); org.example.NativeSummaryFuncs.fprintf(null, "libunwind: %s - %s\n", "getEncodedP", "DW_EH_PE_datarel is invalid with a datarelBase of 0"); org.example.NativeSummaryFuncs.fprintf(null, "libunwind: %s - %s\n", "getEncodedP", "unknown pointer encoding"); org.example.NativeSummaryFuncs.fprintf(null, "libunwind: %s - %s\n", "getSLEB128", "truncated sleb128 expression"); org.example.NativeSummaryFuncs.fprintf(null, "libunwind: %s - %s\n", "getEncodedP", "DW_EH_PE_textrel pointer encoding not supported"); org.example.NativeSummaryFuncs.fprintf(null, "libunwind: %s - %s\n", "getEncodedP", "unknown pointer encoding"); org.example.NativeSummaryFuncs.fprintf(null, "libunwind: %s - %s\n", "getEncodedP", "DW_EH_PE_aligned pointer encoding not supported"); $170_phi = 0; if $opred != 57 goto label55; $170_phi = null; goto label56; label55: if $opred != 58 goto label56; $170_phi = $p1; label56: $171_phi = 0; if $opred != 59 goto label57; $171_phi = null; goto label58; label57: if $opred != 60 goto label58; $171_phi = $p1; label58: $172_phi = 0; if $opred != 61 goto label59; $172_phi = null; goto label60; label59: if $opred != 62 goto label60; $172_phi = $p1; label60: org.example.NativeSummaryFuncs.fprintf(null, $170_phi, $171_phi, $172_phi); org.example.NativeSummaryFuncs.fprintf(null, "libunwind: %s - %s\n", "getEncodedP", "DW_EH_PE_datarel is invalid with a datarelBase of 0"); org.example.NativeSummaryFuncs.fprintf(null, "libunwind: %s - %s\n", "getEncodedP", "unknown pointer encoding"); org.example.NativeSummaryFuncs.fprintf(null, "libunwind: %s - %s\n", "getSLEB128", "truncated sleb128 expression"); org.example.NativeSummaryFuncs.fprintf(null, "libunwind: %s - %s\n", "getSLEB128", "truncated sleb128 expression"); org.example.NativeSummaryFuncs.fprintf(null, "libunwind: %s - %s\n", "getEncodedP", "DW_EH_PE_textrel pointer encoding not supported"); org.example.NativeSummaryFuncs.fprintf(null, "libunwind: %s - %s\n", "getEncodedP", "unknown pointer encoding"); org.example.NativeSummaryFuncs.fprintf(null, "libunwind: %s - %s\n", "getEncodedP", "DW_EH_PE_aligned pointer encoding not supported"); $181_phi = 0; if $opred != 63 goto label61; $181_phi = null; goto label62; label61: if $opred != 64 goto label62; $181_phi = $p1; label62: $182_phi = 0; if $opred != 65 goto label63; $182_phi = null; goto label64; label63: if $opred != 66 goto label64; $182_phi = $p1; label64: $183_phi = 0; if $opred != 67 goto label65; $183_phi = null; goto label66; label65: if $opred != 68 goto label66; $183_phi = $p1; label66: org.example.NativeSummaryFuncs.fprintf(null, $181_phi, $182_phi, $183_phi); org.example.NativeSummaryFuncs.fprintf(null, "libunwind: %s - %s\n", "getEncodedP", "DW_EH_PE_datarel is invalid with a datarelBase of 0"); org.example.NativeSummaryFuncs.fprintf(null, "libunwind: %s - %s\n", "getEncodedP", "unknown pointer encoding"); org.example.NativeSummaryFuncs.fprintf(null, "libunwind: %s - %s\n", "getSLEB128", "truncated sleb128 expression"); org.example.NativeSummaryFuncs.fprintf(null, "libunwind: %s - %s\n", "getEncodedP", "DW_EH_PE_textrel pointer encoding not supported"); org.example.NativeSummaryFuncs.fprintf(null, "libunwind: %s - %s\n", "getEncodedP", "unknown pointer encoding"); org.example.NativeSummaryFuncs.fprintf(null, "libunwind: %s - %s\n", "getEncodedP", "DW_EH_PE_aligned pointer encoding not supported"); $191_phi = 0; if $opred != 69 goto label67; $191_phi = null; goto label68; label67: if $opred != 70 goto label68; $191_phi = $p1; label68: $192_phi = 0; if $opred != 71 goto label69; $192_phi = null; goto label70; label69: if $opred != 72 goto label70; $192_phi = $p1; label70: $193_phi = 0; if $opred != 73 goto label71; $193_phi = null; goto label72; label71: if $opred != 74 goto label72; $193_phi = $p1; label72: org.example.NativeSummaryFuncs.fprintf(null, $191_phi, $192_phi, $193_phi); org.example.NativeSummaryFuncs.fprintf(null, "libunwind: %s - %s\n", "getEncodedP", "DW_EH_PE_datarel is invalid with a datarelBase of 0"); org.example.NativeSummaryFuncs.fprintf(null, "libunwind: %s - %s\n", "getEncodedP", "unknown pointer encoding"); org.example.NativeSummaryFuncs.fprintf(null, "libunwind: %s - %s\n", "getULEB128", "malformed uleb128 expression"); org.example.NativeSummaryFuncs.fprintf(null, "libunwind: %s - %s\n", "getULEB128", "truncated uleb128 expression"); org.example.NativeSummaryFuncs.fprintf(null, "libunwind: %s - %s\n", "getSLEB128", "truncated sleb128 expression"); org.example.NativeSummaryFuncs.fprintf(null, "libunwind: %s - %s\n", "getEncodedP", "DW_EH_PE_textrel pointer encoding not supported"); org.example.NativeSummaryFuncs.fprintf(null, "libunwind: %s - %s\n", "getEncodedP", "unknown pointer encoding"); org.example.NativeSummaryFuncs.fprintf(null, "libunwind: %s - %s\n", "getEncodedP", "DW_EH_PE_aligned pointer encoding not supported"); $203_phi = 0; if $opred != 75 goto label73; $203_phi = null; goto label74; label73: if $opred != 76 goto label74; $203_phi = $p1; label74: $204_phi = 0; if $opred != 77 goto label75; $204_phi = null; goto label76; label75: if $opred != 78 goto label76; $204_phi = $p1; label76: $205_phi = 0; if $opred != 79 goto label77; $205_phi = null; goto label78; label77: if $opred != 80 goto label78; $205_phi = $p1; label78: org.example.NativeSummaryFuncs.fprintf(null, $203_phi, $204_phi, $205_phi); org.example.NativeSummaryFuncs.fprintf(null, "libunwind: %s - %s\n", "getEncodedP", "DW_EH_PE_datarel is invalid with a datarelBase of 0"); org.example.NativeSummaryFuncs.fprintf(null, "libunwind: %s - %s\n", "getEncodedP", "unknown pointer encoding"); org.example.NativeSummaryFuncs.fprintf(null, "libunwind: %s - %s\n", "getSLEB128", "truncated sleb128 expression"); org.example.NativeSummaryFuncs.fprintf(null, "libunwind: %s - %s\n", "getEncodedP", "DW_EH_PE_textrel pointer encoding not supported"); org.example.NativeSummaryFuncs.fprintf(null, "libunwind: %s - %s\n", "getEncodedP", "unknown pointer encoding"); org.example.NativeSummaryFuncs.fprintf(null, "libunwind: %s - %s\n", "getEncodedP", "DW_EH_PE_aligned pointer encoding not supported"); $213_phi = 0; if $opred != 81 goto label79; $213_phi = null; goto label80; label79: if $opred != 82 goto label80; $213_phi = $p1; label80: $214_phi = 0; if $opred != 83 goto label81; $214_phi = null; goto label82; label81: if $opred != 84 goto label82; $214_phi = $p1; label82: $215_phi = 0; if $opred != 85 goto label83; $215_phi = null; goto label84; label83: if $opred != 86 goto label84; $215_phi = $p1; label84: org.example.NativeSummaryFuncs.fprintf(null, $213_phi, $214_phi, $215_phi); org.example.NativeSummaryFuncs.fprintf(null, "libunwind: %s - %s\n", "getEncodedP", "DW_EH_PE_datarel is invalid with a datarelBase of 0"); org.example.NativeSummaryFuncs.fprintf(null, "libunwind: %s - %s\n", "getEncodedP", "unknown pointer encoding"); org.example.NativeSummaryFuncs.fprintf(null, "libunwind: %s - %s\n", "getULEB128", "malformed uleb128 expression"); org.example.NativeSummaryFuncs.fprintf(null, "libunwind: %s - %s\n", "getULEB128", "truncated uleb128 expression"); org.example.NativeSummaryFuncs.fprintf(null, "libunwind: %s - %s\n", "getULEB128", "malformed uleb128 expression"); org.example.NativeSummaryFuncs.fprintf(null, "libunwind: %s - %s\n", "getULEB128", "truncated uleb128 expression"); org.example.NativeSummaryFuncs.fprintf(null, "libunwind: %s - %s\n", "getULEB128", "malformed uleb128 expression"); org.example.NativeSummaryFuncs.fprintf(null, "libunwind: %s - %s\n", "getULEB128", "truncated uleb128 expression"); org.example.NativeSummaryFuncs.fprintf(null, "libunwind: %s - %s\n", "getSLEB128", "truncated sleb128 expression"); org.example.NativeSummaryFuncs.fprintf(null, "libunwind: %s - %s\n", "getEncodedP", "DW_EH_PE_textrel pointer encoding not supported"); org.example.NativeSummaryFuncs.fprintf(null, "libunwind: %s - %s\n", "getEncodedP", "unknown pointer encoding"); org.example.NativeSummaryFuncs.fprintf(null, "libunwind: %s - %s\n", "getEncodedP", "DW_EH_PE_aligned pointer encoding not supported"); $235 = org.example.NativeSummaryFuncs.fprintf(null, "libunwind: %s - %s\n", "getEncodedP", "DW_EH_PE_datarel is invalid with a datarelBase of 0"); $236 = org.example.NativeSummaryFuncs.fprintf(null, "libunwind: %s - %s\n", "getEncodedP", "unknown pointer encoding"); org.example.NativeSummaryFuncs.fprintf(null, "libunwind: %s - %s\n", "getULEB128", "malformed uleb128 expression"); org.example.NativeSummaryFuncs.fprintf(null, "libunwind: %s - %s\n", "getULEB128", "truncated uleb128 expression"); org.example.NativeSummaryFuncs.fprintf(null, "libunwind: %s - %s\n", "getULEB128", "malformed uleb128 expression"); org.example.NativeSummaryFuncs.fprintf(null, "libunwind: %s - %s\n", "getULEB128", "truncated uleb128 expression"); org.example.NativeSummaryFuncs.fprintf(null, "libunwind: %s - %s\n", "getULEB128", "malformed uleb128 expression"); org.example.NativeSummaryFuncs.fprintf(null, "libunwind: %s - %s\n", "getULEB128", "truncated uleb128 expression"); org.example.NativeSummaryFuncs.fprintf(null, "libunwind: %s - %s\n", "getULEB128", "malformed uleb128 expression"); org.example.NativeSummaryFuncs.fprintf(null, "libunwind: %s - %s\n", "getULEB128", "truncated uleb128 expression"); org.example.NativeSummaryFuncs.fprintf(null, "libunwind: %s - %s\n", "getULEB128", "malformed uleb128 expression"); org.example.NativeSummaryFuncs.fprintf(null, "libunwind: %s - %s\n", "getULEB128", "truncated uleb128 expression"); org.example.NativeSummaryFuncs.fprintf(null, "libunwind: %s - %s\n", "getULEB128", "malformed uleb128 expression"); org.example.NativeSummaryFuncs.fprintf(null, "libunwind: %s - %s\n", "getULEB128", "truncated uleb128 expression"); org.example.NativeSummaryFuncs.fprintf(null, "libunwind: %s - %s\n", "getULEB128", "malformed uleb128 expression"); org.example.NativeSummaryFuncs.fprintf(null, "libunwind: %s - %s\n", "getULEB128", "truncated uleb128 expression"); org.example.NativeSummaryFuncs.fprintf(null, "libunwind: %s - %s\n", "getULEB128", "malformed uleb128 expression"); org.example.NativeSummaryFuncs.fprintf(null, "libunwind: %s - %s\n", "getULEB128", "truncated uleb128 expression"); org.example.NativeSummaryFuncs.fprintf(null, "libunwind: %s - %s\n", "getULEB128", "malformed uleb128 expression"); org.example.NativeSummaryFuncs.fprintf(null, "libunwind: %s - %s\n", "getULEB128", "truncated uleb128 expression"); org.example.NativeSummaryFuncs.fprintf(null, "libunwind: %s - %s\n", "getULEB128", "malformed uleb128 expression"); org.example.NativeSummaryFuncs.fprintf(null, "libunwind: %s - %s\n", "getULEB128", "truncated uleb128 expression"); org.example.NativeSummaryFuncs.fprintf(null, "libunwind: %s - %s\n", "getULEB128", "malformed uleb128 expression"); org.example.NativeSummaryFuncs.fprintf(null, "libunwind: %s - %s\n", "getULEB128", "truncated uleb128 expression"); org.example.NativeSummaryFuncs.fprintf(null, "libunwind: %s - %s\n", "getULEB128", "malformed uleb128 expression"); org.example.NativeSummaryFuncs.fprintf(null, "libunwind: %s - %s\n", "getULEB128", "truncated uleb128 expression"); org.example.NativeSummaryFuncs.fprintf(null, "libunwind: %s - %s\n", "getULEB128", "malformed uleb128 expression"); org.example.NativeSummaryFuncs.fprintf(null, "libunwind: %s - %s\n", "getULEB128", "truncated uleb128 expression"); org.example.NativeSummaryFuncs.fprintf(null, "libunwind: %s - %s\n", "getULEB128", "malformed uleb128 expression"); org.example.NativeSummaryFuncs.fprintf(null, "libunwind: %s - %s\n", "getULEB128", "truncated uleb128 expression"); org.example.NativeSummaryFuncs.fprintf(null, "libunwind: %s - %s\n", "getULEB128", "malformed uleb128 expression"); org.example.NativeSummaryFuncs.fprintf(null, "libunwind: %s - %s\n", "getULEB128", "truncated uleb128 expression"); org.example.NativeSummaryFuncs.fprintf(null, "libunwind: %s - %s\n", "getULEB128", "malformed uleb128 expression"); org.example.NativeSummaryFuncs.fprintf(null, "libunwind: %s - %s\n", "getULEB128", "truncated uleb128 expression"); org.example.NativeSummaryFuncs.fprintf(null, "libunwind: %s - %s\n", "getULEB128", "malformed uleb128 expression"); org.example.NativeSummaryFuncs.fprintf(null, "libunwind: %s - %s\n", "getULEB128", "truncated uleb128 expression"); org.example.NativeSummaryFuncs.fprintf(null, "libunwind: %s - %s\n", "getULEB128", "malformed uleb128 expression"); org.example.NativeSummaryFuncs.fprintf(null, "libunwind: %s - %s\n", "getULEB128", "truncated uleb128 expression"); org.example.NativeSummaryFuncs.fprintf(null, "libunwind: %s - %s\n", "getULEB128", "malformed uleb128 expression"); org.example.NativeSummaryFuncs.fprintf(null, "libunwind: %s - %s\n", "getULEB128", "truncated uleb128 expression"); org.example.NativeSummaryFuncs.fprintf(null, "libunwind: %s - %s\n", "getULEB128", "malformed uleb128 expression"); org.example.NativeSummaryFuncs.fprintf(null, "libunwind: %s - %s\n", "getULEB128", "truncated uleb128 expression"); org.example.NativeSummaryFuncs.fprintf(null, "libunwind: %s - %s\n", "getSLEB128", "truncated sleb128 expression"); org.example.NativeSummaryFuncs.fprintf(null, "libunwind: %s - %s\n", "getSLEB128", "truncated sleb128 expression"); org.example.NativeSummaryFuncs.fprintf(null, "libunwind: malformed DW_CFA_val_offset DWARF unwind, reg (%lu) out of range\n\n", null); org.example.NativeSummaryFuncs.fprintf(null, "libunwind: %s - %s\n", "getSLEB128", "truncated sleb128 expression"); org.example.NativeSummaryFuncs.fprintf(null, "libunwind: %s - %s\n", "getSLEB128", "truncated sleb128 expression"); org.example.NativeSummaryFuncs.malloc(null); org.example.NativeSummaryFuncs.free(null); org.example.NativeSummaryFuncs.fprintf(null, "libunwind: %s - %s\n", "getSLEB128", "truncated sleb128 expression"); org.example.NativeSummaryFuncs.fprintf(null, "libunwind: %s - %s\n", "getSLEB128", "truncated sleb128 expression"); org.example.NativeSummaryFuncs.fprintf(null, "libunwind: malformed DW_CFA_val_offset DWARF unwind, reg (%lu) out of range\n\n", null); org.example.NativeSummaryFuncs.fprintf(null, "libunwind: %s - %s\n", "getSLEB128", "truncated sleb128 expression"); org.example.NativeSummaryFuncs.fprintf(null, "libunwind: %s - %s\n", "getSLEB128", "truncated sleb128 expression"); org.example.NativeSummaryFuncs.free(null); org.example.NativeSummaryFuncs.malloc(1L); org.example.NativeSummaryFuncs.malloc(1L); org.example.NativeSummaryFuncs.getpid(); org.example.NativeSummaryFuncs.fclose(null); org.example.NativeSummaryFuncs.malloc(1L); org.example.NativeSummaryFuncs.malloc(1L); org.example.NativeSummaryFuncs.malloc(1L); org.example.NativeSummaryFuncs.free(null); org.example.NativeSummaryFuncs.free(null); org.example.NativeSummaryFuncs.free(null); org.example.NativeSummaryFuncs.free(null); org.example.NativeSummaryFuncs.free(null); org.example.NativeSummaryFuncs.free(null); org.example.NativeSummaryFuncs.free(null); org.example.NativeSummaryFuncs.malloc(1L); org.example.NativeSummaryFuncs.malloc(1L); org.example.NativeSummaryFuncs.malloc(1L); org.example.NativeSummaryFuncs.free(null); $310_phi = 0; if $opred != 95 goto label85; $310_phi = $58; goto label92; label85: if $opred != 96 goto label86; $310_phi = $236; goto label92; label86: if $opred != 97 goto label87; $310_phi = $144; goto label92; label87: if $opred != 98 goto label88; $310_phi = null; goto label92; label88: if $opred != 99 goto label89; $310_phi = $235; goto label92; label89: if $opred != 100 goto label90; $310_phi = $p1; goto label92; label90: if $opred != 101 goto label91; $310_phi = $p0; goto label92; label91: if $opred != 102 goto label92; $310_phi = $145; label92: org.example.NativeSummaryFuncs.stat($310_phi, null); org.example.NativeSummaryFuncs.free(null); org.example.NativeSummaryFuncs.free(null); org.example.NativeSummaryFuncs.malloc(1L); org.example.NativeSummaryFuncs.free(null); org.example.NativeSummaryFuncs.free(null); org.example.NativeSummaryFuncs.free(null); org.example.NativeSummaryFuncs.free(null); org.example.NativeSummaryFuncs.free(null); org.example.NativeSummaryFuncs.open(null, 193L, null); org.example.NativeSummaryFuncs.close(null); org.example.NativeSummaryFuncs.free(null); org.example.NativeSummaryFuncs.malloc(1L); org.example.NativeSummaryFuncs.free(null); org.example.NativeSummaryFuncs.free(null); org.example.NativeSummaryFuncs.free(null); org.example.NativeSummaryFuncs.free(null); org.example.NativeSummaryFuncs.free(null); org.example.NativeSummaryFuncs.close(null); org.example.NativeSummaryFuncs.free(null); org.example.NativeSummaryFuncs.free(null); org.example.NativeSummaryFuncs.free(null); org.example.NativeSummaryFuncs.free(null); $340_phi = 0; if $opred != 103 goto label93; $340_phi = null; goto label94; label93: if $opred != 104 goto label94; $340_phi = $p1; label94: org.example.NativeSummaryFuncs.fprintf(null, "COULD NOT CREATE A LOGGINGFILE %s!", null, $340_phi, null, null, null, null); org.example.NativeSummaryFuncs.free(null); org.example.NativeSummaryFuncs.free(null); org.example.NativeSummaryFuncs.free(null); org.example.NativeSummaryFuncs.open(null, 193L, null); org.example.NativeSummaryFuncs.close(null); org.example.NativeSummaryFuncs.close(null); return; }
1 the param1 printed by printf nsfunc_sink
org.andglkmod.hunkypunk_7.apk Source: $r1 = virtualinvoke $r0.<java.io.File: java.lang.String getAbsolutePath()>() Sink: staticinvoke <org.example.NativeSummaryFuncs: int fclose(int)>($i0)
https://github.com/retrobits/son_of_hunkypunk/blob/d42dc5ca153f96f252576d4bcfa3f0fac69826f0/app/src/main/jni/babel/babel.cpp#L37 extern "C" jstring Java_org_andglk_babel_Babel_examine(JNIEnv *env, jclass cls, jstring filepath) { if(cls){} //remove unused warning const char* copy_filepath = env->GetStringUTFChars(filepath, 0); babel_init(copy_filepath); void* sf = babel_get_story_file(); uint32 sl = babel_get_story_length(); #define IFID_BUFLEN 128 char ifid_buffer[IFID_BUFLEN]; ifid_buffer[0] = 0; // should be able to do this... why not? todo: redo libbabel.so from upstream dist //babel_treaty(GET_STORY_FILE_IFID_SEL, ifid_buffer, IFID_BUFLEN); if (zcode_treaty(CLAIM_STORY_FILE_SEL, sf, sl, 0, 0) == VALID_STORY_FILE_RV) zcode_treaty(GET_STORY_FILE_IFID_SEL, sf, sl, ifid_buffer, IFID_BUFLEN); else if (tads2_treaty(CLAIM_STORY_FILE_SEL, sf, sl, 0, 0) == VALID_STORY_FILE_RV) tads2_treaty(GET_STORY_FILE_IFID_SEL, sf, sl, ifid_buffer, IFID_BUFLEN); else if (tads3_treaty(CLAIM_STORY_FILE_SEL, sf, sl, 0, 0) == VALID_STORY_FILE_RV) tads3_treaty(GET_STORY_FILE_IFID_SEL, sf, sl, ifid_buffer, IFID_BUFLEN); else if (glulx_treaty(CLAIM_STORY_FILE_SEL, sf, sl, 0, 0) == VALID_STORY_FILE_RV) glulx_treaty(GET_STORY_FILE_IFID_SEL, sf, sl, ifid_buffer, IFID_BUFLEN); babel_release(); env->ReleaseStringUTFChars(filepath, copy_filepath); if (ifid_buffer[0]) return env->NewStringUTF(ifid_buffer); else return 0; }
$r1_1 = staticinvoke <org.andglkmod.babel.Babel: java.lang.String examine(java.lang.String)>($r1) $i0 = staticinvoke <org.example.NativeSummaryFuncs: int fopen(java.lang.String,java.lang.String)>($r0, "rb") $r1 = staticinvoke <org.example.NativeSummaryFuncs: java.lang.String calloc(int,long)>($i0, 1L) staticinvoke <org.example.NativeSummaryFuncs: int fprintf(java.lang.Object,java.lang.String,int,java.lang.String,java.lang.String)>(null, "Error: Memory exceeded (%d for %s)!\n", $i0, "story file storage", "") staticinvoke <org.example.NativeSummaryFuncs: int fread(java.lang.String,long,int,int)>($r1, 1L, $i0, $i0) staticinvoke <org.example.NativeSummaryFuncs: int fclose(int)>($i0)
$r1 = virtualinvoke $r0.<java.io.File: java.lang.String getAbsolutePath()>() $r1_1 = staticinvoke <org.andglkmod.babel.Babel: java.lang.String examine(java.lang.String)>($r1) $r0 := @parameter0: java.lang.String $i0 = staticinvoke <org.example.NativeSummaryFuncs: int fopen(java.lang.String,java.lang.String)>($r0, "rb") $r1 = staticinvoke <org.example.NativeSummaryFuncs: java.lang.String calloc(int,long)>($i0, 1L) staticinvoke <org.example.NativeSummaryFuncs: int fprintf(java.lang.Object,java.lang.String,int,java.lang.String,java.lang.String)>(null, "Error: Memory exceeded (%d for %s)!\n", $i0, "story file storage", "") staticinvoke <org.example.NativeSummaryFuncs: int fread(java.lang.String,long,int,int)>($r1, 1L, $i0, $i0) staticinvoke <org.example.NativeSummaryFuncs: int fclose(int)>($i0)
param0 -> fopen
private static java.lang.String examine(java.lang.String) { long $29_phi, $36_phi, $40_phi; int $2, $opred, $35; java.lang.String $p0, $3, $10_phi, $14_phi, $19_phi; $p0 := @parameter0; $2 = org.example.NativeSummaryFuncs.fopen($p0, "rb"); $3 = org.example.NativeSummaryFuncs.calloc($2, 1L); org.example.NativeSummaryFuncs.fprintf(null, "Error: Memory exceeded (%d for %s)!\n", $2, "story file storage", ""); org.example.NativeSummaryFuncs.exit(2L); org.example.NativeSummaryFuncs.fread($3, 1L, $2, $2); org.example.NativeSummaryFuncs.fclose($2); org.example.NativeSummaryFuncs.sprintf(null, "ZCODE-%d-%s-%04X", null, null, null); org.example.NativeSummaryFuncs.sprintf(null, "ZCODE-%d-%s", null, null); $10_phi = null; $opred = org.example.NativeSummaryAux.opaqueInt(); if $opred != 1 goto label01; $10_phi = ""; goto label02; label01: if $opred != 2 goto label02; $10_phi = $3; label02: org.example.NativeSummaryFuncs.sprintf($10_phi, ".z%d", null); org.example.NativeSummaryFuncs.malloc($p0); org.example.NativeSummaryFuncs.sprintf($p0, "%02X", null); $14_phi = null; if $opred != 3 goto label03; $14_phi = "jpg"; goto label04; label03: if $opred != 4 goto label04; $14_phi = "png"; label04: org.example.NativeSummaryFuncs.sprintf(null, " <cover>\n <format>%s</format>\n <height>%lu</height>\n <width>%lu</width>\n </cover>\n", $14_phi, $p0, $p0); org.example.NativeSummaryFuncs.free($p0); org.example.NativeSummaryFuncs.free($p0); org.example.NativeSummaryFuncs.sprintf($p0, "%02X", null); $19_phi = null; if $opred != 5 goto label05; $19_phi = "jpg"; goto label06; label05: if $opred != 6 goto label06; $19_phi = "png"; label06: org.example.NativeSummaryFuncs.sprintf(null, " <cover>\n <format>%s</format>\n <height>%lu</height>\n <width>%lu</width>\n </cover>\n", $19_phi, $p0, $p0); org.example.NativeSummaryFuncs.free($p0); org.example.NativeSummaryFuncs.calloc($p0, 1L); org.example.NativeSummaryFuncs.fprintf(null, "Error: Memory exceeded (%d for %s)!\n", $p0, "Metadata buffer", null); org.example.NativeSummaryFuncs.exit(2L); org.example.NativeSummaryFuncs.free($p0); org.example.NativeSummaryFuncs.sprintf(null, "ZCODE-%d-%s-%04X", null, null, 26368L); org.example.NativeSummaryFuncs.sprintf(null, "ZCODE-%d-%s", null, null); $29_phi = 0; if $opred != 7 goto label07; $29_phi = 116L; goto label09; label07: if $opred != 8 goto label08; $29_phi = 104L; goto label09; label08: if $opred != 9 goto label09; $29_phi = 122L; label09: org.example.NativeSummaryFuncs.sprintf(null, ".z%d", $29_phi); org.example.NativeSummaryFuncs.calloc(1297L, 1L); org.example.NativeSummaryFuncs.fprintf(null, "Error: Memory exceeded (%d for %s)!\n", 1297L, "contained story file", null); org.example.NativeSummaryFuncs.exit(2L); org.example.NativeSummaryFuncs.sprintf("", "%sed %s", null, null); $35 = org.example.NativeSummaryFuncs.strdup(null); $36_phi = 0; if $opred != 10 goto label10; $36_phi = 27648L; goto label15; label10: if $opred != 11 goto label11; $36_phi = 26368L; goto label15; label11: if $opred != 12 goto label12; $36_phi = null; goto label15; label12: if $opred != 13 goto label13; $36_phi = 111L; goto label15; label13: if $opred != 14 goto label14; $36_phi = 27759L; goto label15; label14: if $opred != 15 goto label15; $36_phi = 26479L; label15: org.example.NativeSummaryFuncs.sprintf(null, "ZCODE-%d-%s-%04X", $p0, null, $36_phi); org.example.NativeSummaryFuncs.sprintf(null, "ZCODE-%d-%s", $p0, null); org.example.NativeSummaryFuncs.sprintf(null, ".z%d", $p0); $40_phi = 0; if $opred != 16 goto label16; $40_phi = 27648L; goto label21; label16: if $opred != 17 goto label17; $40_phi = 26368L; goto label21; label17: if $opred != 18 goto label18; $40_phi = null; goto label21; label18: if $opred != 19 goto label19; $40_phi = 111L; goto label21; label19: if $opred != 20 goto label20; $40_phi = 27759L; goto label21; label20: if $opred != 21 goto label21; $40_phi = 26479L; label21: org.example.NativeSummaryFuncs.sprintf(null, "ZCODE-%d-%s-%04X", $p0, null, $40_phi); org.example.NativeSummaryFuncs.sprintf(null, "ZCODE-%d-%s", $p0, null); org.example.NativeSummaryFuncs.sprintf(null, ".z%d", $p0); org.example.NativeSummaryFuncs.free($p0); org.example.NativeSummaryFuncs.free($p0); org.example.NativeSummaryFuncs.free($p0); org.example.NativeSummaryFuncs.sprintf(null, "GLULX-%08X-%08X", null, null); org.example.NativeSummaryFuncs.sprintf(null, "GLULX-%u-%s-%04X", null, null, null); org.example.NativeSummaryFuncs.sprintf(null, "GLULX-%08X-%08X", null, null); org.example.NativeSummaryFuncs.sprintf(null, "GLULX-%u-%s-%04X", null, null, null); org.example.NativeSummaryFuncs.free($3); org.example.NativeSummaryFuncs.free(null); org.example.NativeSummaryFuncs.free($35); return $p0; }
1 param0 file path is opened in native code nsfunc_sink
com.intervigil.micdroid_34.apk Source: $r2 = virtualinvoke $r0.<android.content.Context: java.lang.String getString(int)>(2131099754) Sink: staticinvoke <android.util.Log: int d(java.lang.String,java.lang.String)>("libautotalent.so", $r0_8)
https://github.com/intervigilium/libautotalent/blob/842e489b5020bc7b9c50bc72498dc1657fa03918/jni/autotalent/autotalent-interface.c#L58 JNIEXPORT void JNICALL Java_net_sourceforge_autotalent_Autotalent_instantiateAutotalent(JNIEnv * env, jclass class, jint sampleRate) { if (instance == NULL) { instance = instantiateAutotalent(sampleRate); __android_log_print(ANDROID_LOG_DEBUG, "libautotalent.so", "instantiated autotalent with sample rate: %d", sampleRate); } }
staticinvoke <net.sourceforge.autotalent.Autotalent: void instantiateAutotalent(int)>($i2)
$r2 = virtualinvoke $r0.<android.content.Context: java.lang.String getString(int)>(2131099754) $r2_1 = interfaceinvoke $r1.<android.content.SharedPreferences: java.lang.String getString(java.lang.String,java.lang.String)>($r2, "-1") $i0 = staticinvoke <java.lang.Integer: int parseInt(java.lang.String)>($r2_1) return $i0 $i2 = staticinvoke <com.intervigil.micdroid.helper.PreferenceHelper: int getSampleRate(android.content.Context)>(r0) staticinvoke <net.sourceforge.autotalent.Autotalent: void instantiateAutotalent(int)>($i2) $i0 := @parameter0: int $r1_2 = staticinvoke <java.lang.Integer: java.lang.Integer valueOf(int)>($i0) $r0_8 = virtualinvoke $r1_2.<java.lang.Integer: java.lang.String toString()>() staticinvoke <android.util.Log: int d(java.lang.String,java.lang.String)>("libautotalent.so", $r0_8)
param0 logged by __android_log_print
public static void instantiateAutotalent(int) { long $1_phi, $3_phi, $5_phi, $15_phi, $18_phi, $20_phi, $23_phi, $25_phi, $27_phi, $29_phi, $31_phi, $33_phi; java.lang.Integer boxed, boxed; int $p0, $opred; java.lang.String $50_phi, $casted, $54_phi, $casted; $p0 := @parameter0; org.example.NativeSummaryFuncs.malloc(312L); $1_phi = 0; $opred = org.example.NativeSummaryAux.opaqueInt(); if $opred != 1 goto label01; $1_phi = 2048L; goto label03; label01: if $opred != 2 goto label02; $1_phi = 4096L; goto label03; label02: if $opred != 3 goto label03; $1_phi = 88199L; label03: org.example.NativeSummaryFuncs.calloc($1_phi, 4L); $3_phi = 0; if $opred != 4 goto label04; $3_phi = 2048L; goto label06; label04: if $opred != 5 goto label05; $3_phi = 4096L; goto label06; label05: if $opred != 6 goto label06; $3_phi = 88199L; label06: org.example.NativeSummaryFuncs.calloc($3_phi, 4L); $5_phi = 0; if $opred != 7 goto label07; $5_phi = 2048L; goto label09; label07: if $opred != 8 goto label08; $5_phi = 4096L; goto label09; label08: if $opred != 9 goto label09; $5_phi = 88199L; label09: org.example.NativeSummaryFuncs.calloc($5_phi, 4L); org.example.NativeSummaryFuncs.calloc(7L, 4L); org.example.NativeSummaryFuncs.calloc(7L, 4L); org.example.NativeSummaryFuncs.calloc(7L, 4L); org.example.NativeSummaryFuncs.calloc(7L, 4L); org.example.NativeSummaryFuncs.calloc(7L, 4L); org.example.NativeSummaryFuncs.calloc(7L, 4L); org.example.NativeSummaryFuncs.calloc(7L, 4L); org.example.NativeSummaryFuncs.malloc(28L); $15_phi = 0; if $opred != 10 goto label10; $15_phi = 2048L; goto label12; label10: if $opred != 11 goto label11; $15_phi = 4096L; goto label12; label11: if $opred != 12 goto label12; $15_phi = 88199L; label12: org.example.NativeSummaryFuncs.calloc($15_phi, 4L); org.example.NativeSummaryFuncs.calloc(7L, 4L); $18_phi = 0; if $opred != 13 goto label13; $18_phi = 2048L; goto label15; label13: if $opred != 14 goto label14; $18_phi = 4096L; goto label15; label14: if $opred != 15 goto label15; $18_phi = 88199L; label15: org.example.NativeSummaryFuncs.calloc($18_phi, 4L); $20_phi = 0; if $opred != 16 goto label16; $20_phi = 2048L; goto label18; label16: if $opred != 17 goto label17; $20_phi = 4096L; goto label18; label17: if $opred != 18 goto label18; $20_phi = 88199L; label18: org.example.NativeSummaryFuncs.calloc($20_phi, 4L); org.example.NativeSummaryFuncs.malloc(12L); $23_phi = 0; if $opred != 19 goto label19; $23_phi = 2048L; goto label21; label19: if $opred != 20 goto label20; $23_phi = 4096L; goto label21; label20: if $opred != 21 goto label21; $23_phi = 88199L; label21: org.example.NativeSummaryFuncs.calloc($23_phi, 4L); $25_phi = 0; if $opred != 22 goto label22; $25_phi = 2048L; goto label24; label22: if $opred != 23 goto label23; $25_phi = 4096L; goto label24; label23: if $opred != 24 goto label24; $25_phi = 88199L; label24: org.example.NativeSummaryFuncs.calloc($25_phi, 4L); $27_phi = 0; if $opred != 25 goto label25; $27_phi = 1025L; goto label27; label25: if $opred != 26 goto label26; $27_phi = 2049L; goto label27; label26: if $opred != 27 goto label27; $27_phi = 44100L; label27: org.example.NativeSummaryFuncs.calloc($27_phi, 4L); $29_phi = 0; if $opred != 28 goto label28; $29_phi = 1025L; goto label30; label28: if $opred != 29 goto label29; $29_phi = 2049L; goto label30; label29: if $opred != 30 goto label30; $29_phi = 44100L; label30: org.example.NativeSummaryFuncs.calloc($29_phi, 4L); $31_phi = 0; if $opred != 31 goto label31; $31_phi = 2048L; goto label33; label31: if $opred != 32 goto label32; $31_phi = 4096L; goto label33; label32: if $opred != 33 goto label33; $31_phi = 88199L; label33: org.example.NativeSummaryFuncs.calloc($31_phi, 4L); $33_phi = 0; if $opred != 34 goto label34; $33_phi = 2048L; goto label36; label34: if $opred != 35 goto label35; $33_phi = 4096L; goto label36; label35: if $opred != 36 goto label36; $33_phi = 88199L; label36: org.example.NativeSummaryFuncs.calloc($33_phi, 4L); org.example.NativeSummaryFuncs.malloc(4L); org.example.NativeSummaryFuncs.malloc(4L); org.example.NativeSummaryFuncs.malloc(4L); org.example.NativeSummaryFuncs.malloc(4L); org.example.NativeSummaryFuncs.malloc(4L); org.example.NativeSummaryFuncs.malloc(4L); org.example.NativeSummaryFuncs.malloc(4L); org.example.NativeSummaryFuncs.malloc(4L); org.example.NativeSummaryFuncs.malloc(4L); org.example.NativeSummaryFuncs.malloc(4L); org.example.NativeSummaryFuncs.malloc(4L); org.example.NativeSummaryFuncs.malloc(4L); org.example.NativeSummaryFuncs.malloc(4L); org.example.NativeSummaryFuncs.malloc(4L); org.example.NativeSummaryFuncs.malloc(4L); $50_phi = null; if $opred != 37 goto label37; boxed = java.lang.Integer.valueOf($p0); $casted = virtualinvoke boxed.toString(); $50_phi = $casted; goto label39; label37: if $opred != 38 goto label38; $50_phi = null; goto label39; label38: if $opred != 39 goto label39; $50_phi = "instantiated autotalent with sample rate: %d"; label39: android.util.Log.d("libautotalent.so", $50_phi); $54_phi = null; if $opred != 40 goto label40; boxed = java.lang.Integer.valueOf($p0); $casted = virtualinvoke boxed.toString(); $54_phi = $casted; goto label41; label40: if $opred != 41 goto label41; $54_phi = "instantiated autotalent with sample rate: %d"; label41: android.util.Log.d("libautotalent.so", $54_phi); return; }
1 param0 logged by __android_log_print log_sink
com.traffar.gomoku_4.apk Source: getDeviceIds()>() Sink: staticinvoke <org.example.NativeSummaryFuncs: int realloc(int,int)>($i5_15, $i6_14)
https://github.com/libsdl-org/SDL/blob/9ce7fe2848a2cb3a610558eaf872b4a57fdfffc9/src/core/android/SDL_android.c#L1068 JNIEXPORT jint JNICALL SDL_JAVA_CONTROLLER_INTERFACE(nativeAddJoystick)( JNIEnv *env, jclass jcls, jint device_id, jstring device_name, jstring device_desc, jint vendor_id, jint product_id, jint button_mask, jint naxes, jint axis_mask, jint nhats) { int retval; const char *name = (*env)->GetStringUTFChars(env, device_name, NULL); const char *desc = (*env)->GetStringUTFChars(env, device_desc, NULL); retval = Android_AddJoystick(device_id, name, desc, vendor_id, product_id, button_mask, naxes, axis_mask, nhats); (*env)->ReleaseStringUTFChars(env, device_name, name); (*env)->ReleaseStringUTFChars(env, device_desc, desc); return retval; }
staticinvoke <org.libsdl.app.SDLActivity: int nativeAddJoystick(int,java.lang.String,int,int,int,int,int)>($i1_14, $r5_2, 0, -1, $i2_1, $i3_2, 0) staticinvoke <org.example.NativeSummaryFuncs: int realloc(int,int)>($i5_15, $i6_14)
getDeviceIds()>() $i1_7 = $r2[$i0_2] $r3_2.<org.libsdl.app.SDLJoystickHandler_API12$SDLJoystick: int device_id> = $i1_7 $i1_14 = $r3_2.<org.libsdl.app.SDLJoystickHandler_API12$SDLJoystick: int device_id> staticinvoke <org.libsdl.app.SDLActivity: int nativeAddJoystick(int,java.lang.String,int,int,int,int,int)>($i1_14, $r5_2, 0, -1, $i2_1, $i3_2, 0) $i0 := @parameter0: int $i6_14 = $i0 staticinvoke <org.example.NativeSummaryFuncs: int realloc(int,int)>($i5_15, $i6_14)
param0 -> realloc
public static int nativeAddJoystick(int, java.lang.String, int, int, int, int, int) { int $p0, $p2, $p3, $p4, $p5, $p6, $3, $opred, $10_phi, $11_phi, $16_phi, $17_phi, $19_phi, $20_phi; java.lang.String $p1, $8_phi; $p0 := @parameter0; $p1 := @parameter1; $p2 := @parameter2; $p3 := @parameter3; $p4 := @parameter4; $p5 := @parameter5; $p6 := @parameter6; org.example.NativeSummaryFuncs.raise(8L); org.example.NativeSummaryFuncs.AttachCurrentThread(null, null, null); $3 = org.example.NativeSummaryFuncs.malloc(56L); org.example.NativeSummaryFuncs.strdup($p1); org.example.NativeSummaryFuncs.calloc(1L, 32L); org.example.NativeSummaryFuncs.raise(8L); $8_phi = null; $opred = org.example.NativeSummaryAux.opaqueInt(); if $opred != 1 goto label01; $8_phi = "ERROR"; goto label02; label01: if $opred != 2 goto label02; $8_phi = "INFO"; label02: org.example.NativeSummaryFuncs.fprintf(null, "%s: %s\n", $8_phi, null); $10_phi = 0; if $opred != 3 goto label03; $10_phi = $p0; goto label05; label03: if $opred != 4 goto label04; $10_phi = $p2; goto label05; label04: if $opred != 5 goto label05; $10_phi = $p3; label05: $11_phi = 0; if $opred != 6 goto label06; $11_phi = $p0; goto label08; label06: if $opred != 7 goto label07; $11_phi = $p2; goto label08; label07: if $opred != 8 goto label08; $11_phi = $p3; label08: org.example.NativeSummaryFuncs.realloc($10_phi, $11_phi); org.example.NativeSummaryFuncs.malloc(12L); org.example.NativeSummaryFuncs.free(null); org.example.NativeSummaryFuncs.malloc(776L); $16_phi = 0; if $opred != 9 goto label09; $16_phi = $p0; goto label11; label09: if $opred != 10 goto label10; $16_phi = $p2; goto label11; label10: if $opred != 11 goto label11; $16_phi = $p3; label11: $17_phi = 0; if $opred != 12 goto label12; $17_phi = $p0; goto label14; label12: if $opred != 13 goto label13; $17_phi = $p2; goto label14; label13: if $opred != 14 goto label14; $17_phi = $p3; label14: org.example.NativeSummaryFuncs.realloc($16_phi, $17_phi); $19_phi = 0; if $opred != 15 goto label15; $19_phi = $p0; goto label17; label15: if $opred != 16 goto label16; $19_phi = $p2; goto label17; label16: if $opred != 17 goto label17; $19_phi = $p3; label17: $20_phi = 0; if $opred != 18 goto label18; $20_phi = $p0; goto label20; label18: if $opred != 19 goto label19; $20_phi = $p2; goto label20; label19: if $opred != 20 goto label20; $20_phi = $p3; label20: org.example.NativeSummaryFuncs.realloc($19_phi, $20_phi); org.example.NativeSummaryFuncs.malloc(776L); org.example.NativeSummaryFuncs.malloc(16L); org.example.NativeSummaryFuncs.malloc(80L); org.example.NativeSummaryFuncs.free($3); return 4294967295L; }
1 the calloc size is calculated from param0 nsfunc_sink
org.kwaak3_1.apk Source: $r3_2 = staticinvoke <android.os.Environment: java.io.File getExternalStorageDirectory()>() Sink: $r0_1 = staticinvoke <org.example.NativeSummaryFuncs: java.lang.String strdup(java.lang.String)>($r0)
https://github.com/CalcProgrammer1/kwaak3/blob/fd58ced3d1b37064868af0ab2490f4e4a8439acf/kwaak/project/jni/kwaakjni.c#L354 JNIEXPORT void JNICALL Java_org_kwaak3_KwaakJNI_setGameDirectory(JNIEnv *env, jclass c, jstring jpath) { jboolean iscopy; const jbyte *path = (*env)->GetStringUTFChars(env, jpath, &iscopy); game_dir = strdup(path); setenv("GAME_PATH", game_dir, 1); (*env)->ReleaseStringUTFChars(env, jpath, path); #ifdef DEBUG __android_log_print(ANDROID_LOG_DEBUG, "Quake_JNI", "game path=%s\n", game_dir); #endif }
staticinvoke <org.kwaak3.KwaakJNI: void setGameDirectory(java.lang.String)>($r6_1) $r0_1 = staticinvoke <org.example.NativeSummaryFuncs: java.lang.String strdup(java.lang.String)>($r0)
$r3_2 = staticinvoke <android.os.Environment: java.io.File getExternalStorageDirectory()>() $r6 = virtualinvoke $r3_2.<java.io.File: java.lang.String getPath()>() $r5 = virtualinvoke $r8.<java.lang.StringBuilder: java.lang.StringBuilder append(java.lang.String)>($r6) $r5_1 = virtualinvoke $r5.<java.lang.StringBuilder: java.lang.StringBuilder append(java.lang.String)>("/quake3") $r6_1 = virtualinvoke $r5_1.<java.lang.StringBuilder: java.lang.String toString()>() staticinvoke <org.kwaak3.KwaakJNI: void setGameDirectory(java.lang.String)>($r6_1) $r0 := @parameter0: java.lang.String $r0_1 = staticinvoke <org.example.NativeSummaryFuncs: java.lang.String strdup(java.lang.String)>($r0)
param0 string -> strdup
public static void setGameDirectory(java.lang.String) { int $opred; java.lang.String $p0, $2, $6_phi; $p0 := @parameter0; $2 = org.example.NativeSummaryFuncs.strdup($p0); $6_phi = null; $opred = org.example.NativeSummaryAux.opaqueInt(); if $opred != 1 goto label1; $6_phi = $2; goto label2; label1: if $opred != 2 goto label2; $6_phi = "game path=%s\n"; label2: android.util.Log.d("Quake_JNI", $6_phi); return; }
1 param0 string -> strdup nsfunc_sink
org.develz.crawl_1.apk Source: $i0 = virtualinvoke $r1.<android.view.KeyEvent: int getKeyCode()>() Sink: staticinvoke <android.util.Log: int i(java.lang.String,java.lang.String)>("SDL", $r0_3)
https://github.com/libsdl-org/SDL/blob/9ce7fe2848a2cb3a610558eaf872b4a57fdfffc9/src/core/android/SDL_android.c#L1208 /* Keyup */ JNIEXPORT void JNICALL SDL_JAVA_INTERFACE(onNativeKeyUp)( JNIEnv *env, jclass jcls, jint keycode) { SDL_LockMutex(Android_ActivityMutex); if (Android_Window) { Android_OnKeyUp(keycode); } SDL_UnlockMutex(Android_ActivityMutex); } int Android_OnKeyUp(int keycode) { return SDL_SendKeyboardKey(0, SDL_DEFAULT_KEYBOARD_ID, SDL_RELEASED, TranslateKeycode(keycode)); } int SDL_SendKeyboardKey(Uint64 timestamp, SDL_KeyboardID keyboardID, Uint8 state, SDL_Scancode scancode) { return SDL_SendKeyboardKeyInternal(timestamp, KEYBOARD_HARDWARE, keyboardID, state, scancode, SDLK_UNKNOWN); } static int SDL_SendKeyboardKeyInternal(Uint64 timestamp, Uint32 flags, SDL_KeyboardID keyboardID, Uint8 state, SDL_Scancode scancode, SDL_Keycode keycode) { SDL_Keyboard *keyboard = &SDL_keyboard; int posted; SDL_Keymod modifier; Uint32 type; Uint8 repeat = SDL_FALSE; const Uint8 source = flags & KEYBOARD_SOURCE_MASK; if (scancode == SDL_SCANCODE_UNKNOWN || scancode >= SDL_NUM_SCANCODES) { return 0; } #ifdef DEBUG_KEYBOARD printf("The '%s' key has been %s\n", SDL_GetScancodeName(scancode), state == SDL_PRESSED ? "pressed" : "released"); #endif /* Figure out what type of event this is */ switch (state) { case SDL_PRESSED: type = SDL_EVENT_KEY_DOWN; break; case SDL_RELEASED: type = SDL_EVENT_KEY_UP; break; default: /* Invalid state -- bail */ return 0; } /* Drop events that don't change state */ if (state) { if (keyboard->keystate[scancode]) { if (!(keyboard->keysource[scancode] & source)) { keyboard->keysource[scancode] |= source; return 0; } repeat = SDL_TRUE; } keyboard->keysource[scancode] |= source; } else { if (!keyboard->keystate[scancode]) { return 0; } keyboard->keysource[scancode] = 0; } /* Update internal keyboard state */ keyboard->keystate[scancode] = state; if (keycode == SDLK_UNKNOWN) { keycode = keyboard->keymap[scancode]; } if (source == KEYBOARD_HARDWARE) { keyboard->hardware_timestamp = SDL_GetTicks(); } else if (source == KEYBOARD_AUTORELEASE) { keyboard->autorelease_pending = SDL_TRUE; } /* Update modifiers state if applicable */ if (!(flags & KEYBOARD_IGNOREMODIFIERS)) { switch (keycode) { case SDLK_LCTRL: modifier = SDL_KMOD_LCTRL; break; case SDLK_RCTRL: modifier = SDL_KMOD_RCTRL; break; case SDLK_LSHIFT: modifier = SDL_KMOD_LSHIFT; break; case SDLK_RSHIFT: modifier = SDL_KMOD_RSHIFT; break; case SDLK_LALT: modifier = SDL_KMOD_LALT; break; case SDLK_RALT: modifier = SDL_KMOD_RALT; break; case SDLK_LGUI: modifier = SDL_KMOD_LGUI; break; case SDLK_RGUI: modifier = SDL_KMOD_RGUI; break; case SDLK_MODE: modifier = SDL_KMOD_MODE; break; default: modifier = SDL_KMOD_NONE; break; } if (SDL_EVENT_KEY_DOWN == type) { switch (keycode) { case SDLK_NUMLOCKCLEAR: keyboard->modstate ^= SDL_KMOD_NUM; break; case SDLK_CAPSLOCK: keyboard->modstate ^= SDL_KMOD_CAPS; break; case SDLK_SCROLLLOCK: keyboard->modstate ^= SDL_KMOD_SCROLL; break; default: keyboard->modstate |= modifier; break; } } else { keyboard->modstate &= ~modifier; } } /* Post the event, if desired */ posted = 0; if (SDL_EventEnabled(type)) { SDL_Event event; event.type = type; event.common.timestamp = timestamp; event.key.state = state; event.key.repeat = repeat; event.key.keysym.scancode = scancode; event.key.keysym.sym = keycode; event.key.keysym.mod = keyboard->modstate; event.key.windowID = keyboard->focus ? keyboard->focus->id : 0; event.key.which = keyboardID; posted = (SDL_PushEvent(&event) > 0); } /* If the keyboard is grabbed and the grabbed window is in full-screen, minimize the window when we receive Alt+Tab, unless the application has explicitly opted out of this behavior. */ if (keycode == SDLK_TAB && state == SDL_PRESSED && (keyboard->modstate & SDL_KMOD_ALT) && keyboard->focus && (keyboard->focus->flags & SDL_WINDOW_KEYBOARD_GRABBED) && (keyboard->focus->flags & SDL_WINDOW_FULLSCREEN) && SDL_GetHintBoolean(SDL_HINT_ALLOW_ALT_TAB_WHILE_GRABBED, SDL_TRUE)) { /* We will temporarily forfeit our grab by minimizing our window, allowing the user to escape the application */ SDL_MinimizeWindow(keyboard->focus); } return posted; }
staticinvoke <org.libsdl.app.SDLActivity: void onNativeKeyUp(int)>($i0)
$i0 = virtualinvoke $r1.<android.view.KeyEvent: int getKeyCode()>() staticinvoke <org.libsdl.app.SDLActivity: void onNativeKeyUp(int)>($i0) $i0 := @parameter0: int $r1 = staticinvoke <java.lang.Integer: java.lang.Integer valueOf(int)>($i0) $r0_3 = virtualinvoke $r1.<java.lang.Integer: java.lang.String toString()>() staticinvoke <android.util.Log: int i(java.lang.String,java.lang.String)>("SDL", $r0_3)
param0 -> log
public static void onNativeKeyUp(int) { int $p0, $opred; java.lang.String $0_phi, $casted; java.lang.Integer boxed; $p0 := @parameter0; $0_phi = null; $opred = org.example.NativeSummaryAux.opaqueInt(); if $opred != 1 goto label1; $0_phi = "Unknown keycode %d"; goto label2; label1: if $opred != 2 goto label2; boxed = java.lang.Integer.valueOf($p0); $casted = virtualinvoke boxed.toString(); $0_phi = $casted; label2: android.util.Log.i("SDL", $0_phi); org.example.NativeSummaryFuncs.calloc(1L, 1L); org.example.NativeSummaryFuncs.calloc(1L, 1L); org.example.NativeSummaryFuncs.free(null); org.example.NativeSummaryFuncs.fprintf(null, "%s: %s\n", "DEBUG", null); org.example.NativeSummaryFuncs.malloc(1L); org.example.NativeSummaryFuncs.free(null); org.example.NativeSummaryFuncs.malloc(1L); org.example.NativeSummaryFuncs.malloc(1L); org.example.NativeSummaryFuncs.malloc(1L); org.example.NativeSummaryFuncs.realloc(null, 1L); return; }
1 param0 keycode logged out log_sink
idv.markkuo.ambitsync_9.apk Source: $r11 = virtualinvoke $r10.<android.hardware.usb.UsbManager: android.hardware.usb.UsbDeviceConnection openDevice(android.hardware.usb.UsbDevice)>($r9) Sink: staticinvoke <android.util.Log: int i(java.lang.String,java.lang.String)>("AmbitSync", $r2_35)
https://github.com/starryalley/AmbitSync/blame/436d4f83bfd0aaa6a611ce7c41754e1962d3b283/app/src/main/cpp/ambitsync/ambitsync.c#L644 JNIEXPORT jlong JNICALL Java_idv_markkuo_ambitsync_MainActivity_notifyDeviceAttached(JNIEnv *env, jclass type, jint vid, jint pid, jint fd, jstring path_) { struct ambit_device *ambit; const char *path = (*env)->GetStringUTFChars(env, path_, 0); ambit = setup_ambit(vid, pid, fd, path); (*env)->ReleaseStringUTFChars(env, path_, path); __android_log_print(ANDROID_LOG_INFO, TAG, "Ambit FD set: %d, path:%s, ambit pointer:%p", fd, path, ambit); return (jlong)ambit; }
$l2 = staticinvoke <idv.markkuo.ambitsync.MainActivity: long notifyDeviceAttached(int,int,int,java.lang.String)>($i3, $i0, $i1, $r0)
$r11 = virtualinvoke $r10.<android.hardware.usb.UsbManager: android.hardware.usb.UsbDeviceConnection openDevice(android.hardware.usb.UsbDevice)>($r9) $i2 = virtualinvoke $r11.<android.hardware.usb.UsbDeviceConnection: int getFileDescriptor()>() $l0_1 = staticinvoke <idv.markkuo.ambitsync.MainActivity: long access$2300(int,int,int,java.lang.String)>($i3_2, $i4, $i2, $r4_4) $i1 := @parameter2: int $l2 = staticinvoke <idv.markkuo.ambitsync.MainActivity: long notifyDeviceAttached(int,int,int,java.lang.String)>($i3, $i0, $i1, $r0) $i2 := @parameter2: int $r3_8 = staticinvoke <java.lang.Integer: java.lang.Integer valueOf(int)>($i2) $r2_35 = virtualinvoke $r3_8.<java.lang.Integer: java.lang.String toString()>() staticinvoke <android.util.Log: int i(java.lang.String,java.lang.String)>("AmbitSync", $r2_35)
param2 printed by android log print
private static long notifyDeviceAttached(int, int, int, java.lang.String) { java.lang.Integer boxed, boxed, boxed, boxed, boxed, boxed, boxed; int $p0, $p1, $p2, $opred; java.lang.String $p3, $1, $2_phi, $casted, $6_phi, $casted, $8_phi, $casted, $12_phi, $casted, $16_phi, $20_phi, $24_phi, $32_phi, $casted, $casted, $36_phi, $casted; $p0 := @parameter0; $p1 := @parameter1; $p2 := @parameter2; $p3 := @parameter3; $1 = org.example.NativeSummaryFuncs.malloc(144L); $2_phi = null; $opred = org.example.NativeSummaryAux.opaqueInt(); if $opred != 1 goto label01; $2_phi = "unable to connect to Ambit"; goto label02; label01: if $opred != 2 goto label02; boxed = java.lang.Integer.valueOf($p1); $casted = virtualinvoke boxed.toString(); $2_phi = $casted; label02: android.util.Log.e("AmbitSync", $2_phi); $6_phi = null; if $opred != 3 goto label03; $6_phi = $1; goto label04; label03: if $opred != 4 goto label04; boxed = java.lang.Integer.valueOf($p0); $casted = virtualinvoke boxed.toString(); $6_phi = $casted; label04: org.example.NativeSummaryFuncs.free($6_phi); $8_phi = null; if $opred != 5 goto label05; $8_phi = "Failed to read status"; goto label06; label05: if $opred != 6 goto label06; boxed = java.lang.Integer.valueOf($p1); $casted = virtualinvoke boxed.toString(); $8_phi = $casted; label06: android.util.Log.w("AmbitSync", $8_phi); $12_phi = null; if $opred != 7 goto label07; $12_phi = "Failed to read user setting"; goto label08; label07: if $opred != 8 goto label08; boxed = java.lang.Integer.valueOf($p1); $casted = virtualinvoke boxed.toString(); $12_phi = $casted; label08: android.util.Log.w("AmbitSync", $12_phi); $16_phi = null; if $opred != 9 goto label09; $16_phi = ""; goto label10; label09: if $opred != 10 goto label10; $16_phi = "Ambit user is %smale"; label10: android.util.Log.d("AmbitSync", $16_phi); $20_phi = null; if $opred != 11 goto label11; $20_phi = "Ambit user weight: %.1f kg"; goto label12; label11: if $opred != 12 goto label12; $20_phi = ""; label12: android.util.Log.d("AmbitSync", $20_phi); $24_phi = null; if $opred != 13 goto label13; $24_phi = null; goto label14; label13: if $opred != 14 goto label14; $24_phi = "Ambit user max_hr: %d bpm"; label14: android.util.Log.d("AmbitSync", $24_phi); $32_phi = null; if $opred != 15 goto label15; boxed = java.lang.Integer.valueOf($p2); $casted = virtualinvoke boxed.toString(); $32_phi = $casted; goto label20; label15: if $opred != 16 goto label16; $32_phi = $p3; goto label20; label16: if $opred != 17 goto label17; $32_phi = "Ambit FD set: %d, path:%s, ambit pointer:%p"; goto label20; label17: if $opred != 18 goto label18; $32_phi = null; goto label20; label18: if $opred != 19 goto label19; $32_phi = $1; goto label20; label19: if $opred != 20 goto label20; boxed = java.lang.Integer.valueOf($p0); $casted = virtualinvoke boxed.toString(); $32_phi = $casted; label20: android.util.Log.i("AmbitSync", $32_phi); $36_phi = null; if $opred != 21 goto label21; $36_phi = null; goto label23; label21: if $opred != 22 goto label22; $36_phi = $1; goto label23; label22: if $opred != 23 goto label23; boxed = java.lang.Integer.valueOf($p0); $casted = virtualinvoke boxed.toString(); $36_phi = $casted; label23: return $36_phi; }
1 param2 printed by android log print log_sink
org.andglkmod.hunkypunk_7.apk Source: r4_3 = virtualinvoke r0.<org.andglkmod.hunkypunk.Interpreter: java.io.File getFilesDir()>() Sink: staticinvoke <android.util.Log: int e(java.lang.String,java.lang.String)>("HunkyPunk", $r2_44)
https://github.com/retrobits/son_of_hunkypunk/blob/d42dc5ca153f96f252576d4bcfa3f0fac69826f0/app/src/main/jni/loader/loader.c#L55 JNIEXPORT void Java_org_andglk_glk_Glk_startTerp (JNIEnv *env, jobject obj1, jstring terpPath, jstring saveFilePath, jint argc, jobjectArray argv) { // begin synchronize int ct = 0; while (pthread_mutex_trylock(&_muGame)!=0) { sleep(100); if(ct++>5) { LOGE("failed to acquire game thread lock, bailing"); return; } } pthread_mutex_lock (&_muQuery); (*env)->GetJavaVM(env, &_jvm); _init_error = 0; /* Init exit game callback */ //_GlkWrapperObj = obj1; //_GlkWrapperClass = (*env)->GetObjectClass(env, GlkWrapperObj); //GlkWrapper_onTerpExit = (*env)->GetMethodID(env, GlkWrapperClass, "onTerpExit", "()V"); // load game plugin lib const char *copy_terpPath = (*env)->GetStringUTFChars(env, terpPath, 0); // link entry points andglk_loader_glk_main = link_symbol(copy_terpPath, "andglk_loader_glk_main"); andglk_loader_glk_Glk_notifyLinked = link_symbol(copy_terpPath, "andglk_loader_glk_Glk_notifyLinked"); andglk_loader_glk_MemoryStream_retainVmArray = link_symbol(copy_terpPath,"andglk_loader_glk_MemoryStream_retainVmArray"); andglk_loader_glk_MemoryStream_releaseVmArray = link_symbol(copy_terpPath,"andglk_loader_glk_MemoryStream_releaseVmArray"); andglk_loader_glk_MemoryStream_writeOut = link_symbol(copy_terpPath,"andglk_loader_glk_MemoryStream_writeOut"); andglk_loader_glk_CPointed_makePoint = link_symbol(copy_terpPath,"andglk_loader_glk_CPointed_makePoint"); andglk_loader_glk_CPointed_releasePoint = link_symbol(copy_terpPath,"andglk_loader_glk_CPointed_releasePoint"); (*env)->ReleaseStringUTFChars(env, terpPath, copy_terpPath); // end synchronize pthread_mutex_unlock (&_muQuery); // copy parms glkunix_startup_t startdata; startdata.argc = argc; startdata.argv = malloc(argc * sizeof(char*)); // process argc/argv jstring argv0 = NULL; int i; for(i = 0; i < argc; i++) { argv0 = (*env)->GetObjectArrayElement(env, argv, i); startdata.argv[i] = (char*)((*env)->GetStringUTFChars(env, argv0, 0)); } // notify glk we are linked andglk_loader_glk_Glk_notifyLinked(env, obj1); const char *copy_saveFilePath = (*env)->GetStringUTFChars(env, saveFilePath, 0); // start the game andglk_loader_glk_main(_jvm, env, obj1, copy_saveFilePath, &startdata); (*env)->ReleaseStringUTFChars(env, terpPath, copy_saveFilePath); // begin synchronize pthread_mutex_lock (&_muQuery); dlclose(_handle); // unload terp // free memory for(i = 0; i < argc; i++) { argv0 = ((*env)->GetObjectArrayElement(env, argv, i)); (*env)->ReleaseStringUTFChars(env, argv0, startdata.argv[i]); } free(startdata.argv); // clear pointers _handle = NULL; andglk_loader_glk_main = NULL; andglk_loader_glk_MemoryStream_retainVmArray = NULL; andglk_loader_glk_MemoryStream_releaseVmArray = NULL; andglk_loader_glk_MemoryStream_writeOut = NULL; andglk_loader_glk_CPointed_makePoint = NULL; andglk_loader_glk_CPointed_releasePoint = NULL; // signal game has exited //(*env)->CallVoidMethod(env, GlkWrapperObj, GlkWrapper_onTerpExit); // end synchronize pthread_mutex_unlock (&_muQuery); pthread_mutex_unlock (&_muGame); LOGD("loader exit"); } void* link_symbol(const char* terpPath, const char *fn) { void* fp = NULL; if (!_handle) { LOGD("loader.dlopen %s", terpPath); _handle = dlopen(terpPath, RTLD_LOCAL | RTLD_LAZY); if (!_handle) { LOGE("dlopen failed for %s", terpPath); _init_error = 1; } } if (!_init_error) { fp = dlsym(_handle, fn); if (!fp) { LOGE("dlsym failed for %s", fn); _init_error = 1; } } return fp; }
specialinvoke r0.<org.andglkmod.glk.Glk: void startTerp(java.lang.String,java.lang.String,int,java.lang.String[])>($r2, $r3, $i0, $r1_2)
r4_3 = virtualinvoke r0.<org.andglkmod.hunkypunk.Interpreter: java.io.File getFilesDir()>() $r13 = virtualinvoke $r18.<java.lang.StringBuilder: java.lang.StringBuilder append(java.lang.Object)>(r4_3) $r13_1 = virtualinvoke $r13.<java.lang.StringBuilder: java.lang.StringBuilder append(java.lang.String)>("/../lib/lib") $r13_2 = virtualinvoke $r13_1.<java.lang.StringBuilder: java.lang.StringBuilder append(java.lang.String)>($r8) $r13_3 = virtualinvoke $r13_2.<java.lang.StringBuilder: java.lang.StringBuilder append(java.lang.String)>(".so") $r9_1 = virtualinvoke $r13_3.<java.lang.StringBuilder: java.lang.String toString()>() r2_1 = (java.lang.String[]) $r14 virtualinvoke $r11_4.<org.andglkmod.glk.Glk: void setArguments(java.lang.String[])>(r2_1) $r1 := @parameter0: java.lang.String[] _arguments> = $r1 _arguments> $r2 = $r1[0] specialinvoke r0.<org.andglkmod.glk.Glk: void startTerp(java.lang.String,java.lang.String,int,java.lang.String[])>($r2, $r3, $i0, $r1_2) $r1 := @parameter0: java.lang.String $r2_44 = $r1 staticinvoke <android.util.Log: int e(java.lang.String,java.lang.String)>("HunkyPunk", $r2_44)
parameter0 path -> android log print
private void startTerp(java.lang.String, java.lang.String, int, java.lang.String[]) { org.andglkmod.glk.Glk $this; java.lang.String[] $p3; java.lang.Long boxed; int $p2, $opred, $66; java.lang.String $p0, $p1, $2_phi, $6_phi, $11_phi, $15_phi, $20_phi, $24_phi, $29_phi, $33_phi, $38_phi, $42_phi, $47_phi, $51_phi, $56_phi, $60_phi, $67, $72, $75_phi, $casted; $this := @this; $p0 := @parameter0; $p1 := @parameter1; $p2 := @parameter2; $p3 := @parameter3; $2_phi = null; $opred = org.example.NativeSummaryAux.opaqueInt(); if $opred != 1 goto label01; $2_phi = $p0; goto label02; label01: if $opred != 2 goto label02; $2_phi = "dlopen failed for %s"; label02: android.util.Log.e("HunkyPunk", $2_phi); $6_phi = null; if $opred != 3 goto label03; $6_phi = "andglk_loader_glk_main"; goto label04; label03: if $opred != 4 goto label04; $6_phi = "dlsym failed for %s"; label04: android.util.Log.e("HunkyPunk", $6_phi); $11_phi = null; if $opred != 5 goto label05; $11_phi = $p0; goto label06; label05: if $opred != 6 goto label06; $11_phi = "dlopen failed for %s"; label06: android.util.Log.e("HunkyPunk", $11_phi); $15_phi = null; if $opred != 7 goto label07; $15_phi = "andglk_loader_glk_Glk_notifyLinked"; goto label08; label07: if $opred != 8 goto label08; $15_phi = "dlsym failed for %s"; label08: android.util.Log.e("HunkyPunk", $15_phi); $20_phi = null; if $opred != 9 goto label09; $20_phi = $p0; goto label10; label09: if $opred != 10 goto label10; $20_phi = "dlopen failed for %s"; label10: android.util.Log.e("HunkyPunk", $20_phi); $24_phi = null; if $opred != 11 goto label11; $24_phi = "andglk_loader_glk_MemoryStream_retainVmArray"; goto label12; label11: if $opred != 12 goto label12; $24_phi = "dlsym failed for %s"; label12: android.util.Log.e("HunkyPunk", $24_phi); $29_phi = null; if $opred != 13 goto label13; $29_phi = $p0; goto label14; label13: if $opred != 14 goto label14; $29_phi = "dlopen failed for %s"; label14: android.util.Log.e("HunkyPunk", $29_phi); $33_phi = null; if $opred != 15 goto label15; $33_phi = "andglk_loader_glk_MemoryStream_releaseVmArray"; goto label16; label15: if $opred != 16 goto label16; $33_phi = "dlsym failed for %s"; label16: android.util.Log.e("HunkyPunk", $33_phi); $38_phi = null; if $opred != 17 goto label17; $38_phi = $p0; goto label18; label17: if $opred != 18 goto label18; $38_phi = "dlopen failed for %s"; label18: android.util.Log.e("HunkyPunk", $38_phi); $42_phi = null; if $opred != 19 goto label19; $42_phi = "andglk_loader_glk_MemoryStream_writeOut"; goto label20; label19: if $opred != 20 goto label20; $42_phi = "dlsym failed for %s"; label20: android.util.Log.e("HunkyPunk", $42_phi); $47_phi = null; if $opred != 21 goto label21; $47_phi = $p0; goto label22; label21: if $opred != 22 goto label22; $47_phi = "dlopen failed for %s"; label22: android.util.Log.e("HunkyPunk", $47_phi); $51_phi = null; if $opred != 23 goto label23; $51_phi = "andglk_loader_glk_CPointed_makePoint"; goto label24; label23: if $opred != 24 goto label24; $51_phi = "dlsym failed for %s"; label24: android.util.Log.e("HunkyPunk", $51_phi); $56_phi = null; if $opred != 25 goto label25; $56_phi = $p0; goto label26; label25: if $opred != 26 goto label26; $56_phi = "dlopen failed for %s"; label26: android.util.Log.e("HunkyPunk", $56_phi); $60_phi = null; if $opred != 27 goto label27; $60_phi = "andglk_loader_glk_CPointed_releasePoint"; goto label28; label27: if $opred != 28 goto label28; $60_phi = "dlsym failed for %s"; label28: android.util.Log.e("HunkyPunk", $60_phi); $66 = org.example.NativeSummaryFuncs.malloc($p2); $67 = $p3[0]; $72 = $p3[0]; org.example.NativeSummaryFuncs.free($66); $75_phi = null; if $opred != 29 goto label29; boxed = java.lang.Long.valueOf(86032L); $casted = virtualinvoke boxed.toString(); $75_phi = $casted; goto label30; label29: if $opred != 30 goto label30; $75_phi = "failed to acquire game thread lock, bailing"; label30: android.util.Log.e("HunkyPunk", $75_phi); return; }
1 the file path is logged out log_sink
eu.flatworld.android.slider_3.apk Source: $r6 = virtualinvoke $r5.<java.io.File: java.lang.String getAbsolutePath()>() Sink: error: Cannot open file %s: %s\n", 1170L, $r3_15, null)
https://github.com/xoppa/libgdx/blob/91d6206e258bf7878e5c15a5b89f3661542084de/extensions/gdx-audio/jni/com.badlogic.gdx.audio.io.Mpg123Decoder.cpp#L44 static inline jlong wrapped_Java_com_badlogic_gdx_audio_io_Mpg123Decoder_openFile (JNIEnv* env, jobject object, jstring obj_filename, char* filename) { //@line:127 mpg123_handle *mh = NULL; int channels = 0, encoding = 0; long rate = 0; int err = MPG123_OK; err = mpg123_init(); if( err != MPG123_OK || (mh = mpg123_new(NULL, &err)) == NULL || mpg123_open(mh, filename) != MPG123_OK || mpg123_getformat(mh, &rate, &channels, &encoding) != MPG123_OK ) { fprintf( stderr, "Trouble with mpg123: %s\n", mh==NULL ? mpg123_plain_strerror(err) : mpg123_strerror(mh) ); cleanup(mh); return 0; } if(encoding != MPG123_ENC_SIGNED_16) { // Signed 16 is the default output format anyways; it would actually by only different if we forced it. // So this check is here just for this explanation. cleanup(mh); return 0; } // Ensure that this output format will not change (it could, when we allow it). mpg123_format_none(mh); mpg123_format(mh, rate, channels, encoding); size_t buffer_size = mpg123_outblock( mh ); unsigned char* buffer = (unsigned char*)malloc(buffer_size); size_t done = 0; int samples = 0; Mp3File* mp3 = new Mp3File(); mp3->handle = mh; mp3->channels = channels; mp3->rate = rate; mp3->buffer = buffer; mp3->buffer_size = buffer_size; int length = mpg123_length( mh ); if( length == MPG123_ERR ) mp3->length = 0; else mp3->length = length / rate; return (jlong)mp3; }
$l0 = specialinvoke r0.<com.badlogic.gdx.audio.io.Mpg123Decoder: long openFile(java.lang.String)>($r6)
$r6 = virtualinvoke $r5.<java.io.File: java.lang.String getAbsolutePath()>() $l0 = specialinvoke r0.<com.badlogic.gdx.audio.io.Mpg123Decoder: long openFile(java.lang.String)>($r6) $r1 := @parameter0: java.lang.String $r3_15 = $r1 error: Cannot open file %s: %s\n", 1170L, $r3_15, null)
the filepath is printed by fprintf
private long openFile(java.lang.String) { com.badlogic.gdx.audio.io.Mpg123Decoder $this; long $112_phi, $144_phi; java.lang.Long boxed, boxed, boxed; int $6, $opred, $40; java.lang.String $p0, $1, $8_phi, $14_phi, $16_phi, $casted, $51_phi, $78_phi, $85_phi, $227_phi, $228_phi; $this := @this; $p0 := @parameter0; $1 = org.example.NativeSummaryFuncs.malloc(46456L); org.example.NativeSummaryFuncs.free(null); org.example.NativeSummaryFuncs.free(null); org.example.NativeSummaryFuncs.free(null); org.example.NativeSummaryFuncs.fprintf(null, "Decoder: %s\n", "generic"); $6 = org.example.NativeSummaryFuncs.malloc(294912L); org.example.NativeSummaryFuncs.free($6); $8_phi = null; $opred = org.example.NativeSummaryAux.opaqueInt(); if $opred != 1 goto label01; $8_phi = null; goto label02; label01: if $opred != 2 goto label02; $8_phi = $1; label02: org.example.NativeSummaryFuncs.free($8_phi); org.example.NativeSummaryFuncs.free(null); org.example.NativeSummaryFuncs.free(null); org.example.NativeSummaryFuncs.free(null); org.example.NativeSummaryFuncs.free(null); $14_phi = null; if $opred != 3 goto label03; $14_phi = ""; goto label06; label03: if $opred != 4 goto label04; $14_phi = null; goto label06; label04: if $opred != 5 goto label05; $14_phi = $1; goto label06; label05: if $opred != 6 goto label06; $14_phi = $p0; label06: org.example.NativeSummaryFuncs.open($14_phi, null, 438L); $16_phi = null; if $opred != 7 goto label07; boxed = java.lang.Long.valueOf(4294967295L); $casted = virtualinvoke boxed.toString(); $16_phi = $casted; goto label10; label07: if $opred != 8 goto label08; $16_phi = null; goto label10; label08: if $opred != 9 goto label09; $16_phi = $1; goto label10; label09: if $opred != 10 goto label10; $16_phi = $p0; label10: org.example.NativeSummaryFuncs.fprintf(null, "[/var/lib/hudson/jobs/libgdx/workspace/extensions/gdx-audio/jni/libmpg123/readers.c:%i] error: Cannot open file %s: %s\n", 1170L, $16_phi, null); org.example.NativeSummaryFuncs.malloc(null); org.example.NativeSummaryFuncs.free(null); org.example.NativeSummaryFuncs.fprintf(null, "[/var/lib/hudson/jobs/libgdx/workspace/extensions/gdx-audio/jni/libmpg123/readers.c:%i] error: reading the rest of %li\n", 186L, null); org.example.NativeSummaryFuncs.fprintf(null, "[/var/lib/hudson/jobs/libgdx/workspace/extensions/gdx-audio/jni/libmpg123/readers.c:%i] error: reading icy-meta\n", 164L); org.example.NativeSummaryFuncs.fprintf(null, "[/var/lib/hudson/jobs/libgdx/workspace/extensions/gdx-audio/jni/libmpg123/readers.c:%i] error: reading icy size\n", 145L); org.example.NativeSummaryFuncs.fprintf(null, "[/var/lib/hudson/jobs/libgdx/workspace/extensions/gdx-audio/jni/libmpg123/readers.c:%i] error: icy boundary read\n", 126L); org.example.NativeSummaryFuncs.fprintf(null, "[/var/lib/hudson/jobs/libgdx/workspace/extensions/gdx-audio/jni/libmpg123/readers.c:%i] error: mpg123 programmer error: I don\'t do ICY on seekable streams.\n", 97L); org.example.NativeSummaryFuncs.fprintf(null, "[/var/lib/hudson/jobs/libgdx/workspace/extensions/gdx-audio/jni/libmpg123/readers.c:%i] error: mpg123 Programmer\'s fault: invalid reader\n", 1082L); org.example.NativeSummaryFuncs.fprintf(null, "Note: Junk at the beginning (0x%08lx)\n", null); org.example.NativeSummaryFuncs.fprintf(null, "Note: free format frame size %li\n"); org.example.NativeSummaryFuncs.fprintf(null, "[/var/lib/hudson/jobs/libgdx/workspace/extensions/gdx-audio/jni/libmpg123/parse.c:%i] error: Layer type %i not supported in this build!\n", 773L); org.example.NativeSummaryFuncs.raise(8L); org.example.NativeSummaryFuncs.fprintf(null, "[/var/lib/hudson/jobs/libgdx/workspace/extensions/gdx-audio/jni/libmpg123/parse.c:%i] error: Frame size too big: %d\n", 779L, null); org.example.NativeSummaryFuncs.fprintf(null, "[/var/lib/hudson/jobs/libgdx/workspace/extensions/gdx-audio/jni/libmpg123/parse.c:%i] error: Cannot look for freeformat frame size with non-seekable and non-buffered stream!\n", 612L); org.example.NativeSummaryFuncs.fprintf(null, "[/var/lib/hudson/jobs/libgdx/workspace/extensions/gdx-audio/jni/libmpg123/parse.c:%i] error: Encountered free format header, but failed to guess frame size.\n", 717L); org.example.NativeSummaryFuncs.fprintf(null, "[/var/lib/hudson/jobs/libgdx/workspace/extensions/gdx-audio/jni/libmpg123/parse.c:%i] error: tried to decode obviously invalid header\n", 650L); org.example.NativeSummaryFuncs.fprintf(null, "[/var/lib/hudson/jobs/libgdx/workspace/extensions/gdx-audio/jni/libmpg123/parse.c:%i] error: Giving up searching valid MPEG header after (over) 64K of junk.\n", 1040L); org.example.NativeSummaryFuncs.fprintf(null, "[/var/lib/hudson/jobs/libgdx/workspace/extensions/gdx-audio/jni/libmpg123/id3.c:%i] error: Bad tag length (not synchsafe): 0x%02x%02x%02x%02x; You got a bad ID3 tag here.\n", 583L, null, null, null, null, null); org.example.NativeSummaryFuncs.fprintf(null, "Note: ID3v2.%i rev %i tag of %lu bytes\n", null, null, null, null); $40 = org.example.NativeSummaryFuncs.malloc(null); org.example.NativeSummaryFuncs.fprintf(null, "[/var/lib/hudson/jobs/libgdx/workspace/extensions/gdx-audio/jni/libmpg123/id3.c:%i] error: ID3v2: Duh, not able to read ID3v2 tag data.\n", 807L, null); org.example.NativeSummaryFuncs.free($40); org.example.NativeSummaryFuncs.fprintf(null, "[/var/lib/hudson/jobs/libgdx/workspace/extensions/gdx-audio/jni/libmpg123/id3.c:%i] error: Bad (non-synchsafe) tag offset: 0x%02x%02x%02x%02x\n", 626L, null, null, null, null, null); org.example.NativeSummaryFuncs.free($40); org.example.NativeSummaryFuncs.fprintf(null, "Translated ID3v2.2 frame %s to %s\n", null, null); org.example.NativeSummaryFuncs.fprintf(null, "Ignoring untranslated ID3v2.2 frame %c%c%c\n", null, null, null); org.example.NativeSummaryFuncs.fprintf(null, "[/var/lib/hudson/jobs/libgdx/workspace/extensions/gdx-audio/jni/libmpg123/id3.c:%i] warning: ID3v2: skipping invalid/unsupported frame\n", 700L); org.example.NativeSummaryFuncs.malloc(null); $51_phi = null; if $opred != 11 goto label11; $51_phi = "Latin 1"; goto label15; label11: if $opred != 12 goto label12; $51_phi = "UTF-8"; goto label15; label12: if $opred != 13 goto label13; $51_phi = "unknown!"; goto label15; label13: if $opred != 14 goto label14; $51_phi = "UTF-16 BOM"; goto label15; label14: if $opred != 15 goto label15; $51_phi = "UTF-16 BE"; label15: org.example.NativeSummaryFuncs.fprintf(null, "Note: Storing extra from %s encoding\n", $51_phi, null); org.example.NativeSummaryFuncs.malloc(null); org.example.NativeSummaryFuncs.fprintf(null, "[/var/lib/hudson/jobs/libgdx/workspace/extensions/gdx-audio/jni/libmpg123/id3.c:%i] error: Unable to attach new extra text!\n", 422L, null); org.example.NativeSummaryFuncs.fprintf(null, "[/var/lib/hudson/jobs/libgdx/workspace/extensions/gdx-audio/jni/libmpg123/id3.c:%i] error: Unknown text encoding %u, I take no chances, sorry!\n", 227L, null); org.example.NativeSummaryFuncs.free(null); org.example.NativeSummaryFuncs.raise(8L); org.example.NativeSummaryFuncs.fprintf(null, "[/var/lib/hudson/jobs/libgdx/workspace/extensions/gdx-audio/jni/libmpg123/id3.c:%i] warning: Weird tag size %d for encoding %u - I will probably trim too early or something but I think the MP3 is broken.\n", 244L, null, null); org.example.NativeSummaryFuncs.fprintf(null, "[/var/lib/hudson/jobs/libgdx/workspace/extensions/gdx-audio/jni/libmpg123/id3.c:%i] error: Invalid UTF16 surrogate pair at %li (0x%04lx).\n", 940L, null, null); org.example.NativeSummaryFuncs.malloc(null); org.example.NativeSummaryFuncs.free(null); org.example.NativeSummaryFuncs.free(null); org.example.NativeSummaryFuncs.fprintf(null, "[/var/lib/hudson/jobs/libgdx/workspace/extensions/gdx-audio/jni/libmpg123/id3.c:%i] error: unable to convert string to UTF-8 (out of memory, junk input?)!\n", 215L); org.example.NativeSummaryFuncs.free(null); org.example.NativeSummaryFuncs.fprintf(null, "[/var/lib/hudson/jobs/libgdx/workspace/extensions/gdx-audio/jni/libmpg123/id3.c:%i] error: Cannot resize target string, out of memory?\n", 203L); org.example.NativeSummaryFuncs.fprintf(null, "[/var/lib/hudson/jobs/libgdx/workspace/extensions/gdx-audio/jni/libmpg123/id3.c:%i] error: unable to convert string to UTF-8 (out of memory, junk input?)!\n", 215L); org.example.NativeSummaryFuncs.fprintf(null, "[/var/lib/hudson/jobs/libgdx/workspace/extensions/gdx-audio/jni/libmpg123/id3.c:%i] error: unable to convert string to UTF-8 (out of memory, junk input?)!\n", 215L); org.example.NativeSummaryFuncs.fprintf(null, "[/var/lib/hudson/jobs/libgdx/workspace/extensions/gdx-audio/jni/libmpg123/id3.c:%i] error: Cannot resize target string, out of memory?\n", 203L); org.example.NativeSummaryFuncs.fprintf(null, "[/var/lib/hudson/jobs/libgdx/workspace/extensions/gdx-audio/jni/libmpg123/id3.c:%i] error: No extra frame text / valid description?\n", 416L); org.example.NativeSummaryFuncs.fprintf(null, "[/var/lib/hudson/jobs/libgdx/workspace/extensions/gdx-audio/jni/libmpg123/id3.c:%i] error: Invalid frame size of %lu (too small for anything).\n", 409L, null); org.example.NativeSummaryFuncs.fprintf(null, "Note: RVA2 identification \"%s\"\n", null); org.example.NativeSummaryFuncs.fprintf(null, "Note: RVA value %fdB\n", null, null); org.example.NativeSummaryFuncs.fprintf(null, "[/var/lib/hudson/jobs/libgdx/workspace/extensions/gdx-audio/jni/libmpg123/id3.c:%i] error: ID3v2: unknown frame type %i\n", 785L, null); $78_phi = null; if $opred != 16 goto label16; $78_phi = "Latin 1"; goto label20; label16: if $opred != 17 goto label17; $78_phi = "UTF-8"; goto label20; label17: if $opred != 18 goto label18; $78_phi = "unknown!"; goto label20; label18: if $opred != 19 goto label19; $78_phi = "UTF-16 BOM"; goto label20; label19: if $opred != 20 goto label20; $78_phi = "UTF-16 BE"; label20: org.example.NativeSummaryFuncs.fprintf(null, "Note: Storing text from %s encoding\n", $78_phi, null); org.example.NativeSummaryFuncs.fprintf(null, "[/var/lib/hudson/jobs/libgdx/workspace/extensions/gdx-audio/jni/libmpg123/id3.c:%i] error: unable to convert string to UTF-8 (out of memory, junk input?)!\n", 215L); org.example.NativeSummaryFuncs.fprintf(null, "Note: ID3v2 %c%c%c%c text frame: %s\n", null, null, null, null, null, null); org.example.NativeSummaryFuncs.fprintf(null, "[/var/lib/hudson/jobs/libgdx/workspace/extensions/gdx-audio/jni/libmpg123/id3.c:%i] error: Unable to attach new text!\n", 302L); org.example.NativeSummaryFuncs.fprintf(null, "[/var/lib/hudson/jobs/libgdx/workspace/extensions/gdx-audio/jni/libmpg123/id3.c:%i] error: Invalid frame size of %lu (too small for anything).\n", 327L, null); $85_phi = null; if $opred != 21 goto label21; $85_phi = "Latin 1"; goto label25; label21: if $opred != 22 goto label22; $85_phi = "UTF-8"; goto label25; label22: if $opred != 23 goto label23; $85_phi = "unknown!"; goto label25; label23: if $opred != 24 goto label24; $85_phi = "UTF-16 BOM"; goto label25; label24: if $opred != 25 goto label25; $85_phi = "UTF-16 BE"; label25: org.example.NativeSummaryFuncs.fprintf(null, "Note: Storing comment from %s encoding\n", $85_phi, null); org.example.NativeSummaryFuncs.fprintf(null, "[/var/lib/hudson/jobs/libgdx/workspace/extensions/gdx-audio/jni/libmpg123/id3.c:%i] error: No comment text / valid description?\n", 345L, null); org.example.NativeSummaryFuncs.fprintf(null, "[/var/lib/hudson/jobs/libgdx/workspace/extensions/gdx-audio/jni/libmpg123/id3.c:%i] error: unable to convert string to UTF-8 (out of memory, junk input?)!\n", 215L); org.example.NativeSummaryFuncs.fprintf(null, "[/var/lib/hudson/jobs/libgdx/workspace/extensions/gdx-audio/jni/libmpg123/id3.c:%i] error: Cannot resize target string, out of memory?\n", 203L); org.example.NativeSummaryFuncs.fprintf(null, "[/var/lib/hudson/jobs/libgdx/workspace/extensions/gdx-audio/jni/libmpg123/id3.c:%i] error: unable to convert string to UTF-8 (out of memory, junk input?)!\n", 215L); org.example.NativeSummaryFuncs.fprintf(null, "[/var/lib/hudson/jobs/libgdx/workspace/extensions/gdx-audio/jni/libmpg123/id3.c:%i] error: Cannot resize target string, out of memory?\n", 203L); org.example.NativeSummaryFuncs.fprintf(null, "[/var/lib/hudson/jobs/libgdx/workspace/extensions/gdx-audio/jni/libmpg123/id3.c:%i] error: unable to convert string to UTF-8 (out of memory, junk input?)!\n", 215L); org.example.NativeSummaryFuncs.fprintf(null, "[/var/lib/hudson/jobs/libgdx/workspace/extensions/gdx-audio/jni/libmpg123/id3.c:%i] error: Cannot resize target string, out of memory?\n", 203L); org.example.NativeSummaryFuncs.fprintf(null, "Note: ID3 comm/uslt desc of length %lu.\n", null, null); org.example.NativeSummaryFuncs.fprintf(null, "Note: ID3 comm/uslt text of length %lu.\n", null); org.example.NativeSummaryFuncs.free(null); org.example.NativeSummaryFuncs.fprintf(null, "[/var/lib/hudson/jobs/libgdx/workspace/extensions/gdx-audio/jni/libmpg123/id3.c:%i] error: Unable to attach new comment!\n", 334L); org.example.NativeSummaryFuncs.fprintf(null, "[/var/lib/hudson/jobs/libgdx/workspace/extensions/gdx-audio/jni/libmpg123/id3.c:%i] error: Cannot resize target string, out of memory?\n", 203L); org.example.NativeSummaryFuncs.free(null); org.example.NativeSummaryFuncs.free(null); org.example.NativeSummaryFuncs.malloc(null); org.example.NativeSummaryFuncs.free(null); org.example.NativeSummaryFuncs.fprintf(null, "[/var/lib/hudson/jobs/libgdx/workspace/extensions/gdx-audio/jni/libmpg123/id3.c:%i] error: ID3v2: non-syncsafe size of %s frame, skipping the remainder of tag\n", 665L, null); org.example.NativeSummaryFuncs.fprintf(null, "[/var/lib/hudson/jobs/libgdx/workspace/extensions/gdx-audio/jni/libmpg123/id3.c:%i] error: Whoa! ID3v2 frame claims to be larger than the whole rest of the tag.\n", 672L); org.example.NativeSummaryFuncs.free($40); org.example.NativeSummaryFuncs.fprintf(null, "[/var/lib/hudson/jobs/libgdx/workspace/extensions/gdx-audio/jni/libmpg123/id3.c:%i] warning: ID3v2: Won\'t parse the ID3v2 tag with major version %u and flags 0x%xu - some extra code may be needed\n", 599L, null, null); org.example.NativeSummaryFuncs.malloc(16L); org.example.NativeSummaryFuncs.malloc(null); org.example.NativeSummaryFuncs.fprintf(null, "[/var/lib/hudson/jobs/libgdx/workspace/extensions/gdx-audio/jni/libmpg123/readers.c:%i] error: buffer reading\n", 838L); $112_phi = 0; if $opred != 26 goto label26; $112_phi = 4294967294L; goto label27; label26: if $opred != 27 goto label27; $112_phi = null; label27: org.example.NativeSummaryFuncs.fprintf(null, "[/var/lib/hudson/jobs/libgdx/workspace/extensions/gdx-audio/jni/libmpg123/readers.c:%i] error: unable to add to chain, return: %i\n", 845L, $112_phi); if $opred != 28 goto label28; boxed = java.lang.Long.valueOf(46240L); virtualinvoke boxed.toString(); goto label29; label28: if $opred == 29 goto label29; if $opred == 30 goto label29; if $opred != 31 goto label29; boxed = java.lang.Long.valueOf(46239L); virtualinvoke boxed.toString(); label29: org.example.NativeSummaryFuncs.malloc(null); org.example.NativeSummaryFuncs.free(null); org.example.NativeSummaryFuncs.fprintf(null, "[/var/lib/hudson/jobs/libgdx/workspace/extensions/gdx-audio/jni/libmpg123/readers.c:%i] error: reading the rest of %li\n", 186L, null); org.example.NativeSummaryFuncs.fprintf(null, "[/var/lib/hudson/jobs/libgdx/workspace/extensions/gdx-audio/jni/libmpg123/readers.c:%i] error: reading icy size\n", 145L); org.example.NativeSummaryFuncs.fprintf(null, "[/var/lib/hudson/jobs/libgdx/workspace/extensions/gdx-audio/jni/libmpg123/readers.c:%i] error: icy boundary read\n", 126L); org.example.NativeSummaryFuncs.fprintf(null, "[/var/lib/hudson/jobs/libgdx/workspace/extensions/gdx-audio/jni/libmpg123/readers.c:%i] error: mpg123 programmer error: I don\'t do ICY on seekable streams.\n", 97L); org.example.NativeSummaryFuncs.free(null); org.example.NativeSummaryFuncs.free(null); org.example.NativeSummaryFuncs.fprintf(null, "Note: free format frame size %li\n"); org.example.NativeSummaryFuncs.fprintf(null, "[/var/lib/hudson/jobs/libgdx/workspace/extensions/gdx-audio/jni/libmpg123/parse.c:%i] error: Layer type %i not supported in this build!\n", 773L); org.example.NativeSummaryFuncs.fprintf(null, "[/var/lib/hudson/jobs/libgdx/workspace/extensions/gdx-audio/jni/libmpg123/parse.c:%i] error: Frame size too big: %d\n", 779L, null); org.example.NativeSummaryFuncs.fprintf(null, "[/var/lib/hudson/jobs/libgdx/workspace/extensions/gdx-audio/jni/libmpg123/parse.c:%i] error: Cannot look for freeformat frame size with non-seekable and non-buffered stream!\n", 612L); org.example.NativeSummaryFuncs.fprintf(null, "[/var/lib/hudson/jobs/libgdx/workspace/extensions/gdx-audio/jni/libmpg123/parse.c:%i] error: Encountered free format header, but failed to guess frame size.\n", 717L); org.example.NativeSummaryFuncs.fprintf(null, "[/var/lib/hudson/jobs/libgdx/workspace/extensions/gdx-audio/jni/libmpg123/parse.c:%i] error: tried to decode obviously invalid header\n", 650L); org.example.NativeSummaryFuncs.fprintf(null, "Note: Illegal Audio-MPEG-Header 0x%08lx at offset %li.\n", null, null); org.example.NativeSummaryFuncs.fprintf(null, "Note: Skipped %li bytes in input.\n", null); org.example.NativeSummaryFuncs.malloc(null); org.example.NativeSummaryFuncs.free(null); org.example.NativeSummaryFuncs.fprintf(null, "[/var/lib/hudson/jobs/libgdx/workspace/extensions/gdx-audio/jni/libmpg123/readers.c:%i] error: reading the rest of %li\n", 186L, null); org.example.NativeSummaryFuncs.fprintf(null, "[/var/lib/hudson/jobs/libgdx/workspace/extensions/gdx-audio/jni/libmpg123/readers.c:%i] error: reading icy-meta\n", 164L); org.example.NativeSummaryFuncs.fprintf(null, "[/var/lib/hudson/jobs/libgdx/workspace/extensions/gdx-audio/jni/libmpg123/readers.c:%i] error: reading icy size\n", 145L); org.example.NativeSummaryFuncs.fprintf(null, "[/var/lib/hudson/jobs/libgdx/workspace/extensions/gdx-audio/jni/libmpg123/readers.c:%i] error: icy boundary read\n", 126L); org.example.NativeSummaryFuncs.fprintf(null, "[/var/lib/hudson/jobs/libgdx/workspace/extensions/gdx-audio/jni/libmpg123/readers.c:%i] error: mpg123 programmer error: I don\'t do ICY on seekable streams.\n", 97L); org.example.NativeSummaryFuncs.fprintf(null, "[/var/lib/hudson/jobs/libgdx/workspace/extensions/gdx-audio/jni/libmpg123/readers.c:%i] error: buffer reading\n", 838L); $144_phi = 0; if $opred != 32 goto label30; $144_phi = 4294967294L; goto label31; label30: if $opred != 33 goto label31; $144_phi = null; label31: org.example.NativeSummaryFuncs.fprintf(null, "[/var/lib/hudson/jobs/libgdx/workspace/extensions/gdx-audio/jni/libmpg123/readers.c:%i] error: unable to add to chain, return: %i\n", 845L, $144_phi); org.example.NativeSummaryFuncs.fprintf(null, "[/var/lib/hudson/jobs/libgdx/workspace/extensions/gdx-audio/jni/libmpg123/readers.c:%i] error: gotcount != count\n", 863L); org.example.NativeSummaryFuncs.fprintf(null, "Note: Xing: %lu frames\n", null); org.example.NativeSummaryFuncs.fprintf(null, "Note: Xing stream size %lu differs by %f%% from determined/given file size!\n", null, null, null); org.example.NativeSummaryFuncs.fprintf(null, "Warning: Xing stream size off by more than 1%%, fuzzy seeking may be even more fuzzy than by design!\n"); org.example.NativeSummaryFuncs.fprintf(null, "Note: Xing: %lu bytes\n", null); org.example.NativeSummaryFuncs.malloc(100L); org.example.NativeSummaryFuncs.fprintf(null, "Note: Xing: quality = %lu\n", null); org.example.NativeSummaryFuncs.fprintf(null, "Note: Info: Encoder: %s\n", null); org.example.NativeSummaryFuncs.fprintf(null, "[/var/lib/hudson/jobs/libgdx/workspace/extensions/gdx-audio/jni/libmpg123/parse.c:%i] warning: TODO: finish lame version detetcion...\n", 272L); org.example.NativeSummaryFuncs.fprintf(null, "Note: Info: rev %u\n", null); org.example.NativeSummaryFuncs.fprintf(null, "Note: Info: vbr mode %u\n", null); org.example.NativeSummaryFuncs.fprintf(null, "Note: Info: peak = %f (I won\'t use this)\n", null, null); org.example.NativeSummaryFuncs.fprintf(null, "Note: Info: Radio Gain = %03.1fdB\n", null, null); org.example.NativeSummaryFuncs.fprintf(null, "Note: Info: Audiophile Gain = %03.1fdB\n", null, null); org.example.NativeSummaryFuncs.fprintf(null, "Note: Info: ABR rate = %u\n"); org.example.NativeSummaryFuncs.fprintf(null, "Note: Encoder delay = %i; padding = %i\n", null, null); org.example.NativeSummaryFuncs.fprintf(null, "[/var/lib/hudson/jobs/libgdx/workspace/extensions/gdx-audio/jni/libmpg123/parse.c:%i] error: not attempting to resync...\n", 1135L); org.example.NativeSummaryFuncs.fprintf(null, "[/var/lib/hudson/jobs/libgdx/workspace/extensions/gdx-audio/jni/libmpg123/parse.c:%i] error: Giving up resync after %li bytes - your stream is not nice... (maybe increasing resync limit could help).\n", 1121L, null); org.example.NativeSummaryFuncs.fprintf(null, "[/var/lib/hudson/jobs/libgdx/workspace/extensions/gdx-audio/jni/libmpg123/parse.c:%i] error: cannot seek!\n", 939L); org.example.NativeSummaryFuncs.fprintf(null, "[/var/lib/hudson/jobs/libgdx/workspace/extensions/gdx-audio/jni/libmpg123/parse.c:%i] error: Cannot seek back!\n", 948L); org.example.NativeSummaryFuncs.fprintf(null, "[/var/lib/hudson/jobs/libgdx/workspace/extensions/gdx-audio/jni/libmpg123/parse.c:%i] error: Cannot seek 3 bytes back!\n", 969L); org.example.NativeSummaryFuncs.fprintf(null, "Note: doing RVA with gain %f\n", null, null, null); org.example.NativeSummaryFuncs.fprintf(null, "[/var/lib/hudson/jobs/libgdx/workspace/extensions/gdx-audio/jni/libmpg123/frame.c:%i] warning: limiting scale value to %f to prevent clipping with indicated peak factor of %f\n", 992L, null, null, null, null); org.example.NativeSummaryFuncs.fprintf(null, "Note: Junk at the beginning (0x%08lx)\n", null); org.example.NativeSummaryFuncs.fprintf(null, "[/var/lib/hudson/jobs/libgdx/workspace/extensions/gdx-audio/jni/libmpg123/parse.c:%i] error: Giving up searching valid MPEG header after (over) 64K of junk.\n", 1040L); org.example.NativeSummaryFuncs.fprintf(null, "Note: Illegal Audio-MPEG-Header 0x%08lx at offset %li.\n", null, null); org.example.NativeSummaryFuncs.fprintf(null, "Note: Skipped %li bytes in input.\n", null); org.example.NativeSummaryFuncs.fprintf(null, "[/var/lib/hudson/jobs/libgdx/workspace/extensions/gdx-audio/jni/libmpg123/parse.c:%i] warning: Cannot read next header, a one-frame stream? Duh...\n", 957L); org.example.NativeSummaryFuncs.fprintf(null, "Note: Xing: %lu frames\n", null); org.example.NativeSummaryFuncs.fprintf(null, "Note: Xing stream size %lu differs by %f%% from determined/given file size!\n", null, null, null); org.example.NativeSummaryFuncs.fprintf(null, "Warning: Xing stream size off by more than 1%%, fuzzy seeking may be even more fuzzy than by design!\n"); org.example.NativeSummaryFuncs.fprintf(null, "Note: Xing: %lu bytes\n", null); org.example.NativeSummaryFuncs.fprintf(null, "Note: Xing: quality = %lu\n", null); org.example.NativeSummaryFuncs.fprintf(null, "Note: Info: Encoder: %s\n", null); org.example.NativeSummaryFuncs.fprintf(null, "[/var/lib/hudson/jobs/libgdx/workspace/extensions/gdx-audio/jni/libmpg123/parse.c:%i] warning: TODO: finish lame version detetcion...\n", 272L); org.example.NativeSummaryFuncs.fprintf(null, "Note: Info: rev %u\n", null); org.example.NativeSummaryFuncs.fprintf(null, "Note: Info: vbr mode %u\n", null); org.example.NativeSummaryFuncs.fprintf(null, "Note: Info: peak = %f (I won\'t use this)\n", null, null); org.example.NativeSummaryFuncs.fprintf(null, "Note: Info: Radio Gain = %03.1fdB\n", null, null); org.example.NativeSummaryFuncs.fprintf(null, "Note: Info: Audiophile Gain = %03.1fdB\n", null, null); org.example.NativeSummaryFuncs.fprintf(null, "Note: Info: ABR rate = %u\n"); org.example.NativeSummaryFuncs.fprintf(null, "Note: Encoder delay = %i; padding = %i\n", null, null); org.example.NativeSummaryFuncs.fprintf(null, "[/var/lib/hudson/jobs/libgdx/workspace/extensions/gdx-audio/jni/libmpg123/parse.c:%i] error: not attempting to resync...\n", 1135L); org.example.NativeSummaryFuncs.fprintf(null, "[/var/lib/hudson/jobs/libgdx/workspace/extensions/gdx-audio/jni/libmpg123/parse.c:%i] error: cannot seek!\n", 939L); org.example.NativeSummaryFuncs.fprintf(null, "[/var/lib/hudson/jobs/libgdx/workspace/extensions/gdx-audio/jni/libmpg123/parse.c:%i] error: Cannot seek 3 bytes back!\n", 969L); org.example.NativeSummaryFuncs.fprintf(null, "Note: Junk at the beginning (0x%08lx)\n", null); org.example.NativeSummaryFuncs.fprintf(null, "[/var/lib/hudson/jobs/libgdx/workspace/extensions/gdx-audio/jni/libmpg123/parse.c:%i] error: Giving up searching valid MPEG header after (over) 64K of junk.\n", 1040L); org.example.NativeSummaryFuncs.fprintf(null, "Note: Illegal Audio-MPEG-Header 0x%08lx at offset %li.\n", null, null); org.example.NativeSummaryFuncs.fprintf(null, "Note: Skipped %li bytes in input.\n", null); org.example.NativeSummaryFuncs.fprintf(null, "[/var/lib/hudson/jobs/libgdx/workspace/extensions/gdx-audio/jni/libmpg123/parse.c:%i] warning: Cannot read next header, a one-frame stream? Duh...\n", 957L); org.example.NativeSummaryFuncs.fprintf(null, "Note: Xing: %lu frames\n", null); org.example.NativeSummaryFuncs.fprintf(null, "Note: Xing stream size %lu differs by %f%% from determined/given file size!\n", null, null, null); org.example.NativeSummaryFuncs.fprintf(null, "Warning: Xing stream size off by more than 1%%, fuzzy seeking may be even more fuzzy than by design!\n"); org.example.NativeSummaryFuncs.fprintf(null, "Note: Xing: %lu bytes\n", null); org.example.NativeSummaryFuncs.fprintf(null, "Note: Xing: quality = %lu\n", null); org.example.NativeSummaryFuncs.fprintf(null, "Note: Info: Encoder: %s\n", null); org.example.NativeSummaryFuncs.fprintf(null, "[/var/lib/hudson/jobs/libgdx/workspace/extensions/gdx-audio/jni/libmpg123/parse.c:%i] warning: TODO: finish lame version detetcion...\n", 272L); org.example.NativeSummaryFuncs.fprintf(null, "Note: Info: rev %u\n", null); org.example.NativeSummaryFuncs.fprintf(null, "Note: Info: vbr mode %u\n", null); org.example.NativeSummaryFuncs.fprintf(null, "Note: Info: peak = %f (I won\'t use this)\n", null, null); org.example.NativeSummaryFuncs.fprintf(null, "Note: Info: Radio Gain = %03.1fdB\n", null, null); org.example.NativeSummaryFuncs.fprintf(null, "Note: Info: Audiophile Gain = %03.1fdB\n", null, null); org.example.NativeSummaryFuncs.fprintf(null, "Note: Info: ABR rate = %u\n"); org.example.NativeSummaryFuncs.fprintf(null, "[/var/lib/hudson/jobs/libgdx/workspace/extensions/gdx-audio/jni/libmpg123/parse.c:%i] error: not attempting to resync...\n", 1135L); org.example.NativeSummaryFuncs.fprintf(null, "[/var/lib/hudson/jobs/libgdx/workspace/extensions/gdx-audio/jni/libmpg123/parse.c:%i] error: Giving up resync after %li bytes - your stream is not nice... (maybe increasing resync limit could help).\n", 1121L, null); org.example.NativeSummaryFuncs.fprintf(null, "[/var/lib/hudson/jobs/libgdx/workspace/extensions/gdx-audio/jni/libmpg123/parse.c:%i] error: cannot seek!\n", 939L); org.example.NativeSummaryFuncs.fprintf(null, "[/var/lib/hudson/jobs/libgdx/workspace/extensions/gdx-audio/jni/libmpg123/parse.c:%i] error: Cannot seek back!\n", 948L); org.example.NativeSummaryFuncs.fprintf(null, "[/var/lib/hudson/jobs/libgdx/workspace/extensions/gdx-audio/jni/libmpg123/parse.c:%i] error: Cannot seek 3 bytes back!\n", 969L); org.example.NativeSummaryFuncs.fprintf(null, "[/var/lib/hudson/jobs/libgdx/workspace/extensions/gdx-audio/jni/libmpg123/format.c:%i] error: Some unknown encoding??? (%i)\n", 289L, null); $227_phi = null; if $opred != 34 goto label32; $227_phi = ""; goto label33; label32: if $opred != 35 goto label33; $227_phi = "mono, "; label33: $228_phi = null; if $opred != 36 goto label34; $228_phi = ""; goto label35; label34: if $opred != 37 goto label35; $228_phi = "8bit, "; label35: org.example.NativeSummaryFuncs.fprintf(null, "[/var/lib/hudson/jobs/libgdx/workspace/extensions/gdx-audio/jni/libmpg123/format.c:%i] error: Unable to set up output format! Constraints: %s%s%li, %li or %liHz.\n", 265L, $227_phi, $228_phi, null, null, null); org.example.NativeSummaryFuncs.fprintf(null, "Init rate converter: %ld->%ld\n", null, null); org.example.NativeSummaryFuncs.fprintf(null, "[/var/lib/hudson/jobs/libgdx/workspace/extensions/gdx-audio/jni/libmpg123/ntom.c:%i] error: NtoM converter: illegal rates\n", 22L); org.example.NativeSummaryFuncs.fprintf(null, "[/var/lib/hudson/jobs/libgdx/workspace/extensions/gdx-audio/jni/libmpg123/ntom.c:%i] error: max. 1:%i conversion allowed (%lu vs %lu)!\n", 31L, 8L, null, "\u0004"); org.example.NativeSummaryFuncs.fprintf(null, "[/var/lib/hudson/jobs/libgdx/workspace/extensions/gdx-audio/jni/libmpg123/optimize.c:%i] error: set_synth_functions: This output format is disabled in this build!\n", 339L); org.example.NativeSummaryFuncs.fprintf(null, "[/var/lib/hudson/jobs/libgdx/workspace/extensions/gdx-audio/jni/libmpg123/optimize.c:%i] error: Unable to determine active decoder type -- this is SERIOUS b0rkage!\n", 303L); org.example.NativeSummaryFuncs.free(null); org.example.NativeSummaryFuncs.malloc(null); return null; }
1 the filepath is printed by fprintf nsfunc_sink
com.sgr_b2.compass_18.apk Source: $r3 = virtualinvoke $r1_2.<java.text.DecimalFormat: java.lang.Number parse(java.lang.String)>($r0_1) Sink: virtualinvoke $r2.<android.content.ContentValues: void put(java.lang.String,java.lang.Float)>("lon", $r3_1)
https://bitbucket.org/alekseyt/compass/src/92a4381be7a51efc4d1939851f17b5d513a1bc52/jni/compass_jni_utils.c#lines-8 jfloat JNICALL Java_com_sgr_1b2_compass_jni_CCJNI_cmps_1sanitize_1lon(JNIEnv *env, jclass cls, jfloat lon) { return cmps_sanitize_lon(lon); } float cmps_sanitize_lon(float lon) { return (lon < -180 ? -180 : ( lon > 180 ? 180 : lon)); }
$f0_1 = staticinvoke <com.sgr_b2.compass.jni.CCJNI: float cmps_sanitize_lon(float)>($f0) $f0_1 = staticinvoke <com.sgr_b2.compass.jni.CCJNI: float cmps_sanitize_lon(float)>($f0)
$r3 = virtualinvoke $r1_2.<java.text.DecimalFormat: java.lang.Number parse(java.lang.String)>($r0_1) $f0 = virtualinvoke $r3.<java.lang.Number: float floatValue()>() return $f0 $f1 = staticinvoke <com.sgr_b2.compass.ui.d: float a(java.lang.String)>($r6) $f1_1 = staticinvoke <com.sgr_b2.compass.jni.k: float b(float)>($f1) $f0 := @parameter0: float $f0_1 = staticinvoke <com.sgr_b2.compass.jni.CCJNI: float cmps_sanitize_lon(float)>($f0) $f0 := @parameter0: float return $f0 $f0_1 = staticinvoke <com.sgr_b2.compass.jni.CCJNI: float cmps_sanitize_lon(float)>($f0) return $f0_1 $f1_1 = staticinvoke <com.sgr_b2.compass.jni.k: float b(float)>($f1) specialinvoke r0.<com.sgr_b2.compass.activities.AddEditActivity: void a(java.lang.String,float,float)>($r4, $f0_1, $f1_1) $f1 := @parameter2: float specialinvoke $r5_4.<com.sgr_b2.compass.a.d: void <init>(float,float,java.lang.String,int)>($f0, $f1, $r1, $i0_5) $f1 := @parameter1: float r0.<com.sgr_b2.compass.a.d: float d> = $f1 $f0_1 = $r1.<com.sgr_b2.compass.a.d: float d> $r3_1 = staticinvoke <java.lang.Float: java.lang.Float valueOf(float)>($f0_1) virtualinvoke $r2.<android.content.ContentValues: void put(java.lang.String,java.lang.Float)>("lon", $r3_1)
perform calculation in native code.
public static float cmps_sanitize_lon(float) { float $p0; $p0 := @parameter0; return $p0; }
1 native calculation function, dataflow p0 -> return value propagate
at.tomtasche.reader_172.apk Source: $r7 = virtualinvoke $r2_2.<java.io.File: java.lang.String getAbsolutePath()>() Sink: staticinvoke <org.example.NativeSummaryFuncs: int fopen(java.lang.String,java.lang.String)>($r2, "w")
https://github.com/ViliusSutkus89/wvWare-Android/blob/cc65e17e4d0380e8f9f19d96e0d29f87ce437530/wvWare/src/main/cpp/wvWare-Android.cpp#L91 JNIEXPORT jint JNICALL Java_com_viliussutkus89_android_wvware_wvWare__1convertToHTML(JNIEnv *env, jobject, jstring input_file, jstring output_file, jstring images_dir, jstring password_, jboolean is_no_graphics_mode) { CharGC inputFile(env, input_file); CCharGC outputFile(env, output_file); CharGC imagesDir(env, images_dir); CCharGC password(env, password_); no_graphics = is_no_graphics_mode == JNI_TRUE ? 1 : 0; g_htmlOutputFileHandle = fopen(outputFile.c_str(), "w"); int retVal = convert(inputFile.c_str(), imagesDir.c_str(), password.c_str()); fclose(g_htmlOutputFileHandle); g_htmlOutputFileHandle = nullptr; documentId++; return retVal; }
$i0_1 = virtualinvoke r0.<com.viliussutkus89.android.wvware.wvWare: int _convertToHTML(java.lang.String,java.lang.String,java.lang.String,java.lang.String,boolean)>($r3_3, $r7, $r8, $r1_3, 0) staticinvoke <org.example.NativeSummaryFuncs: int fopen(java.lang.String,java.lang.String)>($r2, "w")
$r7 = virtualinvoke $r2_2.<java.io.File: java.lang.String getAbsolutePath()>() $i0_1 = virtualinvoke r0.<com.viliussutkus89.android.wvware.wvWare: int _convertToHTML(java.lang.String,java.lang.String,java.lang.String,java.lang.String,boolean)>($r3_3, $r7, $r8, $r1_3, 0) $r2 := @parameter1: java.lang.String staticinvoke <org.example.NativeSummaryFuncs: int fopen(java.lang.String,java.lang.String)>($r2, "w")
open file path in param1
public final int _convertToHTML(java.lang.String, java.lang.String, java.lang.String, java.lang.String, boolean) { long $25_phi, $27_phi, $30_phi, $38_phi, $40_phi, $42_phi, $45_phi, $48_phi, $50_phi, $54_phi, $143_phi, $146_phi; com.viliussutkus89.android.wvware.wvWare $this; int $opred, $26; java.lang.String $p0, $p1, $p2, $p3; boolean $p4; $this := @this; $p0 := @parameter0; $p1 := @parameter1; $p2 := @parameter2; $p3 := @parameter3; $p4 := @parameter4; org.example.NativeSummaryFuncs.strdup($p0); org.example.NativeSummaryFuncs.strdup($p2); org.example.NativeSummaryFuncs.fopen($p1, "w"); org.example.NativeSummaryFuncs.malloc(null); org.example.NativeSummaryFuncs.malloc(null); org.example.NativeSummaryFuncs.malloc(null); org.example.NativeSummaryFuncs.malloc(-88L); org.example.NativeSummaryFuncs.free(null); org.example.NativeSummaryFuncs.free(null); org.example.NativeSummaryFuncs.free(null); org.example.NativeSummaryFuncs.free(null); org.example.NativeSummaryFuncs.free(null); org.example.NativeSummaryFuncs.free(null); org.example.NativeSummaryFuncs.malloc(5L); $25_phi = 0; $opred = org.example.NativeSummaryAux.opaqueInt(); if $opred != 1 goto label01; $25_phi = -1L; goto label04; label01: if $opred != 2 goto label02; $25_phi = 4294967295L; goto label04; label02: if $opred != 3 goto label03; $25_phi = -4294967284L; goto label04; label03: if $opred != 4 goto label04; $25_phi = 12L; label04: $26 = org.example.NativeSummaryFuncs.malloc($25_phi); $27_phi = 0; if $opred != 5 goto label05; $27_phi = -1L; goto label08; label05: if $opred != 6 goto label06; $27_phi = 4294967295L; goto label08; label06: if $opred != 7 goto label07; $27_phi = -4294967284L; goto label08; label07: if $opred != 8 goto label08; $27_phi = 12L; label08: org.example.NativeSummaryFuncs.malloc($27_phi); org.example.NativeSummaryFuncs.free(null); $30_phi = 0; if $opred != 9 goto label09; $30_phi = 4294967295L; goto label12; label09: if $opred != 10 goto label10; $30_phi = -1L; goto label12; label10: if $opred != 11 goto label11; $30_phi = -4294967284L; goto label12; label11: if $opred != 12 goto label12; $30_phi = 12L; label12: org.example.NativeSummaryFuncs.realloc(null, $30_phi); org.example.NativeSummaryFuncs.sprintf(null, "%#.0f", null); org.example.NativeSummaryFuncs.sprintf(null, "%+d", null); org.example.NativeSummaryFuncs.sprintf(null, "%#.0f", null); org.example.NativeSummaryFuncs.sprintf(null, "%+d", null); org.example.NativeSummaryFuncs.free(null); $38_phi = 0; if $opred != 13 goto label13; $38_phi = -1L; goto label14; label13: if $opred != 14 goto label14; $38_phi = 12L; label14: org.example.NativeSummaryFuncs.realloc(null, $38_phi); $40_phi = 0; if $opred != 15 goto label15; $40_phi = -1L; goto label18; label15: if $opred != 16 goto label16; $40_phi = 4294967295L; goto label18; label16: if $opred != 17 goto label17; $40_phi = -4294967284L; goto label18; label17: if $opred != 18 goto label18; $40_phi = 12L; label18: org.example.NativeSummaryFuncs.malloc($40_phi); $42_phi = 0; if $opred != 19 goto label19; $42_phi = -1L; goto label22; label19: if $opred != 20 goto label20; $42_phi = 4294967295L; goto label22; label20: if $opred != 21 goto label21; $42_phi = -4294967284L; goto label22; label21: if $opred != 22 goto label22; $42_phi = 12L; label22: org.example.NativeSummaryFuncs.malloc($42_phi); org.example.NativeSummaryFuncs.free(null); $45_phi = 0; if $opred != 23 goto label23; $45_phi = -1L; goto label24; label23: if $opred != 24 goto label24; $45_phi = 12L; label24: org.example.NativeSummaryFuncs.realloc(null, $45_phi); org.example.NativeSummaryFuncs.free(null); $48_phi = 0; if $opred != 25 goto label25; $48_phi = -1L; goto label28; label25: if $opred != 26 goto label26; $48_phi = 4294967295L; goto label28; label26: if $opred != 27 goto label27; $48_phi = -4294967284L; goto label28; label27: if $opred != 28 goto label28; $48_phi = 12L; label28: org.example.NativeSummaryFuncs.malloc($48_phi); $50_phi = 0; if $opred != 29 goto label29; $50_phi = -1L; goto label32; label29: if $opred != 30 goto label30; $50_phi = 4294967295L; goto label32; label30: if $opred != 31 goto label31; $50_phi = -4294967284L; goto label32; label31: if $opred != 32 goto label32; $50_phi = 12L; label32: org.example.NativeSummaryFuncs.malloc($50_phi); org.example.NativeSummaryFuncs.free(null); org.example.NativeSummaryFuncs.free(null); $54_phi = 0; if $opred != 33 goto label33; $54_phi = -1L; goto label36; label33: if $opred != 34 goto label34; $54_phi = 4294967295L; goto label36; label34: if $opred != 35 goto label35; $54_phi = -4294967284L; goto label36; label35: if $opred != 36 goto label36; $54_phi = 12L; label36: org.example.NativeSummaryFuncs.malloc($54_phi); org.example.NativeSummaryFuncs.malloc(16L); org.example.NativeSummaryFuncs.malloc(null); org.example.NativeSummaryFuncs.malloc(null); org.example.NativeSummaryFuncs.malloc(null); org.example.NativeSummaryFuncs.malloc(null); org.example.NativeSummaryFuncs.free(null); org.example.NativeSummaryFuncs.free(null); org.example.NativeSummaryFuncs.malloc(null); org.example.NativeSummaryFuncs.malloc(1L); org.example.NativeSummaryFuncs.free(null); org.example.NativeSummaryFuncs.free(null); org.example.NativeSummaryFuncs.free(null); org.example.NativeSummaryFuncs.free(null); org.example.NativeSummaryFuncs.free(null); org.example.NativeSummaryFuncs.free(null); org.example.NativeSummaryFuncs.free(null); org.example.NativeSummaryFuncs.free(null); org.example.NativeSummaryFuncs.free(null); org.example.NativeSummaryFuncs.malloc(null); org.example.NativeSummaryFuncs.free(null); org.example.NativeSummaryFuncs.free(null); org.example.NativeSummaryFuncs.free(null); org.example.NativeSummaryFuncs.free(null); org.example.NativeSummaryFuncs.sprintf(null, "%#.0f", null); org.example.NativeSummaryFuncs.sprintf(null, "%#.0f", null); org.example.NativeSummaryFuncs.sprintf(null, "%#.0f", null); org.example.NativeSummaryFuncs.sprintf(null, "%+.2d", null); org.example.NativeSummaryFuncs.sprintf(null, "%#.0f", null); org.example.NativeSummaryFuncs.free(null); org.example.NativeSummaryFuncs.free(null); org.example.NativeSummaryFuncs.free(null); org.example.NativeSummaryFuncs.sprintf(null, "%#.0f", null); org.example.NativeSummaryFuncs.free(null); org.example.NativeSummaryFuncs.sprintf(null, "%#.0f", null); org.example.NativeSummaryFuncs.sprintf(null, "%+.2d", null); org.example.NativeSummaryFuncs.malloc(8L); org.example.NativeSummaryFuncs.free(null); org.example.NativeSummaryFuncs.free(null); org.example.NativeSummaryFuncs.free(null); org.example.NativeSummaryFuncs.free(null); org.example.NativeSummaryFuncs.free(null); org.example.NativeSummaryFuncs.free(null); org.example.NativeSummaryFuncs.sprintf(null, "%#.0f", null); org.example.NativeSummaryFuncs.free(null); org.example.NativeSummaryFuncs.free(null); org.example.NativeSummaryFuncs.free(null); org.example.NativeSummaryFuncs.free(null); org.example.NativeSummaryFuncs.sprintf(null, "%#.0f", null); org.example.NativeSummaryFuncs.sprintf(null, "%#.0f", null); org.example.NativeSummaryFuncs.sprintf(null, "%#.0f", null); org.example.NativeSummaryFuncs.sprintf(null, "%+.2d", null); org.example.NativeSummaryFuncs.free(null); org.example.NativeSummaryFuncs.sprintf(null, "%#.0f", null); org.example.NativeSummaryFuncs.free(null); org.example.NativeSummaryFuncs.free(null); org.example.NativeSummaryFuncs.free(null); org.example.NativeSummaryFuncs.sprintf(null, "%#.0f", null); org.example.NativeSummaryFuncs.free(null); org.example.NativeSummaryFuncs.sprintf(null, "%#.0f", null); org.example.NativeSummaryFuncs.sprintf(null, "%+.2d", null); $143_phi = 0; if $opred != 37 goto label37; $143_phi = -1L; goto label40; label37: if $opred != 38 goto label38; $143_phi = 4294967295L; goto label40; label38: if $opred != 39 goto label39; $143_phi = -4294967284L; goto label40; label39: if $opred != 40 goto label40; $143_phi = 12L; label40: org.example.NativeSummaryFuncs.malloc($143_phi); org.example.NativeSummaryFuncs.free($26); $146_phi = 0; if $opred != 41 goto label41; $146_phi = -1L; goto label42; label41: if $opred != 42 goto label42; $146_phi = 12L; label42: org.example.NativeSummaryFuncs.realloc($26, $146_phi); org.example.NativeSummaryFuncs.free(null); org.example.NativeSummaryFuncs.malloc(null); org.example.NativeSummaryFuncs.free(null); org.example.NativeSummaryFuncs.free(null); return null; }
1 fopen call on param1 nsfunc_sink
me.impa.knockonports_46.apk Source: $r5_10 = virtualinvoke $r55.<java.net.Inet4Address: java.lang.String getHostAddress()>() Sink: staticinvoke <android.util.Log: int i(java.lang.String,java.lang.String)>("TCP", $r2_4)
https://github.com/impalex/knockonports/blob/57b0eb2148a3a7cae416188f8dd092a5f3423d69/app/src/main/cpp/netutil.cpp#L219 extern "C" jint Java_me_impa_knockonports_service_Knocker_sendtcp(JNIEnv *env, jobject __unused thiz, jstring host, jint port) { const char *n_host = env->GetStringUTFChars(host, NULL); int result = send_tcp_packet(AF_INET, n_host, port); (*env).ReleaseStringUTFChars(host, n_host); return result; } int send_tcp_packet(int family, const char *host, const int port) { void *addr; int addr_size; __android_log_print(ANDROID_LOG_INFO, "TCP", "hitting %s:%d", host, port); memset(&addr, 0, sizeof(addr)); if (family == AF_INET) { if (init_addr_v4(&addr, &addr_size, host, port) == EXIT_FAILURE) return EXIT_FAILURE; } else if (family == AF_INET6) { if (init_addr_v6(&addr, &addr_size, host, port) == EXIT_FAILURE) return EXIT_FAILURE; } else { __android_log_print(ANDROID_LOG_ERROR, "TCP", "invalid family %d", family); return EXIT_FAILURE; } int sock = socket(family, SOCK_STREAM | SOCK_NONBLOCK, IPPROTO_TCP); // NOLINT(android-cloexec-socket,hicpp-signed-bitwise) if (sock < 0) { __android_log_print(ANDROID_LOG_ERROR, "TCP", "socket errorno %d %s\n", errno, strerror(errno)); free(addr); return EXIT_FAILURE; } connect(sock, (struct sockaddr *)addr, addr_size); // NOLINT(bugprone-unused-return-value) shutdown(sock, SHUT_RDWR); close(sock); free(addr); return EXIT_SUCCESS; }
specialinvoke r0.<me.impa.knockonports.service.Knocker: int sendtcp(java.lang.String,int)>($r5_10, $i1_17)
$r5_10 = virtualinvoke $r55.<java.net.Inet4Address: java.lang.String getHostAddress()>() specialinvoke r0.<me.impa.knockonports.service.Knocker: int sendtcp(java.lang.String,int)>($r5_10, $i1_17) $r1 := @parameter0: java.lang.String $r2_4 = $r1 staticinvoke <android.util.Log: int i(java.lang.String,java.lang.String)>("TCP", $r2_4)
the param0 -> log
private final int sendtcp(java.lang.String, int) { java.lang.Integer boxed; java.lang.Long boxed; me.impa.knockonports.service.Knocker $this; int $p1, $opred, $6, $22_phi; java.lang.String $p0, $2_phi, $casted, $9_phi, $11_phi, $16_phi, $casted; $this := @this; $p0 := @parameter0; $p1 := @parameter1; $2_phi = null; $opred = org.example.NativeSummaryAux.opaqueInt(); if $opred != 1 goto label01; $2_phi = "hitting %s:%d"; goto label03; label01: if $opred != 2 goto label02; boxed = java.lang.Integer.valueOf($p1); $casted = virtualinvoke boxed.toString(); $2_phi = $casted; goto label03; label02: if $opred != 3 goto label03; $2_phi = $p0; label03: android.util.Log.i("TCP", $2_phi); $6 = org.example.NativeSummaryFuncs.calloc(1L, 16L); org.example.NativeSummaryFuncs.close(2L); org.example.NativeSummaryFuncs.free($6); $9_phi = null; if $opred != 4 goto label04; $9_phi = "TCP"; goto label05; label04: if $opred != 5 goto label05; $9_phi = "ADDR"; label05: $11_phi = null; if $opred != 6 goto label06; $11_phi = null; goto label08; label06: if $opred != 7 goto label07; $11_phi = "socket errorno %d %s\n"; goto label08; label07: if $opred != 8 goto label08; $11_phi = "inet_pton errono %d %s"; label08: android.util.Log.e($9_phi, $11_phi); org.example.NativeSummaryFuncs.free($6); $16_phi = null; if $opred != 9 goto label09; boxed = java.lang.Long.valueOf(2L); $casted = virtualinvoke boxed.toString(); $16_phi = $casted; goto label10; label09: if $opred != 10 goto label10; $16_phi = "invalid family %d"; label10: android.util.Log.e("TCP", $16_phi); $22_phi = 0; if $opred != 11 goto label11; $22_phi = 1L; goto label12; label11: if $opred != 12 goto label12; $22_phi = null; label12: return $22_phi; }
1 the param0 host is printed by log log_sink
jp.sawada.np2android_20130429.apk Source: $r2 = virtualinvoke $r1.<java.io.File: java.lang.String getAbsolutePath()>() Sink: staticinvoke <org.example.NativeSummaryFuncs: int fread(java.lang.Object,long,long,java.lang.String)>(null, 1L, 32L, $r2_3)
https://sourceforge.net/p/np2android/code/ci/master/tree/ JNIEXPORT void JNICALL Java_jp_sawada_np2android_SDLActivity_onNativeFileDir (JNIEnv *env, jclass jcls, jint device, jstring name) { const char *path = (*env)->GetStringUTFChars(env, name, 0); // __android_log_print(ANDROID_LOG_INFO, "SDL", "DISK-filepath=(%s)",path ); if (device == 0) { /* Set current directory */ chdir(path); } else if (device == 1) { /* Set SASI1 filepath */ diskdrv_sethdd(0, path); } else if (device == 2) { /* Set SASI2 filepath */ diskdrv_sethdd(1, path); } else if (device == 3) { /* Set FDD1 filepath */ diskdrv_setfdd(0, path, 0); } else if (device == 4) { /* Set FDD2 filepath */ diskdrv_setfdd(1, path, 0); } (*env)->ReleaseStringUTFChars(env, name, path); }
staticinvoke <jp.sawada.np2android.SDLActivity: void onNativeFileDir(int,java.lang.String)>($i0, $r2) staticinvoke <org.example.NativeSummaryFuncs: int fread(java.lang.Object,long,long,java.lang.String)>(null, 1L, 32L, $r2_3)
$r2 = virtualinvoke $r1.<java.io.File: java.lang.String getAbsolutePath()>() staticinvoke <jp.sawada.np2android.SDLActivity: void onNativeFileDir(int,java.lang.String)>($i0, $r2) $r0 := @parameter1: java.lang.String $r2_3 = $r0 staticinvoke <org.example.NativeSummaryFuncs: int fread(java.lang.Object,long,long,java.lang.String)>(null, 1L, 32L, $r2_3)
the file path is read by fread
public static void onNativeFileDir(int, java.lang.String) { int $p0, $opred, $14, $17, $27; java.lang.String $p1, $2, $3_phi, $5_phi, $7_phi, $9_phi, $11_phi, $13_phi, $16_phi; $p0 := @parameter0; $p1 := @parameter1; $2 = org.example.NativeSummaryFuncs.fopen($p1, "rb+"); $3_phi = null; $opred = org.example.NativeSummaryAux.opaqueInt(); if $opred != 1 goto label01; $3_phi = $p1; goto label02; label01: if $opred != 2 goto label02; $3_phi = $2; label02: org.example.NativeSummaryFuncs.fread(null, 1L, 32L, $3_phi); $5_phi = null; if $opred != 3 goto label03; $5_phi = $p1; goto label04; label03: if $opred != 4 goto label04; $5_phi = $2; label04: org.example.NativeSummaryFuncs.fread(null, 1L, 512L, $5_phi); $7_phi = null; if $opred != 5 goto label05; $7_phi = $p1; goto label06; label05: if $opred != 6 goto label06; $7_phi = $2; label06: org.example.NativeSummaryFuncs.fread(null, 1L, 2L, $7_phi); $9_phi = null; if $opred != 7 goto label07; $9_phi = $p1; goto label08; label07: if $opred != 8 goto label08; $9_phi = $2; label08: org.example.NativeSummaryFuncs.fread(null, 1L, 220L, $9_phi); $11_phi = null; if $opred != 9 goto label09; $11_phi = $p1; goto label10; label09: if $opred != 10 goto label10; $11_phi = $2; label10: org.example.NativeSummaryFuncs.fclose($11_phi); $13_phi = null; if $opred != 11 goto label11; $13_phi = ""; goto label12; label11: if $opred != 12 goto label12; $13_phi = $p1; label12: $14 = org.example.NativeSummaryFuncs.fopen($13_phi, "rb+"); org.example.NativeSummaryFuncs.fread(null, 1L, 2048L, $14); $16_phi = null; if $opred != 13 goto label13; $16_phi = ""; goto label14; label13: if $opred != 14 goto label14; $16_phi = $p1; label14: $17 = org.example.NativeSummaryFuncs.fopen($16_phi, "rb+"); org.example.NativeSummaryFuncs.fread(null, 1L, 4L, $17); org.example.NativeSummaryFuncs.malloc(2080L); org.example.NativeSummaryFuncs.malloc(4908L); org.example.NativeSummaryFuncs.fread(null, 1L, 2048L, $14); org.example.NativeSummaryFuncs.fclose($14); org.example.NativeSummaryFuncs.fclose($17); org.example.NativeSummaryFuncs.fclose(null); org.example.NativeSummaryFuncs.free(null); $27 = org.example.NativeSummaryFuncs.fopen(null, "rb+"); org.example.NativeSummaryFuncs.fclose($27); org.example.NativeSummaryFuncs.fclose($27); return; }
1 the file path is read by fread nsfunc_sink
name.boyle.chris.sgtpuzzles_133.apk Source: $r4_1 = virtualinvoke $r0.<java.io.BufferedReader: java.lang.String readLine()>() Sink: specialinvoke r0.<android.view.View: void setBackgroundColor(int)>($i0)
https://github.com/chrisboyle/sgtpuzzles/blob/7363eb73913486ce167771be414ff468a412e4c3/app/src/main/jni/android.c#L953 JNIEXPORT jobject JNICALL Java_name_boyle_chris_sgtpuzzles_backend_GameEngineImpl_fromSavedGame(JNIEnv *env, __attribute__((unused)) jclass clazz, jstring savedGame, jobject activityCallbacks, jobject viewCallbacks, jstring initialPrefs) { return startPlayingInt(env, NULL, activityCallbacks, viewCallbacks, savedGame, false, initialPrefs); }
$r4 = staticinvoke <name.boyle.chris.sgtpuzzles.GameEngineImpl: name.boyle.chris.sgtpuzzles.GameEngine fromSavedGame(java.lang.String,name.boyle.chris.sgtpuzzles.GameEngine$ActivityCallbacks,name.boyle.chris.sgtpuzzles.GameEngine$ViewCallbacks)>($r3, $r2, $r0)
$r4_1 = virtualinvoke $r0.<java.io.BufferedReader: java.lang.String readLine()>() virtualinvoke $r3.<java.lang.StringBuilder: java.lang.StringBuilder append(java.lang.String)>($r4_1) $r4_2 = virtualinvoke $r3.<java.lang.StringBuilder: java.lang.String toString()>() return $r4_2 $r16 = staticinvoke <name.boyle.chris.sgtpuzzles.Utils: java.lang.String readAllOf(java.io.InputStream)>($r15) specialinvoke $r26.<name.boyle.chris.sgtpuzzles.GameLaunch: void <init>(int,name.boyle.chris.sgtpuzzles.BackendName,java.lang.String,java.lang.String,java.lang.String,java.lang.String)>($i0_2, $r1, $r2_2, $r3, $r4, $r16) $r5 := @parameter5: java.lang.String r0.<name.boyle.chris.sgtpuzzles.GameLaunch: java.lang.String _saved> = $r5 $r3 = $r1.<name.boyle.chris.sgtpuzzles.GameLaunch: java.lang.String _saved> $r4 = staticinvoke <name.boyle.chris.sgtpuzzles.GameEngineImpl: name.boyle.chris.sgtpuzzles.GameEngine fromSavedGame(java.lang.String,name.boyle.chris.sgtpuzzles.GameEngine$ActivityCallbacks,name.boyle.chris.sgtpuzzles.GameEngine$ViewCallbacks)>($r3, $r2, $r0) return $r4 $r7 = staticinvoke <name.boyle.chris.sgtpuzzles.GameEngineImpl: name.boyle.chris.sgtpuzzles.GameEngine fromLaunch(name.boyle.chris.sgtpuzzles.GameLaunch,name.boyle.chris.sgtpuzzles.GameEngine$ActivityCallbacks,name.boyle.chris.sgtpuzzles.GameEngine$ViewCallbacks)>($r1, r0, $r6) r0.<name.boyle.chris.sgtpuzzles.GamePlay: name.boyle.chris.sgtpuzzles.GameEngine gameEngine> = $r7 $r6 = r0.<name.boyle.chris.sgtpuzzles.GamePlay: name.boyle.chris.sgtpuzzles.GameEngine gameEngine> getColours()>() $f0_1 = $r7[$i2_1] $f0_2 = $f0_1 * 255.0F $i1_3 = (int) $f0_2 $i1_4 = staticinvoke <android.graphics.Color: int rgb(int,int,int)>($i1_3, $i3_2, $i2_3) virtualinvoke $r1_1.<name.boyle.chris.sgtpuzzles.GameView: void setBackgroundColor(int)>($i0_14) $i0 := @parameter0: int specialinvoke r0.<android.view.View: void setBackgroundColor(int)>($i0)
param0 -> return value
private static name.boyle.chris.sgtpuzzles.GameEngine fromSavedGame(java.lang.String, name.boyle.chris.sgtpuzzles.GameEngine$ActivityCallbacks, name.boyle.chris.sgtpuzzles.GameEngine$ViewCallbacks) { name.boyle.chris.sgtpuzzles.GameEngine$ViewCallbacks $p2; java.lang.IllegalArgumentException $70; int $3, $8, $20, $25, $43, $opred; java.lang.String $p0; name.boyle.chris.sgtpuzzles.GameEngine$ActivityCallbacks $p1, $19, $48_phi, $51_phi; $p0 := @parameter0; $p1 := @parameter1; $p2 := @parameter2; org.example.NativeSummaryFuncs.vfprintf(null, "allocation too large", null); org.example.NativeSummaryFuncs.exit(1L); org.example.NativeSummaryFuncs.malloc(96L); $3 = org.example.NativeSummaryFuncs.vfprintf(null, "out of memory", null); org.example.NativeSummaryFuncs.exit(1L); $8 = org.example.NativeSummaryFuncs.malloc(1L); org.example.NativeSummaryFuncs.free($8); org.example.NativeSummaryFuncs.vfprintf(null, "allocation too large", null); org.example.NativeSummaryFuncs.exit(1L); org.example.NativeSummaryFuncs.malloc(1L); org.example.NativeSummaryFuncs.vfprintf(null, "out of memory", null); org.example.NativeSummaryFuncs.exit(1L); org.example.NativeSummaryFuncs.free($8); name.boyle.chris.sgtpuzzles.BackendName.byDisplayName(null); $19 = org.example.NativeSummaryFuncs.malloc(280L); $20 = org.example.NativeSummaryFuncs.malloc(16L); org.example.NativeSummaryFuncs.malloc(64L); org.example.NativeSummaryFuncs.malloc(56L); org.example.NativeSummaryFuncs.sscanf($3, "%d", null); org.example.NativeSummaryFuncs.free($20); $25 = org.example.NativeSummaryFuncs.malloc(1L); org.example.NativeSummaryFuncs.free(null); org.example.NativeSummaryFuncs.free(null); org.example.NativeSummaryFuncs.free(null); org.example.NativeSummaryFuncs.free(null); org.example.NativeSummaryFuncs.free(null); org.example.NativeSummaryFuncs.malloc(null); org.example.NativeSummaryFuncs.free(null); org.example.NativeSummaryFuncs.free(null); org.example.NativeSummaryFuncs.free(null); $43 = org.example.NativeSummaryFuncs.malloc(null); org.example.NativeSummaryFuncs.free($25); org.example.NativeSummaryFuncs.free(null); org.example.NativeSummaryFuncs.ExceptionCheck(null); $48_phi = null; $opred = org.example.NativeSummaryAux.opaqueInt(); if $opred != 1 goto label1; $48_phi = null; goto label2; label1: if $opred != 2 goto label2; $48_phi = $19; label2: interfaceinvoke $48_phi.requestTimer(0L); org.example.NativeSummaryFuncs.ExceptionCheck(null); $51_phi = null; if $opred != 3 goto label3; $51_phi = null; goto label4; label3: if $opred != 4 goto label4; $51_phi = $19; label4: interfaceinvoke $51_phi.requestTimer(1L); org.example.NativeSummaryFuncs.free($25); org.example.NativeSummaryFuncs.free(null); org.example.NativeSummaryFuncs.free(null); org.example.NativeSummaryFuncs.free(null); org.example.NativeSummaryFuncs.free(null); org.example.NativeSummaryFuncs.free(null); org.example.NativeSummaryFuncs.free(null); org.example.NativeSummaryFuncs.free(null); org.example.NativeSummaryFuncs.free(null); org.example.NativeSummaryFuncs.free($43); $70 = new java.lang.IllegalArgumentException; specialinvoke $70.<init>(null); throw $70; }
1 data flow from saved game path to returned instance propagate
org.calyxinstitute.vpn_160000.apk Source: $r11 = virtualinvoke $r10.<java.io.File: java.lang.String getAbsolutePath()>() Sink: staticinvoke <org.example.NativeSummaryFuncs: int strdup(java.lang.String)>($r2_9)
https://github.com/guardianproject/tor/blob/86771dade0937520a0a164ca571c5c7a8a1c20cc/src/feature/api/org_torproject_jni_TorService.c#L221 JNIEXPORT jboolean JNICALL Java_org_torproject_jni_TorService_mainConfigurationSetCommandLine (JNIEnv *env, jobject thisObj, jobjectArray arrArgv) { return SetCommandLine(env, thisObj, arrArgv); } static bool SetCommandLine(JNIEnv *env, jobject thisObj, jobjectArray arrArgv) { tor_main_configuration_t *cfg = GetConfiguration(env, thisObj); if (cfg == NULL) { fprintf(stderr, "SetCommandLine: The Tor configuration is NULL!\n"); return -1; } jsize arrArgvLen = (*env)->GetArrayLength(env, arrArgv); if (arrArgvLen > (INT_MAX-1)) { fprintf(stderr, "Too many args\n"); return false; } argc = (int) arrArgvLen; argv = (char**) tor_malloc(argc * sizeof(char*)); if (argv == NULL) { return false; } for (jsize i=0; i<argc; i++) { jobject objElm = (*env)->GetObjectArrayElement(env, arrArgv, i); jstring argElm = (jstring) objElm; const char *arg = (*env)->GetStringUTFChars(env, argElm, NULL); argv[i] = strdup(arg); } if (tor_main_configuration_set_command_line(cfg, argc, argv)) { fprintf(stderr, "Setting the command line config failed\n"); return false; } return true; }
$z0 = specialinvoke $r1.<org.torproject.jni.TorService: boolean mainConfigurationSetCommandLine(java.lang.String[])>($r0) staticinvoke <org.example.NativeSummaryFuncs: int strdup(java.lang.String)>($r2_9)
$r11 = virtualinvoke $r10.<java.io.File: java.lang.String getAbsolutePath()>() = $r11 $r13 = staticinvoke <java.util.Arrays: java.util.List asList(java.lang.Object[])>($r8) $r8_2 = (java.lang.String[]) $r14 $z0_3 = staticinvoke <org.torproject.jni.TorService: boolean access$1300(org.torproject.jni.TorService,java.lang.String[])>($r3_4, $r8_2) $r0 := @parameter1: java.lang.String[] $z0 = specialinvoke $r1.<org.torproject.jni.TorService: boolean mainConfigurationSetCommandLine(java.lang.String[])>($r0) $r1 := @parameter0: java.lang.String[] $r2_9 = $r1[0] staticinvoke <org.example.NativeSummaryFuncs: int strdup(java.lang.String)>($r2_9)
get elememt from array and passed to strdup
private boolean mainConfigurationSetCommandLine(java.lang.String[]) { java.lang.String[] $p0; long $19_phi; org.torproject.jni.TorService $this; int $opred; java.lang.String $4_phi, $8_phi, $23, $27_phi, $31_phi; boolean $13, $35_phi; $this := @this; $p0 := @parameter0; $4_phi = null; $opred = org.example.NativeSummaryAux.opaqueInt(); if $opred != 1 goto label01; $4_phi = "The fieldID is NULL\n"; goto label03; label01: if $opred != 2 goto label02; $4_phi = "GetObjectClass returned NULL\n"; goto label03; label02: if $opred != 3 goto label03; $4_phi = "J"; label03: android.util.Log.e("Tor-api", $4_phi); $8_phi = null; if $opred != 4 goto label04; $8_phi = "The long is 0\n"; goto label05; label04: if $opred != 5 goto label05; $8_phi = "J"; label05: android.util.Log.e("Tor-api", $8_phi); org.example.NativeSummaryFuncs.GetArrayLength(null, $p0); $13 = org.example.NativeSummaryFuncs.malloc(1L); org.example.NativeSummaryFuncs.write(null, null, 64L); org.example.NativeSummaryFuncs.write(null, null, 16L); org.example.NativeSummaryFuncs.write(null, null, 15L); org.example.NativeSummaryFuncs.write(null, null, 40L); org.example.NativeSummaryFuncs.write(null, null, null); $19_phi = 0; if $opred != 6 goto label06; $19_phi = 33L; goto label07; label06: if $opred != 7 goto label07; $19_phi = null; label07: org.example.NativeSummaryFuncs.write(null, null, $19_phi); org.example.NativeSummaryFuncs.write(null, null, 15L); org.example.NativeSummaryFuncs.write(null, null, 15L); $23 = $p0[0]; org.example.NativeSummaryFuncs.strdup($23); $27_phi = null; if $opred != 8 goto label08; $27_phi = "Too many args\n"; goto label09; label08: if $opred != 9 goto label09; $27_phi = "J"; label09: android.util.Log.e("Tor-api", $27_phi); $31_phi = null; if $opred != 10 goto label10; $31_phi = "SetCommandLine: The Tor configuration is NULL!\n"; goto label11; label10: if $opred != 11 goto label11; $31_phi = "J"; label11: android.util.Log.e("Tor-api", $31_phi); $35_phi = 0; if $opred != 12 goto label12; $35_phi = 1L; goto label14; label12: if $opred != 13 goto label13; $35_phi = null; goto label14; label13: if $opred != 14 goto label14; $35_phi = $13; label14: return $35_phi; }
1 get elememt from array and passed to strdup nsfunc_sink
com.Bisha.TI89EmuDonation_1133.apk Source: $r5_1 = virtualinvoke r3.<java.io.File: java.lang.String getAbsolutePath()>() Sink: staticinvoke <android.util.Log: int i(java.lang.String,java.lang.String)>("Graph89", $r1_3)
https://github.com/chosen1/graph89/blob/900498e6f52c07ddf80359875a57a3046ba26a83/jni/wrapper/tiemuwrapperjni.c#L33 JNIEXPORT jint JNICALL Java_com_graph89_emulationcore_EmulatorActivity_nativeTiEmuStep2LoadImage(JNIEnv * env, jobject obj, jstring image_file) { const char * filename = (*env)->GetStringUTFChars(env, image_file, 0); int code = tiemu_step2_load_image(filename); (*env)->ReleaseStringUTFChars(env, image_file, filename); LOGI("TiEmu LoadImage %d", code); return (jint)code; }
$i0 = staticinvoke <com.graph89.emulationcore.EmulatorActivity: int nativeTiEmuStep2LoadImage(java.lang.String)>($r5_1)
$r5_1 = virtualinvoke r3.<java.io.File: java.lang.String getAbsolutePath()>() $i0 = staticinvoke <com.graph89.emulationcore.EmulatorActivity: int nativeTiEmuStep2LoadImage(java.lang.String)>($r5_1) $r0 := @parameter0: java.lang.String $r1_3 = $r0 staticinvoke <android.util.Log: int i(java.lang.String,java.lang.String)>("Graph89", $r1_3)
param0 filename logged by android log print
public static int nativeTiEmuStep2LoadImage(java.lang.String) { int $opred; java.lang.String $p0, $4_phi; $p0 := @parameter0; $4_phi = null; $opred = org.example.NativeSummaryAux.opaqueInt(); if $opred != 1 goto label1; $4_phi = $p0; goto label2; label1: if $opred != 2 goto label2; $4_phi = "TiEmu LoadImage %d"; label2: android.util.Log.i("Graph89", $4_phi); return $p0; }
1 param0 filename logged by android log print log_sink
com.atelieryl.wonderdroid_51.apk Source: $i0_9 = staticinvoke <java.lang.Integer: int parseInt(java.lang.String)>($r5_3) Sink: staticinvoke <android.util.Log: int e(java.lang.String,java.lang.String)>("VNCConn-native", $r2_4)
https://github.com/williehwc/wonderdroid-x/blob/bca8527d9cb4ace82ae6a9ab19f3c84e96ae8571/app/src/main/jni/com_atelieryl_wonderdroid_WonderSwan.cpp#L199 JNIEXPORT void JNICALL Java_com_atelieryl_wonderdroid_WonderSwan_savebackup(JNIEnv *env, jclass obj, jstring filename) {}
$z0_1 = specialinvoke $r7.<com.coboltforge.dontmind.multivnc.VNCConn: boolean rfbInit(java.lang.String,int,int,int,java.lang.String,boolean,boolean,int,int,java.lang.String,java.lang.String,java.lang.String,byte[],java.lang.String)>($r0, $i0, $i1, $i2, $r1, $z0, $z1, $i3, $i4, $r2, $r3, $r4, $r5, $r6)
$i0_9 = staticinvoke <java.lang.Integer: int parseInt(java.lang.String)>($r5_3) r0.<com.coboltforge.dontmind.multivnc.db.ConnectionBean: int port> = $i0_9 $i1_2 = $r7_16.<com.coboltforge.dontmind.multivnc.db.ConnectionBean: int port> $z0_7 = staticinvoke <com.coboltforge.dontmind.multivnc.VNCConn: boolean access$800(com.coboltforge.dontmind.multivnc.VNCConn,java.lang.String,int,int,int,java.lang.String,boolean,boolean,int,int,java.lang.String,java.lang.String,java.lang.String,byte[],java.lang.String)>($r4_18, $r20, $i1_2, $i0_6_4, $i2, $r1_16, $z0_6_4, $z1_4_4, $i3, $i4, $r2_4, $r23, $r24, $r9_6, $r25) $i0 := @parameter2: int $z0_1 = specialinvoke $r7.<com.coboltforge.dontmind.multivnc.VNCConn: boolean rfbInit(java.lang.String,int,int,int,java.lang.String,boolean,boolean,int,int,java.lang.String,java.lang.String,java.lang.String,byte[],java.lang.String)>($r0, $i0, $i1, $i2, $r1, $z0, $z1, $i3, $i4, $r2, $r3, $r4, $r5, $r6) $i0 := @parameter1: int $r8 = staticinvoke <java.lang.Integer: java.lang.Integer valueOf(int)>($i0) $r2_4 = virtualinvoke $r8.<java.lang.Integer: java.lang.String toString()>() staticinvoke <android.util.Log: int e(java.lang.String,java.lang.String)>("VNCConn-native", $r2_4)
cannot find source code
public static void savebackup(java.lang.String) { int $opred, $7, $24; java.lang.String $p0, $0_phi, $8_phi, $12_phi, $17_phi, $25_phi, $29_phi; $p0 := @parameter0; $0_phi = null; $opred = org.example.NativeSummaryAux.opaqueInt(); if $opred != 1 goto label01; $0_phi = "storing backup data"; goto label02; label01: if $opred != 2 goto label02; $0_phi = null; label02: android.util.Log.d("libwonderswan", $0_phi); org.example.NativeSummaryFuncs.snprintf(null, 256L, "eeprom size %d, sram size %d", null, null); $7 = org.example.NativeSummaryFuncs.fopen($p0, "w"); $8_phi = null; if $opred != 3 goto label03; $8_phi = "Writing SRAM"; goto label04; label03: if $opred != 4 goto label04; $8_phi = null; label04: android.util.Log.d("libwonderswan", $8_phi); $12_phi = null; if $opred != 5 goto label05; $12_phi = null; goto label06; label05: if $opred != 6 goto label06; $12_phi = "Writing eeprom"; label06: android.util.Log.d("libwonderswan", $12_phi); org.example.NativeSummaryFuncs.fclose($7); $17_phi = null; if $opred != 7 goto label07; $17_phi = "storing backup data"; goto label08; label07: if $opred != 8 goto label08; $17_phi = null; label08: android.util.Log.d("libwonderswan", $17_phi); org.example.NativeSummaryFuncs.snprintf(null, 256L, "eeprom size %d, sram size %d", null, null); $24 = org.example.NativeSummaryFuncs.fopen($p0, "w"); $25_phi = null; if $opred != 9 goto label09; $25_phi = "Writing SRAM"; goto label10; label09: if $opred != 10 goto label10; $25_phi = null; label10: android.util.Log.d("libwonderswan", $25_phi); $29_phi = null; if $opred != 11 goto label11; $29_phi = null; goto label12; label11: if $opred != 12 goto label12; $29_phi = "Writing eeprom"; label12: android.util.Log.d("libwonderswan", $29_phi); org.example.NativeSummaryFuncs.fclose($24); return; }
1 cannot find source code nsfunc_sink
com.annie.dictionary.fork_20210415.apk Source: $r3 = virtualinvoke $r2_1.<java.io.File: java.lang.String getAbsolutePath()>() Sink: $i1_1 = staticinvoke <org.example.NativeSummaryFuncs: int fopen(java.lang.String,java.lang.String)>($r0, "w")
https://github.com/namndev/QDict/blob/b3bbac3babd8e4e58e5aee4b93047d0a589182b2/qDict/src/main/cpp/QDictEng.c#L95 jboolean Java_com_annie_dictionary_QDictEng_LoadDicts(JNIEnv* env, jobject thiz, jobjectArray paths, jobjectArray names, jintArray types) { int i = 0, count = 0; char * strUTF = NULL; char ** pPaths = NULL; char ** pNames = NULL; int * pTypes = NULL; if (NULL == paths) return FALSE; count = (*env)->GetArrayLength(env, paths); if (count <= 0) return FALSE; pPaths = malloc(sizeof(char*) * count); pNames = malloc(sizeof(char*) * count); for (i = 0; i < count; i++) { strUTF = (char*) (*env)->GetStringUTFChars(env, (jstring)(*env)->GetObjectArrayElement(env, paths, i), NULL); pPaths[i] = strdup(strUTF); (*env)->ReleaseStringUTFChars(env, (jstring)(*env)->GetObjectArrayElement(env, paths, i), strUTF); strUTF = (char*) (*env)->GetStringUTFChars(env, (jstring)(*env)->GetObjectArrayElement(env, names, i), NULL); pNames[i] = strdup(strUTF); (*env)->ReleaseStringUTFChars(env, (jstring)(*env)->GetObjectArrayElement(env, names, i), strUTF); } pTypes = (int*) (*env)->GetIntArrayElements(env, types, 0); // Initialize the dict engine. DictEng_New(&g_pDictEng); DictEng_LoadDicts(g_pDictEng, pPaths, pNames, pTypes, count); (*env)->ReleaseIntArrayElements(env, types, pTypes, 0); for (i = 0; i < count; i++) { free(pPaths[i]); free(pNames[i]); } free(pPaths); free(pNames); return TRUE; }
staticinvoke <com.atelieryl.wonderdroid.WonderSwan: void savebackup(java.lang.String)>($r3) $i1 = staticinvoke <org.example.NativeSummaryFuncs: int fopen(java.lang.String,java.lang.String)>($r0, "w") $i1_1 = staticinvoke <org.example.NativeSummaryFuncs: int fopen(java.lang.String,java.lang.String)>($r0, "w")
$r3 = virtualinvoke $r2_1.<java.io.File: java.lang.String getAbsolutePath()>() staticinvoke <com.atelieryl.wonderdroid.WonderSwan: void savebackup(java.lang.String)>($r3) $r0 := @parameter0: java.lang.String $i1 = staticinvoke <org.example.NativeSummaryFuncs: int fopen(java.lang.String,java.lang.String)>($r0, "w") $i1_1 = staticinvoke <org.example.NativeSummaryFuncs: int fopen(java.lang.String,java.lang.String)>($r0, "w")
get array length of param0
public boolean LoadDicts(java.lang.String[], java.lang.String[], int[]) { com.annie.dictionary.QDictEng $this; java.lang.String[] $p0, $p1; int[] $p2; int $0, $1, $2, $49, $51, $97, $110, $opred; java.lang.String $3, $7, $10, $14; boolean $126_phi; $this := @this; $p0 := @parameter0; $p1 := @parameter1; $p2 := @parameter2; $0 = org.example.NativeSummaryFuncs.GetArrayLength(null, $p0); $1 = org.example.NativeSummaryFuncs.malloc($0); $2 = org.example.NativeSummaryFuncs.malloc($0); $3 = $p0[0]; org.example.NativeSummaryFuncs.strdup($3); $7 = $p0[0]; $10 = $p1[0]; org.example.NativeSummaryFuncs.strdup($10); $14 = $p1[0]; org.example.NativeSummaryFuncs.malloc(16L); org.example.NativeSummaryFuncs.free(null); org.example.NativeSummaryFuncs.free(null); org.example.NativeSummaryFuncs.free(null); org.example.NativeSummaryFuncs.free(null); org.example.NativeSummaryFuncs.free(null); org.example.NativeSummaryFuncs.free(null); org.example.NativeSummaryFuncs.fclose(null); org.example.NativeSummaryFuncs.free(null); org.example.NativeSummaryFuncs.free(null); org.example.NativeSummaryFuncs.free(null); org.example.NativeSummaryFuncs.fclose(null); org.example.NativeSummaryFuncs.free(null); org.example.NativeSummaryFuncs.free(null); org.example.NativeSummaryFuncs.free(null); org.example.NativeSummaryFuncs.free(null); org.example.NativeSummaryFuncs.free(null); org.example.NativeSummaryFuncs.free(null); org.example.NativeSummaryFuncs.free(null); org.example.NativeSummaryFuncs.free(null); org.example.NativeSummaryFuncs.close(null); org.example.NativeSummaryFuncs.free(null); org.example.NativeSummaryFuncs.free(null); org.example.NativeSummaryFuncs.malloc($0); org.example.NativeSummaryFuncs.strdup(null); org.example.NativeSummaryFuncs.strdup(null); org.example.NativeSummaryFuncs.malloc(2184L); org.example.NativeSummaryFuncs.malloc(392L); org.example.NativeSummaryFuncs.malloc(null); org.example.NativeSummaryFuncs.stat(null, null); $49 = org.example.NativeSummaryFuncs.malloc(null); $51 = org.example.NativeSummaryFuncs.fopen(null, "rb"); org.example.NativeSummaryFuncs.fread($49, null, 1L, $51); org.example.NativeSummaryFuncs.fclose($51); org.example.NativeSummaryFuncs.malloc(null); org.example.NativeSummaryFuncs.malloc(null); org.example.NativeSummaryFuncs.free(null); org.example.NativeSummaryFuncs.free(null); org.example.NativeSummaryFuncs.free(null); org.example.NativeSummaryFuncs.free($49); org.example.NativeSummaryFuncs.fopen(null, "rb"); org.example.NativeSummaryFuncs.close(null); org.example.NativeSummaryFuncs.malloc(null); org.example.NativeSummaryFuncs.close(null); org.example.NativeSummaryFuncs.fread(null, 264L, 1L, null); org.example.NativeSummaryFuncs.fread(null, 264L, 1L, null); org.example.NativeSummaryFuncs.fread(null, 264L, 1L, null); org.example.NativeSummaryFuncs.free(null); org.example.NativeSummaryFuncs.malloc(null); org.example.NativeSummaryFuncs.fread(null, 1L, null, null); org.example.NativeSummaryFuncs.stat(null, null); org.example.NativeSummaryFuncs.malloc(2184L); org.example.NativeSummaryFuncs.fopen(null, "rb"); org.example.NativeSummaryFuncs.close(null); org.example.NativeSummaryFuncs.malloc(null); org.example.NativeSummaryFuncs.fread(null, 264L, 1L, null); org.example.NativeSummaryFuncs.fread(null, 264L, 1L, null); org.example.NativeSummaryFuncs.fread(null, 264L, 1L, null); org.example.NativeSummaryFuncs.free(null); org.example.NativeSummaryFuncs.malloc(null); org.example.NativeSummaryFuncs.fread(null, 1L, null, null); org.example.NativeSummaryFuncs.close(null); org.example.NativeSummaryFuncs.stat(null, null); $97 = org.example.NativeSummaryFuncs.fopen(null, "rb"); org.example.NativeSummaryFuncs.stat(null, null); org.example.NativeSummaryFuncs.malloc(null); org.example.NativeSummaryFuncs.fclose($97); org.example.NativeSummaryFuncs.malloc(null); org.example.NativeSummaryFuncs.fclose($97); org.example.NativeSummaryFuncs.close(null); org.example.NativeSummaryFuncs.stat(null, null); $110 = org.example.NativeSummaryFuncs.fopen(null, "rb"); org.example.NativeSummaryFuncs.stat(null, null); org.example.NativeSummaryFuncs.malloc(null); org.example.NativeSummaryFuncs.fclose($110); org.example.NativeSummaryFuncs.malloc(null); org.example.NativeSummaryFuncs.fclose($110); org.example.NativeSummaryFuncs.free(null); org.example.NativeSummaryFuncs.free(null); org.example.NativeSummaryFuncs.free(null); org.example.NativeSummaryFuncs.free($1); org.example.NativeSummaryFuncs.free($2); $126_phi = 0; $opred = org.example.NativeSummaryAux.opaqueInt(); if $opred != 1 goto label1; $126_phi = 1L; goto label2; label1: if $opred != 2 goto label2; $126_phi = null; label2: return $126_phi; }
1 get array length of parameter0 nsfunc_sink
net.kollnig.missioncontrol.fdroid_2022102501.apk Source: $i2 = virtualinvoke $r4.<android.os.ParcelFileDescriptor: int getFd()>() Sink: staticinvoke <org.example.NativeSummaryFuncs: int write(int,java.lang.Object,java.lang.Object)>($i3_11, null, null)
https://github.com/M66B/NetGuard/blob/1f56b996f54d5fa515e3f193a49da1d1b4df871a/app/src/main/jni/netguard/netguard.c#L155 JNIEXPORT void JNICALL Java_eu_faircode_netguard_ServiceSinkhole_jni_1run( JNIEnv *env, jobject instance, jlong context, jint tun, jboolean fwd53, jint rcode) { struct context *ctx = (struct context *) context; log_android(ANDROID_LOG_WARN, "Running tun %d fwd53 %d level %d", tun, fwd53, loglevel); // Set blocking int flags = fcntl(tun, F_GETFL, 0); if (flags < 0 || fcntl(tun, F_SETFL, flags & ~O_NONBLOCK) < 0) log_android(ANDROID_LOG_ERROR, "fcntl tun ~O_NONBLOCK error %d: %s", errno, strerror(errno)); // Get arguments struct arguments *args = ng_malloc(sizeof(struct arguments), "arguments"); args->env = env; args->instance = instance; args->tun = tun; args->fwd53 = fwd53; args->rcode = rcode; args->ctx = ctx; handle_events(args); } void *handle_events(void *a) { struct arguments *args = (struct arguments *) a; log_android(ANDROID_LOG_WARN, "Start events tun=%d", args->tun); // Get max number of sessions int maxsessions = SESSION_MAX; struct rlimit rlim; if (getrlimit(RLIMIT_NOFILE, &rlim)) log_android(ANDROID_LOG_WARN, "getrlimit error %d: %s", errno, strerror(errno)); else { maxsessions = (int) (rlim.rlim_cur * SESSION_LIMIT / 100); if (maxsessions > SESSION_MAX) maxsessions = SESSION_MAX; log_android(ANDROID_LOG_WARN, "getrlimit soft %d hard %d max sessions %d", rlim.rlim_cur, rlim.rlim_max, maxsessions); } // Terminate existing sessions not allowed anymore check_allowed(args); // Open epoll file int epoll_fd = epoll_create(1); if (epoll_fd < 0) { log_android(ANDROID_LOG_ERROR, "epoll create error %d: %s", errno, strerror(errno)); report_exit(args, "epoll create error %d: %s", errno, strerror(errno)); args->ctx->stopping = 1; } // Monitor stop events struct epoll_event ev_pipe; memset(&ev_pipe, 0, sizeof(struct epoll_event)); ev_pipe.events = EPOLLIN | EPOLLERR; ev_pipe.data.ptr = &ev_pipe; if (epoll_ctl(epoll_fd, EPOLL_CTL_ADD, args->ctx->pipefds[0], &ev_pipe)) { log_android(ANDROID_LOG_ERROR, "epoll add pipe error %d: %s", errno, strerror(errno)); report_exit(args, "epoll add pipe error %d: %s", errno, strerror(errno)); args->ctx->stopping = 1; } // Monitor tun events struct epoll_event ev_tun; memset(&ev_tun, 0, sizeof(struct epoll_event)); ev_tun.events = EPOLLIN | EPOLLERR; ev_tun.data.ptr = NULL; if (epoll_ctl(epoll_fd, EPOLL_CTL_ADD, args->tun, &ev_tun)) { log_android(ANDROID_LOG_ERROR, "epoll add tun error %d: %s", errno, strerror(errno)); report_exit(args, "epoll add tun error %d: %s", errno, strerror(errno)); args->ctx->stopping = 1; } // Loop long long last_check = 0; while (!args->ctx->stopping) { log_android(ANDROID_LOG_DEBUG, "Loop"); int recheck = 0; int timeout = EPOLL_TIMEOUT; // Count sessions int isessions = 0; int usessions = 0; int tsessions = 0; struct ng_session *s = args->ctx->ng_session; while (s != NULL) { if (s->protocol == IPPROTO_ICMP || s->protocol == IPPROTO_ICMPV6) { if (!s->icmp.stop) isessions++; } else if (s->protocol == IPPROTO_UDP) { if (s->udp.state == UDP_ACTIVE) usessions++; } else if (s->protocol == IPPROTO_TCP) { if (s->tcp.state != TCP_CLOSING && s->tcp.state != TCP_CLOSE) tsessions++; if (s->socket >= 0) recheck = recheck | monitor_tcp_session(args, s, epoll_fd); } s = s->next; } int sessions = isessions + usessions + tsessions; // Check sessions long long ms = get_ms(); if (ms - last_check > EPOLL_MIN_CHECK) { last_check = ms; time_t now = time(NULL); struct ng_session *sl = NULL; s = args->ctx->ng_session; while (s != NULL) { int del = 0; if (s->protocol == IPPROTO_ICMP || s->protocol == IPPROTO_ICMPV6) { del = check_icmp_session(args, s, sessions, maxsessions); if (!s->icmp.stop && !del) { int stimeout = s->icmp.time + get_icmp_timeout(&s->icmp, sessions, maxsessions) - now + 1; if (stimeout > 0 && stimeout < timeout) timeout = stimeout; } } else if (s->protocol == IPPROTO_UDP) { del = check_udp_session(args, s, sessions, maxsessions); if (s->udp.state == UDP_ACTIVE && !del) { int stimeout = s->udp.time + get_udp_timeout(&s->udp, sessions, maxsessions) - now + 1; if (stimeout > 0 && stimeout < timeout) timeout = stimeout; } } else if (s->protocol == IPPROTO_TCP) { del = check_tcp_session(args, s, sessions, maxsessions); if (s->tcp.state != TCP_CLOSING && s->tcp.state != TCP_CLOSE && !del) { int stimeout = s->tcp.time + get_tcp_timeout(&s->tcp, sessions, maxsessions) - now + 1; if (stimeout > 0 && stimeout < timeout) timeout = stimeout; } } if (del) { if (sl == NULL) args->ctx->ng_session = s->next; else sl->next = s->next; struct ng_session *c = s; s = s->next; if (c->protocol == IPPROTO_TCP) clear_tcp_data(&c->tcp); ng_free(c, __FILE__, __LINE__); } else { sl = s; s = s->next; } } } else { recheck = 1; log_android(ANDROID_LOG_DEBUG, "Skipped session checks"); } log_android(ANDROID_LOG_DEBUG, "sessions ICMP %d UDP %d TCP %d max %d/%d timeout %d recheck %d", isessions, usessions, tsessions, sessions, maxsessions, timeout, recheck); // Poll struct epoll_event ev[EPOLL_EVENTS]; int ready = epoll_wait(epoll_fd, ev, EPOLL_EVENTS, recheck ? EPOLL_MIN_CHECK : timeout * 1000); if (ready < 0) { if (errno == EINTR) { log_android(ANDROID_LOG_DEBUG, "epoll interrupted tun %d", args->tun); continue; } else { log_android(ANDROID_LOG_ERROR, "epoll tun %d error %d: %s", args->tun, errno, strerror(errno)); report_exit(args, "epoll tun %d error %d: %s", args->tun, errno, strerror(errno)); break; } } if (ready == 0) log_android(ANDROID_LOG_DEBUG, "epoll timeout"); else { if (pthread_mutex_lock(&args->ctx->lock)) log_android(ANDROID_LOG_ERROR, "pthread_mutex_lock failed"); int error = 0; for (int i = 0; i < ready; i++) { if (ev[i].data.ptr == &ev_pipe) { // Check pipe uint8_t buffer[1]; if (read(args->ctx->pipefds[0], buffer, 1) < 0) log_android(ANDROID_LOG_WARN, "Read pipe error %d: %s", errno, strerror(errno)); else log_android(ANDROID_LOG_WARN, "Read pipe"); } else if (ev[i].data.ptr == NULL) { // Check upstream log_android(ANDROID_LOG_DEBUG, "epoll ready %d/%d in %d out %d err %d hup %d", i, ready, (ev[i].events & EPOLLIN) != 0, (ev[i].events & EPOLLOUT) != 0, (ev[i].events & EPOLLERR) != 0, (ev[i].events & EPOLLHUP) != 0); int count = 0; while (count < TUN_YIELD && !error && !args->ctx->stopping && is_readable(args->tun)) { count++; if (check_tun(args, &ev[i], epoll_fd, sessions, maxsessions) < 0) error = 1; } } else { // Check downstream log_android(ANDROID_LOG_DEBUG, "epoll ready %d/%d in %d out %d err %d hup %d prot %d sock %d", i, ready, (ev[i].events & EPOLLIN) != 0, (ev[i].events & EPOLLOUT) != 0, (ev[i].events & EPOLLERR) != 0, (ev[i].events & EPOLLHUP) != 0, ((struct ng_session *) ev[i].data.ptr)->protocol, ((struct ng_session *) ev[i].data.ptr)->socket); struct ng_session *session = (struct ng_session *) ev[i].data.ptr; if (session->protocol == IPPROTO_ICMP || session->protocol == IPPROTO_ICMPV6) check_icmp_socket(args, &ev[i]); else if (session->protocol == IPPROTO_UDP) { int count = 0; while (count < UDP_YIELD && !args->ctx->stopping && !(ev[i].events & EPOLLERR) && (ev[i].events & EPOLLIN) && is_readable(session->socket)) { count++; check_udp_socket(args, &ev[i]); } } else if (session->protocol == IPPROTO_TCP) check_tcp_socket(args, &ev[i], epoll_fd); } if (error) break; } if (pthread_mutex_unlock(&args->ctx->lock)) log_android(ANDROID_LOG_ERROR, "pthread_mutex_unlock failed"); if (error) break; } } // Close epoll file if (epoll_fd >= 0 && close(epoll_fd)) log_android(ANDROID_LOG_ERROR, "epoll close error %d: %s", errno, strerror(errno)); log_android(ANDROID_LOG_WARN, "Stopped events tun=%d", args->tun); // Cleanup ng_free(args, __FILE__, __LINE__); return NULL; }
specialinvoke $r0.<eu.faircode.netguard.ServiceSinkhole: void jni_run(long,int,boolean,int)>($l0, $i1, $z0, $i2) staticinvoke <org.example.NativeSummaryFuncs: int write(int,java.lang.Object,java.lang.Object)>($i3_11, null, null)
$i2 = virtualinvoke $r4.<android.os.ParcelFileDescriptor: int getFd()>() staticinvoke <eu.faircode.netguard.ServiceSinkhole: void access$3700(eu.faircode.netguard.ServiceSinkhole,long,int,boolean,int)>($r1, $l1_1, $i2, $z0, $i0) $i1 := @parameter2: int specialinvoke $r0.<eu.faircode.netguard.ServiceSinkhole: void jni_run(long,int,boolean,int)>($l0, $i1, $z0, $i2) $i1 := @parameter1: int $i3_11 = $i1 staticinvoke <org.example.NativeSummaryFuncs: int write(int,java.lang.Object,java.lang.Object)>($i3_11, null, null)
param1 tun -> write
private void jni_run(long, int, boolean, int) { long $p0; int $p1, $p3, $opred, $222_phi, $380_phi, $515_phi, $752_phi, $778_phi, $790_phi, $797_phi, $807_phi, $825_phi, $839, $859_phi, $875, $887_phi, $893_phi, $905, $953, $954_phi, $1087; java.lang.String $0_phi, $4_phi, $9_phi, $13_phi, $17_phi, $21_phi, $27_phi, $36_phi, $45_phi, $50_phi, $55_phi, $60_phi, $65_phi, $70_phi, $75_phi, $80_phi, $85_phi, $90_phi, $95_phi, $122_phi, $136_phi, $141_phi, $218_phi, $224_phi, $228_phi, $233_phi, $237_phi, $241_phi, $249_phi, $316_phi, $320_phi, $326_phi, $345_phi, $366_phi, $370_phi, $374_phi, $386_phi, $390_phi, $394_phi, $398_phi, $402_phi, $406_phi, $410_phi, $415_phi, $421_phi, $430_phi, $439_phi, $448_phi, $453_phi, $458_phi, $463_phi, $468_phi, $475_phi, $500_phi, $505_phi, $509_phi, $520_phi, $524_phi, $531_phi, $535_phi, $539_phi, $543_phi, $547_phi, $551_phi, $556_phi, $561_phi, $565_phi, $569_phi, $573_phi, $577_phi, $581_phi, $585_phi, $589_phi, $593_phi, $597_phi, $604_phi, $613_phi, $622_phi, $631_phi, $636_phi, $641_phi, $646_phi, $651_phi, $673_phi, $677_phi, $681_phi, $685_phi, $689_phi, $693_phi, $697_phi, $703_phi, $710_phi, $718_phi, $722_phi, $728_phi, $732_phi, $736_phi, $742_phi, $746_phi, $756_phi, $760_phi, $764_phi, $768_phi, $772_phi, $782_phi, $801_phi, $811_phi, $815_phi, $819_phi, $830_phi, $835_phi, $840_phi, $845_phi, $849_phi, $853_phi, $864_phi, $869_phi, $876_phi, $881_phi, $897_phi, $901_phi, $906_phi, $910_phi, $914_phi, $920_phi, $927_phi, $935_phi, $940_phi, $945_phi, $949_phi, $956_phi, $980_phi, $984_phi, $988_phi, $992_phi, $996_phi, $1000_phi, $1004_phi, $1008_phi, $1012_phi, $1017_phi, $1021_phi, $1023_phi, $1031_phi, $1037_phi, $1041_phi, $1053_phi, $1058_phi, $1062_phi, $1066_phi, $1070_phi, $1075_phi, $1079_phi, $1083_phi, $1092_phi, $1095_phi, $1099_phi, $1103_phi, $1107_phi, $1111_phi; boolean $p2; eu.faircode.netguard.ServiceSinkhole $this; $this := @this; $p0 := @parameter0; $p1 := @parameter1; $p2 := @parameter2; $p3 := @parameter3; $0_phi = null; $opred = org.example.NativeSummaryAux.opaqueInt(); if $opred != 1 goto label001; $0_phi = null; goto label002; label001: if $opred != 2 goto label002; $0_phi = "%s"; label002: android.util.Log.w("TrackerControl.JNI", $0_phi); $4_phi = null; if $opred != 3 goto label003; $4_phi = null; goto label004; label003: if $opred != 4 goto label004; $4_phi = "%s"; label004: android.util.Log.e("TrackerControl.JNI", $4_phi); org.example.NativeSummaryFuncs.malloc(40L); $9_phi = null; if $opred != 5 goto label005; $9_phi = null; goto label006; label005: if $opred != 6 goto label006; $9_phi = "%s"; label006: android.util.Log.w("TrackerControl.JNI", $9_phi); $13_phi = null; if $opred != 7 goto label007; $13_phi = null; goto label008; label007: if $opred != 8 goto label008; $13_phi = "%s"; label008: android.util.Log.w("TrackerControl.JNI", $13_phi); $17_phi = null; if $opred != 9 goto label009; $17_phi = null; goto label010; label009: if $opred != 10 goto label010; $17_phi = "%s"; label010: android.util.Log.w("TrackerControl.JNI", $17_phi); $21_phi = null; if $opred != 11 goto label011; $21_phi = null; goto label012; label011: if $opred != 12 goto label012; $21_phi = "%s"; label012: android.util.Log.w("TrackerControl.JNI", $21_phi); org.example.NativeSummaryFuncs.free(null); $27_phi = null; if $opred != 13 goto label013; $27_phi = null; goto label014; label013: if $opred != 14 goto label014; $27_phi = "%s"; label014: android.util.Log.e("TrackerControl.JNI", $27_phi); org.example.NativeSummaryFuncs.ExceptionOccurred(null); org.example.NativeSummaryFuncs.ExceptionDescribe(null); org.example.NativeSummaryFuncs.ExceptionClear(null); $36_phi = null; if $opred != 15 goto label015; $36_phi = null; goto label016; label015: if $opred != 16 goto label016; $36_phi = "%s"; label016: android.util.Log.e("TrackerControl.JNI", $36_phi); org.example.NativeSummaryFuncs.ExceptionOccurred(null); org.example.NativeSummaryFuncs.ExceptionDescribe(null); org.example.NativeSummaryFuncs.ExceptionClear(null); $45_phi = null; if $opred != 17 goto label017; $45_phi = null; goto label018; label017: if $opred != 18 goto label018; $45_phi = "%s"; label018: android.util.Log.e("TrackerControl.JNI", $45_phi); $50_phi = null; if $opred != 19 goto label019; $50_phi = null; goto label020; label019: if $opred != 20 goto label020; $50_phi = "%s"; label020: android.util.Log.e("TrackerControl.JNI", $50_phi); $55_phi = null; if $opred != 21 goto label021; $55_phi = null; goto label022; label021: if $opred != 22 goto label022; $55_phi = "%s"; label022: android.util.Log.e("TrackerControl.JNI", $55_phi); $60_phi = null; if $opred != 23 goto label023; $60_phi = null; goto label024; label023: if $opred != 24 goto label024; $60_phi = "%s"; label024: android.util.Log.e("TrackerControl.JNI", $60_phi); $65_phi = null; if $opred != 25 goto label025; $65_phi = null; goto label026; label025: if $opred != 26 goto label026; $65_phi = "%s"; label026: android.util.Log.e("TrackerControl.JNI", $65_phi); $70_phi = null; if $opred != 27 goto label027; $70_phi = null; goto label028; label027: if $opred != 28 goto label028; $70_phi = "%s"; label028: android.util.Log.e("TrackerControl.JNI", $70_phi); $75_phi = null; if $opred != 29 goto label029; $75_phi = null; goto label030; label029: if $opred != 30 goto label030; $75_phi = "%s"; label030: android.util.Log.e("TrackerControl.JNI", $75_phi); $80_phi = null; if $opred != 31 goto label031; $80_phi = null; goto label032; label031: if $opred != 32 goto label032; $80_phi = "%s"; label032: android.util.Log.e("TrackerControl.JNI", $80_phi); $85_phi = null; if $opred != 33 goto label033; $85_phi = null; goto label034; label033: if $opred != 34 goto label034; $85_phi = "%s"; label034: android.util.Log.e("TrackerControl.JNI", $85_phi); $90_phi = null; if $opred != 35 goto label035; $90_phi = null; goto label036; label035: if $opred != 36 goto label036; $90_phi = "%s"; label036: android.util.Log.e("TrackerControl.JNI", $90_phi); $95_phi = null; if $opred != 37 goto label037; $95_phi = null; goto label038; label037: if $opred != 38 goto label038; $95_phi = "%s"; label038: android.util.Log.e("TrackerControl.JNI", $95_phi); $122_phi = null; if $opred != 39 goto label039; $122_phi = null; goto label040; label039: if $opred != 40 goto label040; $122_phi = "%s"; label040: android.util.Log.e("TrackerControl.JNI", $122_phi); org.example.NativeSummaryFuncs.ExceptionOccurred(null); org.example.NativeSummaryFuncs.ExceptionDescribe(null); org.example.NativeSummaryFuncs.ExceptionClear(null); org.example.NativeSummaryFuncs.ExceptionOccurred(null); org.example.NativeSummaryFuncs.ExceptionDescribe(null); org.example.NativeSummaryFuncs.ExceptionClear(null); $136_phi = null; if $opred != 41 goto label041; $136_phi = null; goto label042; label041: if $opred != 42 goto label042; $136_phi = "%s"; label042: android.util.Log.e("TrackerControl.JNI", $136_phi); $141_phi = null; if $opred != 43 goto label043; $141_phi = null; goto label044; label043: if $opred != 44 goto label044; $141_phi = "%s"; label044: android.util.Log.e("TrackerControl.JNI", $141_phi); org.example.NativeSummaryFuncs.ExceptionOccurred(null); org.example.NativeSummaryFuncs.ExceptionDescribe(null); org.example.NativeSummaryFuncs.ExceptionClear(null); org.example.NativeSummaryFuncs.ExceptionOccurred(null); org.example.NativeSummaryFuncs.ExceptionDescribe(null); org.example.NativeSummaryFuncs.ExceptionClear(null); org.example.NativeSummaryFuncs.ExceptionOccurred(null); org.example.NativeSummaryFuncs.ExceptionDescribe(null); org.example.NativeSummaryFuncs.ExceptionClear(null); org.example.NativeSummaryFuncs.ExceptionOccurred(null); org.example.NativeSummaryFuncs.ExceptionDescribe(null); org.example.NativeSummaryFuncs.ExceptionClear(null); org.example.NativeSummaryFuncs.malloc(40L); org.example.NativeSummaryFuncs.malloc(60L); $218_phi = null; if $opred != 45 goto label045; $218_phi = null; goto label046; label045: if $opred != 46 goto label046; $218_phi = "%s"; label046: android.util.Log.d("TrackerControl.JNI", $218_phi); $222_phi = 0; if $opred != 47 goto label047; $222_phi = null; goto label048; label047: if $opred != 48 goto label048; $222_phi = $p1; label048: org.example.NativeSummaryFuncs.write($222_phi, null, null); $224_phi = null; if $opred != 49 goto label049; $224_phi = null; goto label050; label049: if $opred != 50 goto label050; $224_phi = "%s"; label050: android.util.Log.e("TrackerControl.JNI", $224_phi); $228_phi = null; if $opred != 51 goto label051; $228_phi = null; goto label052; label051: if $opred != 52 goto label052; $228_phi = "%s"; label052: android.util.Log.e("TrackerControl.JNI", $228_phi); org.example.NativeSummaryFuncs.malloc(80L); $233_phi = null; if $opred != 53 goto label053; $233_phi = null; goto label054; label053: if $opred != 54 goto label054; $233_phi = "%s"; label054: android.util.Log.d("TrackerControl.JNI", $233_phi); $237_phi = null; if $opred != 55 goto label055; $237_phi = null; goto label056; label055: if $opred != 56 goto label056; $237_phi = "%s"; label056: android.util.Log.w("TrackerControl.JNI", $237_phi); $241_phi = null; if $opred != 57 goto label057; $241_phi = null; goto label058; label057: if $opred != 58 goto label058; $241_phi = "%s"; label058: android.util.Log.e("TrackerControl.JNI", $241_phi); org.example.NativeSummaryFuncs.free(null); org.example.NativeSummaryFuncs.free(null); $249_phi = null; if $opred != 59 goto label059; $249_phi = null; goto label060; label059: if $opred != 60 goto label060; $249_phi = "%s"; label060: android.util.Log.e("TrackerControl.JNI", $249_phi); org.example.NativeSummaryFuncs.ExceptionOccurred(null); org.example.NativeSummaryFuncs.ExceptionDescribe(null); org.example.NativeSummaryFuncs.ExceptionClear(null); org.example.NativeSummaryFuncs.ExceptionOccurred(null); org.example.NativeSummaryFuncs.ExceptionDescribe(null); org.example.NativeSummaryFuncs.ExceptionClear(null); org.example.NativeSummaryFuncs.ExceptionOccurred(null); org.example.NativeSummaryFuncs.ExceptionDescribe(null); org.example.NativeSummaryFuncs.ExceptionClear(null); org.example.NativeSummaryFuncs.ExceptionOccurred(null); org.example.NativeSummaryFuncs.ExceptionDescribe(null); org.example.NativeSummaryFuncs.ExceptionClear(null); $316_phi = null; if $opred != 61 goto label061; $316_phi = null; goto label062; label061: if $opred != 62 goto label062; $316_phi = "%s"; label062: android.util.Log.w("TrackerControl.JNI", $316_phi); $320_phi = null; if $opred != 63 goto label063; $320_phi = null; goto label064; label063: if $opred != 64 goto label064; $320_phi = "%s"; label064: android.util.Log.e("TrackerControl.JNI", $320_phi); $326_phi = null; if $opred != 65 goto label065; $326_phi = null; goto label066; label065: if $opred != 66 goto label066; $326_phi = "%s"; label066: android.util.Log.e("TrackerControl.JNI", $326_phi); org.example.NativeSummaryFuncs.ExceptionOccurred(null); org.example.NativeSummaryFuncs.ExceptionDescribe(null); org.example.NativeSummaryFuncs.ExceptionClear(null); org.example.NativeSummaryFuncs.ExceptionOccurred(null); org.example.NativeSummaryFuncs.ExceptionDescribe(null); org.example.NativeSummaryFuncs.ExceptionClear(null); $345_phi = null; if $opred != 72 goto label067; $345_phi = null; goto label068; label067: if $opred != 73 goto label068; $345_phi = "%s"; label068: android.util.Log.e("TrackerControl.JNI", $345_phi); org.example.NativeSummaryFuncs.ExceptionOccurred(null); org.example.NativeSummaryFuncs.ExceptionDescribe(null); org.example.NativeSummaryFuncs.ExceptionClear(null); org.example.NativeSummaryFuncs.ExceptionOccurred(null); org.example.NativeSummaryFuncs.ExceptionDescribe(null); org.example.NativeSummaryFuncs.ExceptionClear(null); $366_phi = null; if $opred != 79 goto label069; $366_phi = null; goto label070; label069: if $opred != 80 goto label070; $366_phi = "%s"; label070: android.util.Log.d("TrackerControl.JNI", $366_phi); $370_phi = null; if $opred != 81 goto label071; $370_phi = null; goto label072; label071: if $opred != 82 goto label072; $370_phi = "%s"; label072: android.util.Log.d("TrackerControl.JNI", $370_phi); $374_phi = null; if $opred != 83 goto label073; $374_phi = null; goto label074; label073: if $opred != 84 goto label074; $374_phi = "%s"; label074: android.util.Log.w("TrackerControl.JNI", $374_phi); org.example.NativeSummaryFuncs.malloc(40L); org.example.NativeSummaryFuncs.malloc(60L); $380_phi = 0; if $opred != 85 goto label075; $380_phi = null; goto label076; label075: if $opred != 86 goto label076; $380_phi = $p1; label076: org.example.NativeSummaryFuncs.write($380_phi, null, null); org.example.NativeSummaryFuncs.free(null); $386_phi = null; if $opred != 89 goto label077; $386_phi = null; goto label078; label077: if $opred != 90 goto label078; $386_phi = "%s"; label078: android.util.Log.w("TrackerControl.JNI", $386_phi); $390_phi = null; if $opred != 91 goto label079; $390_phi = null; goto label080; label079: if $opred != 92 goto label080; $390_phi = "%s"; label080: android.util.Log.d("TrackerControl.JNI", $390_phi); $394_phi = null; if $opred != 93 goto label081; $394_phi = null; goto label082; label081: if $opred != 94 goto label082; $394_phi = "%s"; label082: android.util.Log.e("TrackerControl.JNI", $394_phi); $398_phi = null; if $opred != 95 goto label083; $398_phi = null; goto label084; label083: if $opred != 96 goto label084; $398_phi = "%s"; label084: android.util.Log.d("TrackerControl.JNI", $398_phi); $402_phi = null; if $opred != 97 goto label085; $402_phi = null; goto label086; label085: if $opred != 98 goto label086; $402_phi = "%s"; label086: android.util.Log.d("TrackerControl.JNI", $402_phi); $406_phi = null; if $opred != 99 goto label087; $406_phi = null; goto label088; label087: if $opred != 100 goto label088; $406_phi = "%s"; label088: android.util.Log.w("TrackerControl.JNI", $406_phi); $410_phi = null; if $opred != 101 goto label089; $410_phi = null; goto label090; label089: if $opred != 102 goto label090; $410_phi = "%s"; label090: android.util.Log.i("TrackerControl.JNI", $410_phi); org.example.NativeSummaryFuncs.close(null); $415_phi = null; if $opred != 103 goto label091; $415_phi = null; goto label092; label091: if $opred != 104 goto label092; $415_phi = "%s"; label092: android.util.Log.e("TrackerControl.JNI", $415_phi); $421_phi = null; if $opred != 105 goto label093; $421_phi = null; goto label094; label093: if $opred != 106 goto label094; $421_phi = "%s"; label094: android.util.Log.e("TrackerControl.JNI", $421_phi); org.example.NativeSummaryFuncs.ExceptionOccurred(null); org.example.NativeSummaryFuncs.ExceptionDescribe(null); org.example.NativeSummaryFuncs.ExceptionClear(null); $430_phi = null; if $opred != 107 goto label095; $430_phi = null; goto label096; label095: if $opred != 108 goto label096; $430_phi = "%s"; label096: android.util.Log.e("TrackerControl.JNI", $430_phi); org.example.NativeSummaryFuncs.ExceptionOccurred(null); org.example.NativeSummaryFuncs.ExceptionDescribe(null); org.example.NativeSummaryFuncs.ExceptionClear(null); $439_phi = null; if $opred != 109 goto label097; $439_phi = null; goto label098; label097: if $opred != 110 goto label098; $439_phi = "%s"; label098: android.util.Log.e("TrackerControl.JNI", $439_phi); org.example.NativeSummaryFuncs.ExceptionOccurred(null); org.example.NativeSummaryFuncs.ExceptionDescribe(null); org.example.NativeSummaryFuncs.ExceptionClear(null); $448_phi = null; if $opred != 111 goto label099; $448_phi = null; goto label100; label099: if $opred != 112 goto label100; $448_phi = "%s"; label100: android.util.Log.e("TrackerControl.JNI", $448_phi); $453_phi = null; if $opred != 113 goto label101; $453_phi = null; goto label102; label101: if $opred != 114 goto label102; $453_phi = "%s"; label102: android.util.Log.e("TrackerControl.JNI", $453_phi); $458_phi = null; if $opred != 115 goto label103; $458_phi = null; goto label104; label103: if $opred != 116 goto label104; $458_phi = "%s"; label104: android.util.Log.e("TrackerControl.JNI", $458_phi); $463_phi = null; if $opred != 117 goto label105; $463_phi = null; goto label106; label105: if $opred != 118 goto label106; $463_phi = "%s"; label106: android.util.Log.e("TrackerControl.JNI", $463_phi); $468_phi = null; if $opred != 119 goto label107; $468_phi = null; goto label108; label107: if $opred != 120 goto label108; $468_phi = "%s"; label108: android.util.Log.e("TrackerControl.JNI", $468_phi); $475_phi = null; if $opred != 121 goto label109; $475_phi = null; goto label110; label109: if $opred != 122 goto label110; $475_phi = "%s"; label110: android.util.Log.e("TrackerControl.JNI", $475_phi); org.example.NativeSummaryFuncs.ExceptionOccurred(null); org.example.NativeSummaryFuncs.ExceptionDescribe(null); org.example.NativeSummaryFuncs.ExceptionClear(null); $500_phi = null; if $opred != 125 goto label111; $500_phi = null; goto label112; label111: if $opred != 126 goto label112; $500_phi = "%s"; label112: android.util.Log.w("TrackerControl.JNI", $500_phi); org.example.NativeSummaryFuncs.close(null); $505_phi = null; if $opred != 127 goto label113; $505_phi = null; goto label114; label113: if $opred != 128 goto label114; $505_phi = "%s"; label114: android.util.Log.e("TrackerControl.JNI", $505_phi); $509_phi = null; if $opred != 129 goto label115; $509_phi = null; goto label116; label115: if $opred != 130 goto label116; $509_phi = "%s"; label116: android.util.Log.w("TrackerControl.JNI", $509_phi); org.example.NativeSummaryFuncs.malloc(40L); org.example.NativeSummaryFuncs.malloc(60L); $515_phi = 0; if $opred != 131 goto label117; $515_phi = null; goto label118; label117: if $opred != 132 goto label118; $515_phi = $p1; label118: org.example.NativeSummaryFuncs.write($515_phi, null, null); org.example.NativeSummaryFuncs.free(null); org.example.NativeSummaryFuncs.close(null); $520_phi = null; if $opred != 133 goto label119; $520_phi = null; goto label120; label119: if $opred != 134 goto label120; $520_phi = "%s"; label120: android.util.Log.w("TrackerControl.JNI", $520_phi); $524_phi = null; if $opred != 135 goto label121; $524_phi = null; goto label122; label121: if $opred != 136 goto label122; $524_phi = "%s"; label122: android.util.Log.e("TrackerControl.JNI", $524_phi); org.example.NativeSummaryFuncs.free(null); org.example.NativeSummaryFuncs.free(null); org.example.NativeSummaryFuncs.free(null); $531_phi = null; if $opred != 137 goto label123; $531_phi = null; goto label124; label123: if $opred != 138 goto label124; $531_phi = "%s"; label124: android.util.Log.d("TrackerControl.JNI", $531_phi); $535_phi = null; if $opred != 139 goto label125; $535_phi = null; goto label126; label125: if $opred != 140 goto label126; $535_phi = "%s"; label126: android.util.Log.d("TrackerControl.JNI", $535_phi); $539_phi = null; if $opred != 141 goto label127; $539_phi = null; goto label128; label127: if $opred != 142 goto label128; $539_phi = "%s"; label128: android.util.Log.e("TrackerControl.JNI", $539_phi); $543_phi = null; if $opred != 143 goto label129; $543_phi = null; goto label130; label129: if $opred != 144 goto label130; $543_phi = "%s"; label130: android.util.Log.w("TrackerControl.JNI", $543_phi); $547_phi = null; if $opred != 145 goto label131; $547_phi = null; goto label132; label131: if $opred != 146 goto label132; $547_phi = "%s"; label132: android.util.Log.w("TrackerControl.JNI", $547_phi); $551_phi = null; if $opred != 147 goto label133; $551_phi = null; goto label134; label133: if $opred != 148 goto label134; $551_phi = "%s"; label134: android.util.Log.d("TrackerControl.JNI", $551_phi); org.example.NativeSummaryFuncs.poll(null, 1L, null); $556_phi = null; if $opred != 149 goto label135; $556_phi = null; goto label136; label135: if $opred != 150 goto label136; $556_phi = "%s"; label136: android.util.Log.e("TrackerControl.JNI", $556_phi); org.example.NativeSummaryFuncs.malloc(null); $561_phi = null; if $opred != 151 goto label137; $561_phi = null; goto label138; label137: if $opred != 152 goto label138; $561_phi = "%s"; label138: android.util.Log.w("TrackerControl.JNI", $561_phi); $565_phi = null; if $opred != 153 goto label139; $565_phi = null; goto label140; label139: if $opred != 154 goto label140; $565_phi = "%s"; label140: android.util.Log.i("TrackerControl.JNI", $565_phi); $569_phi = null; if $opred != 155 goto label141; $569_phi = null; goto label142; label141: if $opred != 156 goto label142; $569_phi = "%s"; label142: android.util.Log.w("TrackerControl.JNI", $569_phi); $573_phi = null; if $opred != 157 goto label143; $573_phi = null; goto label144; label143: if $opred != 158 goto label144; $573_phi = "%s"; label144: android.util.Log.d("TrackerControl.JNI", $573_phi); $577_phi = null; if $opred != 159 goto label145; $577_phi = null; goto label146; label145: if $opred != 160 goto label146; $577_phi = "%s"; label146: android.util.Log.w("TrackerControl.JNI", $577_phi); $581_phi = null; if $opred != 161 goto label147; $581_phi = null; goto label148; label147: if $opred != 162 goto label148; $581_phi = "%s"; label148: android.util.Log.d("TrackerControl.JNI", $581_phi); $585_phi = null; if $opred != 163 goto label149; $585_phi = null; goto label150; label149: if $opred != 164 goto label150; $585_phi = "%s"; label150: android.util.Log.d("TrackerControl.JNI", $585_phi); $589_phi = null; if $opred != 165 goto label151; $589_phi = null; goto label152; label151: if $opred != 166 goto label152; $589_phi = "%s"; label152: android.util.Log.d("TrackerControl.JNI", $589_phi); $593_phi = null; if $opred != 167 goto label153; $593_phi = null; goto label154; label153: if $opred != 168 goto label154; $593_phi = "%s"; label154: android.util.Log.e("TrackerControl.JNI", $593_phi); $597_phi = null; if $opred != 169 goto label155; $597_phi = null; goto label156; label155: if $opred != 170 goto label156; $597_phi = "%s"; label156: android.util.Log.d("TrackerControl.JNI", $597_phi); $604_phi = null; if $opred != 171 goto label157; $604_phi = null; goto label158; label157: if $opred != 172 goto label158; $604_phi = "%s"; label158: android.util.Log.e("TrackerControl.JNI", $604_phi); org.example.NativeSummaryFuncs.ExceptionOccurred(null); org.example.NativeSummaryFuncs.ExceptionDescribe(null); org.example.NativeSummaryFuncs.ExceptionClear(null); $613_phi = null; if $opred != 173 goto label159; $613_phi = null; goto label160; label159: if $opred != 174 goto label160; $613_phi = "%s"; label160: android.util.Log.e("TrackerControl.JNI", $613_phi); org.example.NativeSummaryFuncs.ExceptionOccurred(null); org.example.NativeSummaryFuncs.ExceptionDescribe(null); org.example.NativeSummaryFuncs.ExceptionClear(null); $622_phi = null; if $opred != 175 goto label161; $622_phi = null; goto label162; label161: if $opred != 176 goto label162; $622_phi = "%s"; label162: android.util.Log.e("TrackerControl.JNI", $622_phi); org.example.NativeSummaryFuncs.ExceptionOccurred(null); org.example.NativeSummaryFuncs.ExceptionDescribe(null); org.example.NativeSummaryFuncs.ExceptionClear(null); $631_phi = null; if $opred != 177 goto label163; $631_phi = null; goto label164; label163: if $opred != 178 goto label164; $631_phi = "%s"; label164: android.util.Log.e("TrackerControl.JNI", $631_phi); $636_phi = null; if $opred != 179 goto label165; $636_phi = null; goto label166; label165: if $opred != 180 goto label166; $636_phi = "%s"; label166: android.util.Log.e("TrackerControl.JNI", $636_phi); $641_phi = null; if $opred != 181 goto label167; $641_phi = null; goto label168; label167: if $opred != 182 goto label168; $641_phi = "%s"; label168: android.util.Log.e("TrackerControl.JNI", $641_phi); $646_phi = null; if $opred != 183 goto label169; $646_phi = null; goto label170; label169: if $opred != 184 goto label170; $646_phi = "%s"; label170: android.util.Log.e("TrackerControl.JNI", $646_phi); $651_phi = null; if $opred != 185 goto label171; $651_phi = null; goto label172; label171: if $opred != 186 goto label172; $651_phi = "%s"; label172: android.util.Log.e("TrackerControl.JNI", $651_phi); org.example.NativeSummaryFuncs.ExceptionOccurred(null); org.example.NativeSummaryFuncs.ExceptionDescribe(null); org.example.NativeSummaryFuncs.ExceptionClear(null); $673_phi = null; if $opred != 187 goto label173; $673_phi = null; goto label174; label173: if $opred != 188 goto label174; $673_phi = "%s"; label174: android.util.Log.d("TrackerControl.JNI", $673_phi); $677_phi = null; if $opred != 189 goto label175; $677_phi = null; goto label176; label175: if $opred != 190 goto label176; $677_phi = "%s"; label176: android.util.Log.d("TrackerControl.JNI", $677_phi); $681_phi = null; if $opred != 191 goto label177; $681_phi = null; goto label178; label177: if $opred != 192 goto label178; $681_phi = "%s"; label178: android.util.Log.w("TrackerControl.JNI", $681_phi); $685_phi = null; if $opred != 193 goto label179; $685_phi = null; goto label180; label179: if $opred != 194 goto label180; $685_phi = "%s"; label180: android.util.Log.e("TrackerControl.JNI", $685_phi); $689_phi = null; if $opred != 195 goto label181; $689_phi = null; goto label182; label181: if $opred != 196 goto label182; $689_phi = "%s"; label182: android.util.Log.e("TrackerControl.JNI", $689_phi); $693_phi = null; if $opred != 197 goto label183; $693_phi = null; goto label184; label183: if $opred != 198 goto label184; $693_phi = "%s"; label184: android.util.Log.w("TrackerControl.JNI", $693_phi); $697_phi = null; if $opred != 199 goto label185; $697_phi = null; goto label186; label185: if $opred != 200 goto label186; $697_phi = "%s"; label186: android.util.Log.w("TrackerControl.JNI", $697_phi); org.example.NativeSummaryFuncs.malloc(null); org.example.NativeSummaryFuncs.malloc(null); $703_phi = null; if $opred != 201 goto label187; $703_phi = null; goto label188; label187: if $opred != 202 goto label188; $703_phi = "%s"; label188: android.util.Log.d("TrackerControl.JNI", $703_phi); $710_phi = null; if $opred != 205 goto label189; $710_phi = null; goto label190; label189: if $opred != 206 goto label190; $710_phi = "%s"; label190: android.util.Log.w("TrackerControl.JNI", $710_phi); org.example.NativeSummaryFuncs.free(null); org.example.NativeSummaryFuncs.free(null); $718_phi = null; if $opred != 207 goto label191; $718_phi = null; goto label192; label191: if $opred != 208 goto label192; $718_phi = "%s"; label192: android.util.Log.e("TrackerControl.JNI", $718_phi); $722_phi = null; if $opred != 209 goto label193; $722_phi = null; goto label194; label193: if $opred != 210 goto label194; $722_phi = "%s"; label194: android.util.Log.w("TrackerControl.JNI", $722_phi); org.example.NativeSummaryFuncs.free(null); $728_phi = null; if $opred != 211 goto label195; $728_phi = null; goto label196; label195: if $opred != 212 goto label196; $728_phi = "%s"; label196: android.util.Log.e("TrackerControl.JNI", $728_phi); $732_phi = null; if $opred != 213 goto label197; $732_phi = null; goto label198; label197: if $opred != 214 goto label198; $732_phi = "%s"; label198: android.util.Log.d("TrackerControl.JNI", $732_phi); $736_phi = null; if $opred != 215 goto label199; $736_phi = null; goto label200; label199: if $opred != 216 goto label200; $736_phi = "%s"; label200: android.util.Log.d("TrackerControl.JNI", $736_phi); org.example.NativeSummaryFuncs.free(null); org.example.NativeSummaryFuncs.free(null); $742_phi = null; if $opred != 217 goto label201; $742_phi = null; goto label202; label201: if $opred != 218 goto label202; $742_phi = "%s"; label202: android.util.Log.w("TrackerControl.JNI", $742_phi); $746_phi = null; if $opred != 219 goto label203; $746_phi = null; goto label204; label203: if $opred != 220 goto label204; $746_phi = "%s"; label204: android.util.Log.e("TrackerControl.JNI", $746_phi); org.example.NativeSummaryFuncs.malloc(40L); org.example.NativeSummaryFuncs.malloc(60L); $752_phi = 0; if $opred != 221 goto label205; $752_phi = null; goto label206; label205: if $opred != 222 goto label206; $752_phi = $p1; label206: org.example.NativeSummaryFuncs.write($752_phi, null, null); org.example.NativeSummaryFuncs.free(null); $756_phi = null; if $opred != 223 goto label207; $756_phi = null; goto label208; label207: if $opred != 224 goto label208; $756_phi = "%s"; label208: android.util.Log.w("TrackerControl.JNI", $756_phi); $760_phi = null; if $opred != 225 goto label209; $760_phi = null; goto label210; label209: if $opred != 226 goto label210; $760_phi = "%s"; label210: android.util.Log.d("TrackerControl.JNI", $760_phi); $764_phi = null; if $opred != 227 goto label211; $764_phi = null; goto label212; label211: if $opred != 228 goto label212; $764_phi = "%s"; label212: android.util.Log.d("TrackerControl.JNI", $764_phi); $768_phi = null; if $opred != 229 goto label213; $768_phi = null; goto label214; label213: if $opred != 230 goto label214; $768_phi = "%s"; label214: android.util.Log.w("TrackerControl.JNI", $768_phi); $772_phi = null; if $opred != 231 goto label215; $772_phi = null; goto label216; label215: if $opred != 232 goto label216; $772_phi = "%s"; label216: android.util.Log.w("TrackerControl.JNI", $772_phi); org.example.NativeSummaryFuncs.malloc(40L); org.example.NativeSummaryFuncs.malloc(60L); $778_phi = 0; if $opred != 233 goto label217; $778_phi = null; goto label218; label217: if $opred != 234 goto label218; $778_phi = $p1; label218: org.example.NativeSummaryFuncs.write($778_phi, null, null); org.example.NativeSummaryFuncs.free(null); $782_phi = null; if $opred != 235 goto label219; $782_phi = null; goto label220; label219: if $opred != 236 goto label220; $782_phi = "%s"; label220: android.util.Log.d("TrackerControl.JNI", $782_phi); org.example.NativeSummaryFuncs.malloc(null); org.example.NativeSummaryFuncs.malloc(40L); org.example.NativeSummaryFuncs.malloc(60L); $790_phi = 0; if $opred != 237 goto label221; $790_phi = null; goto label222; label221: if $opred != 238 goto label222; $790_phi = $p1; label222: org.example.NativeSummaryFuncs.write($790_phi, null, null); org.example.NativeSummaryFuncs.free(null); org.example.NativeSummaryFuncs.malloc(null); org.example.NativeSummaryFuncs.malloc(null); $797_phi = 0; if $opred != 239 goto label223; $797_phi = null; goto label224; label223: if $opred != 240 goto label224; $797_phi = $p1; label224: org.example.NativeSummaryFuncs.write($797_phi, null, null); org.example.NativeSummaryFuncs.free(null); $801_phi = null; if $opred != 241 goto label225; $801_phi = null; goto label226; label225: if $opred != 242 goto label226; $801_phi = "%s"; label226: android.util.Log.w("TrackerControl.JNI", $801_phi); org.example.NativeSummaryFuncs.malloc(40L); org.example.NativeSummaryFuncs.malloc(60L); $807_phi = 0; if $opred != 243 goto label227; $807_phi = null; goto label228; label227: if $opred != 244 goto label228; $807_phi = $p1; label228: org.example.NativeSummaryFuncs.write($807_phi, null, null); org.example.NativeSummaryFuncs.free(null); $811_phi = null; if $opred != 245 goto label229; $811_phi = null; goto label230; label229: if $opred != 246 goto label230; $811_phi = "%s"; label230: android.util.Log.w("TrackerControl.JNI", $811_phi); $815_phi = null; if $opred != 247 goto label231; $815_phi = null; goto label232; label231: if $opred != 248 goto label232; $815_phi = "%s"; label232: android.util.Log.e("TrackerControl.JNI", $815_phi); $819_phi = null; if $opred != 249 goto label233; $819_phi = null; goto label234; label233: if $opred != 250 goto label234; $819_phi = "%s"; label234: android.util.Log.e("TrackerControl.JNI", $819_phi); org.example.NativeSummaryFuncs.malloc(40L); org.example.NativeSummaryFuncs.malloc(60L); $825_phi = 0; if $opred != 251 goto label235; $825_phi = null; goto label236; label235: if $opred != 252 goto label236; $825_phi = $p1; label236: org.example.NativeSummaryFuncs.write($825_phi, null, null); org.example.NativeSummaryFuncs.free(null); org.example.NativeSummaryFuncs.close(null); $830_phi = null; if $opred != 253 goto label237; $830_phi = null; goto label238; label237: if $opred != 254 goto label238; $830_phi = "%s"; label238: android.util.Log.e("TrackerControl.JNI", $830_phi); org.example.NativeSummaryFuncs.free(null); $835_phi = null; if $opred != 255 goto label239; $835_phi = null; goto label240; label239: if $opred != 256 goto label240; $835_phi = "%s"; label240: android.util.Log.i("TrackerControl.JNI", $835_phi); $839 = org.example.NativeSummaryFuncs.malloc(null); $840_phi = null; if $opred != 257 goto label241; $840_phi = null; goto label242; label241: if $opred != 258 goto label242; $840_phi = "%s"; label242: android.util.Log.i("TrackerControl.JNI", $840_phi); org.example.NativeSummaryFuncs.free($839); $845_phi = null; if $opred != 259 goto label243; $845_phi = null; goto label244; label243: if $opred != 260 goto label244; $845_phi = "%s"; label244: android.util.Log.w("TrackerControl.JNI", $845_phi); $849_phi = null; if $opred != 261 goto label245; $849_phi = null; goto label246; label245: if $opred != 262 goto label246; $849_phi = "%s"; label246: android.util.Log.e("TrackerControl.JNI", $849_phi); $853_phi = null; if $opred != 263 goto label247; $853_phi = null; goto label248; label247: if $opred != 264 goto label248; $853_phi = "%s"; label248: android.util.Log.e("TrackerControl.JNI", $853_phi); org.example.NativeSummaryFuncs.malloc(40L); org.example.NativeSummaryFuncs.malloc(60L); $859_phi = 0; if $opred != 265 goto label249; $859_phi = null; goto label250; label249: if $opred != 266 goto label250; $859_phi = $p1; label250: org.example.NativeSummaryFuncs.write($859_phi, null, null); org.example.NativeSummaryFuncs.free(null); org.example.NativeSummaryFuncs.malloc(67L); $864_phi = null; if $opred != 267 goto label251; $864_phi = null; goto label252; label251: if $opred != 268 goto label252; $864_phi = "%s"; label252: android.util.Log.i("TrackerControl.JNI", $864_phi); org.example.NativeSummaryFuncs.malloc(991L); $869_phi = null; if $opred != 269 goto label253; $869_phi = null; goto label254; label253: if $opred != 270 goto label254; $869_phi = "%s"; label254: android.util.Log.i("TrackerControl.JNI", $869_phi); org.example.NativeSummaryFuncs.free(null); $875 = org.example.NativeSummaryFuncs.malloc(13L); $876_phi = null; if $opred != 271 goto label255; $876_phi = null; goto label256; label255: if $opred != 272 goto label256; $876_phi = "%s"; label256: android.util.Log.i("TrackerControl.JNI", $876_phi); org.example.NativeSummaryFuncs.free($875); $881_phi = null; if $opred != 273 goto label257; $881_phi = null; goto label258; label257: if $opred != 274 goto label258; $881_phi = "%s"; label258: android.util.Log.e("TrackerControl.JNI", $881_phi); org.example.NativeSummaryFuncs.malloc(40L); org.example.NativeSummaryFuncs.malloc(60L); $887_phi = 0; if $opred != 275 goto label259; $887_phi = null; goto label260; label259: if $opred != 276 goto label260; $887_phi = $p1; label260: org.example.NativeSummaryFuncs.write($887_phi, null, null); org.example.NativeSummaryFuncs.free(null); org.example.NativeSummaryFuncs.malloc(48L); org.example.NativeSummaryFuncs.malloc(68L); $893_phi = 0; if $opred != 277 goto label261; $893_phi = null; goto label262; label261: if $opred != 278 goto label262; $893_phi = $p1; label262: org.example.NativeSummaryFuncs.write($893_phi, null, null); org.example.NativeSummaryFuncs.free(null); $897_phi = null; if $opred != 279 goto label263; $897_phi = null; goto label264; label263: if $opred != 280 goto label264; $897_phi = "%s"; label264: android.util.Log.d("TrackerControl.JNI", $897_phi); $901_phi = null; if $opred != 281 goto label265; $901_phi = null; goto label266; label265: if $opred != 282 goto label266; $901_phi = "%s"; label266: android.util.Log.e("TrackerControl.JNI", $901_phi); $905 = org.example.NativeSummaryFuncs.malloc(65487L); $906_phi = null; if $opred != 283 goto label267; $906_phi = null; goto label268; label267: if $opred != 284 goto label268; $906_phi = "%s"; label268: android.util.Log.w("TrackerControl.JNI", $906_phi); $910_phi = null; if $opred != 285 goto label269; $910_phi = null; goto label270; label269: if $opred != 286 goto label270; $910_phi = "%s"; label270: android.util.Log.w("TrackerControl.JNI", $910_phi); $914_phi = null; if $opred != 287 goto label271; $914_phi = null; goto label272; label271: if $opred != 288 goto label272; $914_phi = "%s"; label272: android.util.Log.w("TrackerControl.JNI", $914_phi); org.example.NativeSummaryFuncs.malloc(null); org.example.NativeSummaryFuncs.malloc(null); $920_phi = null; if $opred != 289 goto label273; $920_phi = null; goto label274; label273: if $opred != 290 goto label274; $920_phi = "%s"; label274: android.util.Log.w("TrackerControl.JNI", $920_phi); $927_phi = null; if $opred != 293 goto label275; $927_phi = null; goto label276; label275: if $opred != 294 goto label276; $927_phi = "%s"; label276: android.util.Log.w("TrackerControl.JNI", $927_phi); org.example.NativeSummaryFuncs.free(null); org.example.NativeSummaryFuncs.free(null); $935_phi = null; if $opred != 295 goto label277; $935_phi = null; goto label278; label277: if $opred != 296 goto label278; $935_phi = "%s"; label278: android.util.Log.e("TrackerControl.JNI", $935_phi); org.example.NativeSummaryFuncs.free($905); $940_phi = null; if $opred != 297 goto label279; $940_phi = null; goto label280; label279: if $opred != 298 goto label280; $940_phi = "%s"; label280: android.util.Log.d("TrackerControl.JNI", $940_phi); org.example.NativeSummaryFuncs.poll(null, 1L, null); $945_phi = null; if $opred != 299 goto label281; $945_phi = null; goto label282; label281: if $opred != 300 goto label282; $945_phi = "%s"; label282: android.util.Log.e("TrackerControl.JNI", $945_phi); $949_phi = null; if $opred != 301 goto label283; $949_phi = null; goto label284; label283: if $opred != 302 goto label284; $949_phi = "%s"; label284: android.util.Log.e("TrackerControl.JNI", $949_phi); $953 = org.example.NativeSummaryFuncs.malloc(10000L); $954_phi = 0; if $opred != 303 goto label285; $954_phi = null; goto label287; label285: if $opred != 304 goto label286; $954_phi = $p1; goto label287; label286: if $opred != 305 goto label287; $954_phi = $953; label287: org.example.NativeSummaryFuncs.free($954_phi); $956_phi = null; if $opred != 306 goto label288; $956_phi = null; goto label289; label288: if $opred != 307 goto label289; $956_phi = "%s"; label289: android.util.Log.e("TrackerControl.JNI", $956_phi); org.example.NativeSummaryFuncs.ExceptionOccurred(null); org.example.NativeSummaryFuncs.ExceptionDescribe(null); org.example.NativeSummaryFuncs.ExceptionClear(null); org.example.NativeSummaryFuncs.ExceptionOccurred(null); org.example.NativeSummaryFuncs.ExceptionDescribe(null); org.example.NativeSummaryFuncs.ExceptionClear(null); org.example.NativeSummaryFuncs.free(null); $980_phi = null; if $opred != 313 goto label290; $980_phi = null; goto label291; label290: if $opred != 314 goto label291; $980_phi = "%s"; label291: android.util.Log.w("TrackerControl.JNI", $980_phi); $984_phi = null; if $opred != 315 goto label292; $984_phi = null; goto label293; label292: if $opred != 316 goto label293; $984_phi = "%s"; label293: android.util.Log.e("TrackerControl.JNI", $984_phi); $988_phi = null; if $opred != 317 goto label294; $988_phi = null; goto label295; label294: if $opred != 318 goto label295; $988_phi = "%s"; label295: android.util.Log.e("TrackerControl.JNI", $988_phi); $992_phi = null; if $opred != 319 goto label296; $992_phi = null; goto label297; label296: if $opred != 320 goto label297; $992_phi = "%s"; label297: android.util.Log.e("TrackerControl.JNI", $992_phi); $996_phi = null; if $opred != 321 goto label298; $996_phi = null; goto label299; label298: if $opred != 322 goto label299; $996_phi = "%s"; label299: android.util.Log.w("TrackerControl.JNI", $996_phi); $1000_phi = null; if $opred != 323 goto label300; $1000_phi = null; goto label301; label300: if $opred != 324 goto label301; $1000_phi = "%s"; label301: android.util.Log.w("TrackerControl.JNI", $1000_phi); $1004_phi = null; if $opred != 325 goto label302; $1004_phi = null; goto label303; label302: if $opred != 326 goto label303; $1004_phi = "%s"; label303: android.util.Log.w("TrackerControl.JNI", $1004_phi); $1008_phi = null; if $opred != 327 goto label304; $1008_phi = null; goto label305; label304: if $opred != 328 goto label305; $1008_phi = "%s"; label305: android.util.Log.w("TrackerControl.JNI", $1008_phi); $1012_phi = null; if $opred != 329 goto label306; $1012_phi = null; goto label307; label306: if $opred != 330 goto label307; $1012_phi = "%s"; label307: android.util.Log.e("TrackerControl.JNI", $1012_phi); $1017_phi = null; if $opred != 331 goto label308; $1017_phi = null; goto label309; label308: if $opred != 332 goto label309; $1017_phi = "%s"; label309: android.util.Log.i("TrackerControl.JNI", $1017_phi); $1021_phi = null; if $opred != 333 goto label310; $1021_phi = "/proc/net/icmp6"; goto label313; label310: if $opred != 334 goto label311; $1021_phi = "/proc/net/udp6"; goto label313; label311: if $opred != 335 goto label312; $1021_phi = "/proc/net/tcp6"; goto label313; label312: if $opred != 336 goto label313; $1021_phi = "/proc/net/icmp"; label313: org.example.NativeSummaryFuncs.fopen($1021_phi, "r"); $1023_phi = null; if $opred != 337 goto label314; $1023_phi = null; goto label315; label314: if $opred != 338 goto label315; $1023_phi = "%s"; label315: android.util.Log.e("TrackerControl.JNI", $1023_phi); org.example.NativeSummaryFuncs.sscanf(null, "%*d: %32s:%X %32s:%X %*X %*lX:%*lX %*X:%*X %*X %d %*d %*ld", null, null, null, null, null); org.example.NativeSummaryFuncs.malloc(56L); org.example.NativeSummaryFuncs.realloc(null, null); $1031_phi = null; if $opred != 339 goto label316; $1031_phi = null; goto label317; label316: if $opred != 340 goto label317; $1031_phi = "%s"; label317: android.util.Log.e("TrackerControl.JNI", $1031_phi); org.example.NativeSummaryFuncs.fclose(null); $1037_phi = null; if $opred != 341 goto label318; $1037_phi = null; goto label319; label318: if $opred != 342 goto label319; $1037_phi = "%s"; label319: android.util.Log.e("TrackerControl.JNI", $1037_phi); $1041_phi = null; if $opred != 343 goto label320; $1041_phi = null; goto label321; label320: if $opred != 344 goto label321; $1041_phi = "%s"; label321: android.util.Log.d("TrackerControl.JNI", $1041_phi); org.example.NativeSummaryFuncs.sscanf(null, "%*d: %32s:%X %32s:%X %*X %*lX:%*lX %*X:%*X %*X %d %*d %*ld", null, null, null, null, null); org.example.NativeSummaryFuncs.fclose(null); $1053_phi = null; if $opred != 349 goto label322; $1053_phi = null; goto label323; label322: if $opred != 350 goto label323; $1053_phi = "%s"; label323: android.util.Log.d("TrackerControl.JNI", $1053_phi); $1058_phi = null; if $opred != 353 goto label324; $1058_phi = null; goto label325; label324: if $opred != 354 goto label325; $1058_phi = "%s"; label325: android.util.Log.d("TrackerControl.JNI", $1058_phi); $1062_phi = null; if $opred != 355 goto label326; $1062_phi = null; goto label327; label326: if $opred != 356 goto label327; $1062_phi = "%s"; label327: android.util.Log.d("TrackerControl.JNI", $1062_phi); $1066_phi = null; if $opred != 357 goto label328; $1066_phi = null; goto label329; label328: if $opred != 358 goto label329; $1066_phi = "%s"; label329: android.util.Log.d("TrackerControl.JNI", $1066_phi); $1070_phi = null; if $opred != 359 goto label330; $1070_phi = null; goto label331; label330: if $opred != 360 goto label331; $1070_phi = "%s"; label331: android.util.Log.i("TrackerControl.JNI", $1070_phi); org.example.NativeSummaryFuncs.malloc(176L); $1075_phi = null; if $opred != 361 goto label332; $1075_phi = null; goto label333; label332: if $opred != 362 goto label333; $1075_phi = "%s"; label333: android.util.Log.w("TrackerControl.JNI", $1075_phi); $1079_phi = null; if $opred != 363 goto label334; $1079_phi = null; goto label335; label334: if $opred != 364 goto label335; $1079_phi = "%s"; label335: android.util.Log.w("TrackerControl.JNI", $1079_phi); $1083_phi = null; if $opred != 365 goto label336; $1083_phi = null; goto label337; label336: if $opred != 366 goto label337; $1083_phi = "%s"; label337: android.util.Log.w("TrackerControl.JNI", $1083_phi); $1087 = org.example.NativeSummaryFuncs.malloc(176L); org.example.NativeSummaryFuncs.malloc(32L); org.example.NativeSummaryFuncs.malloc(null); $1092_phi = null; if $opred != 367 goto label338; $1092_phi = ""; goto label339; label338: if $opred != 368 goto label339; $1092_phi = null; label339: org.example.NativeSummaryFuncs.strchr($1092_phi, 58L); $1095_phi = null; if $opred != 369 goto label340; $1095_phi = null; goto label341; label340: if $opred != 370 goto label341; $1095_phi = "%s"; label341: android.util.Log.e("TrackerControl.JNI", $1095_phi); $1099_phi = null; if $opred != 371 goto label342; $1099_phi = null; goto label343; label342: if $opred != 372 goto label343; $1099_phi = "%s"; label343: android.util.Log.e("TrackerControl.JNI", $1099_phi); $1103_phi = null; if $opred != 373 goto label344; $1103_phi = null; goto label345; label344: if $opred != 374 goto label345; $1103_phi = "%s"; label345: android.util.Log.w("TrackerControl.JNI", $1103_phi); $1107_phi = null; if $opred != 375 goto label346; $1107_phi = null; goto label347; label346: if $opred != 376 goto label347; $1107_phi = "%s"; label347: android.util.Log.w("TrackerControl.JNI", $1107_phi); $1111_phi = null; if $opred != 377 goto label348; $1111_phi = null; goto label349; label348: if $opred != 378 goto label349; $1111_phi = "%s"; label349: android.util.Log.e("TrackerControl.JNI", $1111_phi); org.example.NativeSummaryFuncs.free($1087); return; }
1 write into the tunnel nsfunc_sink
com.github.metacubex.clash.meta_206001.apk Source: $r8 = staticinvoke <java.util.TimeZone: java.util.TimeZone getDefault()>() Sink: staticinvoke <org.example.NativeSummaryFuncs: int GetByteArrayRegion(java.lang.Object,byte[],java.lang.Object,int,int)>(null, $r2, null, $i0_1, $i1)
https://github.com/BackupTime/ClashForAndroid/blob/85063036936b71a3663ae081619bf9795bf37ca9/core/src/main/cpp/main.c#L88 JNIEXPORT void JNICALL Java_com_github_kr328_clash_core_bridge_Bridge_nativeNotifyTimeZoneChanged(JNIEnv *env, jobject thiz, jstring name, jint offset) { TRACE_METHOD(); scoped_string _name = get_string(name); notifyTimeZoneChanged(_name, offset); }
virtualinvoke $r11.<com.github.kr328.clash.core.bridge.Bridge: void nativeNotifyTimeZoneChanged(java.lang.String,int)>($r10, $i0_6) $i0_1 = staticinvoke <org.example.NativeSummaryFuncs: int GetArrayLength(java.lang.Object,byte[])>(null, $r2) staticinvoke <org.example.NativeSummaryFuncs: int GetByteArrayRegion(java.lang.Object,byte[],java.lang.Object,int,int)>(null, $r2, null, $i0_1, $i1)
$r8 = staticinvoke <java.util.TimeZone: java.util.TimeZone getDefault()>() $r10 = virtualinvoke $r8.<java.util.TimeZone: java.lang.String getID()>() virtualinvoke $r11.<com.github.kr328.clash.core.bridge.Bridge: void nativeNotifyTimeZoneChanged(java.lang.String,int)>($r10, $i0_6) $r1 := @parameter0: java.lang.String getBytes()>() $i0_1 = staticinvoke <org.example.NativeSummaryFuncs: int GetArrayLength(java.lang.Object,byte[])>(null, $r2) staticinvoke <org.example.NativeSummaryFuncs: int GetByteArrayRegion(java.lang.Object,byte[],java.lang.Object,int,int)>(null, $r2, null, $i0_1, $i1)
called GetByteArrayRegion on param0
public final void nativeNotifyTimeZoneChanged(java.lang.String, int) { byte[] $0; int $p1, $1, $2; java.lang.String $p0; com.github.kr328.clash.core.bridge.Bridge $this; $this := @this; $p0 := @parameter0; $p1 := @parameter1; $0 = virtualinvoke $p0.getBytes(); $1 = org.example.NativeSummaryFuncs.GetArrayLength(null, $0); $2 = org.example.NativeSummaryFuncs.malloc($1); org.example.NativeSummaryFuncs.GetByteArrayRegion(null, $0, null, $1, $2); org.example.NativeSummaryFuncs.free($2); return; }
1 called GetByteArrayRegion on param0 nsfunc_sink
org.calyxinstitute.vpn_160000.apk Source: $r2 = virtualinvoke $r1.<java.util.HashMap: java.lang.Object get(java.lang.Object)>($r3) Sink: staticinvoke <android.util.Log: int e(java.lang.String,java.lang.String)>("go/Seq", $r0_6)
https://github.com/tladesignz/IPtProxy/blob/3dea62b7b552a0e4a8d5a5a8859a80d841f07756/IPtProxy.go/IPtProxy.go#L244 func StartSnowflake(ice, url, fronts, ampCache, sqsQueueURL, sqsCredsStr, logFile string, logToStateDir, keepLocalAddresses, unsafeLogging bool, maxPeers int) int { if snowflakeRunning { return snowflakePort } snowflakeRunning = true for !IsPortAvailable(snowflakePort) { snowflakePort++ } fixEnv() go snowflakeclient.Start(&snowflakePort, &ice, &url, &fronts, &ampCache, &sqsQueueURL, &sqsCredsStr, &logFile, &logToStateDir, &keepLocalAddresses, &unsafeLogging, &maxPeers) return snowflakePort }
$l0 = staticinvoke <IPtProxy.IPtProxy: long startSnowflake(java.lang.String,java.lang.String,java.lang.String,java.lang.String,java.lang.String,boolean,boolean,boolean,long)>($r10, $r6_1, $r8_2, null, $r11_1, 0, 0, 1, 5L)
$r2 = virtualinvoke $r1.<java.util.HashMap: java.lang.Object get(java.lang.Object)>($r3) $r3_1 = (java.lang.String) $r2 return $r3_1 $r6_1 = specialinvoke r0.<se.leap.bitmaskclient.tor.ClientTransportPlugin: java.lang.String getCdnFront(java.lang.String)>("snowflake-target") $l0 = staticinvoke <IPtProxy.IPtProxy: long startSnowflake(java.lang.String,java.lang.String,java.lang.String,java.lang.String,java.lang.String,boolean,boolean,boolean,long)>($r10, $r6_1, $r8_2, null, $r11_1, 0, 0, 1, 5L) $r1 := @parameter1: java.lang.String $r0_6 = $r1 staticinvoke <android.util.Log: int e(java.lang.String,java.lang.String)>("go/Seq", $r0_6)
from param1 -> log
public static long startSnowflake(java.lang.String, java.lang.String, java.lang.String, java.lang.String, java.lang.String, boolean, boolean, boolean, long) { long $p8; int $opred; java.lang.String $p0, $p1, $p2, $p3, $p4, $4_phi, $14_phi, $24_phi, $34_phi, $44_phi; boolean $p5, $p6, $p7; $p0 := @parameter0; $p1 := @parameter1; $p2 := @parameter2; $p3 := @parameter3; $p4 := @parameter4; $p5 := @parameter5; $p6 := @parameter6; $p7 := @parameter7; $p8 := @parameter8; org.example.NativeSummaryFuncs.malloc(null); $4_phi = null; $opred = org.example.NativeSummaryAux.opaqueInt(); if $opred != 1 goto label01; $4_phi = $p1; goto label04; label01: if $opred != 2 goto label02; $4_phi = "utf16Decode: malloc failed"; goto label04; label02: if $opred != 3 goto label03; $4_phi = "GetStringChars failed"; goto label04; label03: if $opred != 4 goto label04; $4_phi = "utf16Decode: buffer overflow"; label04: android.util.Log.e("go/Seq", $4_phi); org.example.NativeSummaryFuncs.malloc(null); $14_phi = null; if $opred != 5 goto label05; $14_phi = $p1; goto label08; label05: if $opred != 6 goto label06; $14_phi = "utf16Decode: malloc failed"; goto label08; label06: if $opred != 7 goto label07; $14_phi = "GetStringChars failed"; goto label08; label07: if $opred != 8 goto label08; $14_phi = "utf16Decode: buffer overflow"; label08: android.util.Log.e("go/Seq", $14_phi); org.example.NativeSummaryFuncs.malloc(null); $24_phi = null; if $opred != 9 goto label09; $24_phi = $p1; goto label12; label09: if $opred != 10 goto label10; $24_phi = "utf16Decode: malloc failed"; goto label12; label10: if $opred != 11 goto label11; $24_phi = "GetStringChars failed"; goto label12; label11: if $opred != 12 goto label12; $24_phi = "utf16Decode: buffer overflow"; label12: android.util.Log.e("go/Seq", $24_phi); org.example.NativeSummaryFuncs.malloc(null); $34_phi = null; if $opred != 13 goto label13; $34_phi = $p1; goto label16; label13: if $opred != 14 goto label14; $34_phi = "utf16Decode: malloc failed"; goto label16; label14: if $opred != 15 goto label15; $34_phi = "GetStringChars failed"; goto label16; label15: if $opred != 16 goto label16; $34_phi = "utf16Decode: buffer overflow"; label16: android.util.Log.e("go/Seq", $34_phi); org.example.NativeSummaryFuncs.malloc(null); $44_phi = null; if $opred != 17 goto label17; $44_phi = $p1; goto label20; label17: if $opred != 18 goto label18; $44_phi = "utf16Decode: malloc failed"; goto label20; label18: if $opred != 19 goto label19; $44_phi = "GetStringChars failed"; goto label20; label19: if $opred != 20 goto label20; $44_phi = "utf16Decode: buffer overflow"; label20: android.util.Log.e("go/Seq", $44_phi); return null; }
1 param1 printed by golang if there is error log_sink
com.practicalapps.hamtrainer_8.apk Source: $r7 = staticinvoke <android.graphics.Bitmap: android.graphics.Bitmap createBitmap(int,int,android.graphics.Bitmap$Config)>($i0_8, $i1, $r6_2) Sink: staticinvoke <android.util.Log: int e(java.lang.String,java.lang.String)>("jniPdfium", $r2_9)
https://github.com/barteksc/PdfiumAndroid/blob/103d5855f797af78a6f33f94cb306ef1c23b2290/src/main/jni/src/mainJNILib.cpp#L469 JNI_FUNC(void, PdfiumCore, nativeRenderPageBitmap)(JNI_ARGS, jlong pagePtr, jobject bitmap, jint dpi, jint startX, jint startY, jint drawSizeHor, jint drawSizeVer, jboolean renderAnnot){ FPDF_PAGE page = reinterpret_cast<FPDF_PAGE>(pagePtr); if(page == NULL || bitmap == NULL){ LOGE("Render page pointers invalid"); return; } AndroidBitmapInfo info; int ret; if((ret = AndroidBitmap_getInfo(env, bitmap, &info)) < 0) { LOGE("Fetching bitmap info failed: %s", strerror(ret * -1)); return; } int canvasHorSize = info.width; int canvasVerSize = info.height; if(info.format != ANDROID_BITMAP_FORMAT_RGBA_8888 && info.format != ANDROID_BITMAP_FORMAT_RGB_565){ LOGE("Bitmap format must be RGBA_8888 or RGB_565"); return; } void *addr; if( (ret = AndroidBitmap_lockPixels(env, bitmap, &addr)) != 0 ){ LOGE("Locking bitmap failed: %s", strerror(ret * -1)); return; } void *tmp; int format; int sourceStride; if (info.format == ANDROID_BITMAP_FORMAT_RGB_565) { tmp = malloc(canvasVerSize * canvasHorSize * sizeof(rgb)); sourceStride = canvasHorSize * sizeof(rgb); format = FPDFBitmap_BGR; } else { tmp = addr; sourceStride = info.stride; format = FPDFBitmap_BGRA; } FPDF_BITMAP pdfBitmap = FPDFBitmap_CreateEx( canvasHorSize, canvasVerSize, format, tmp, sourceStride); /*LOGD("Start X: %d", startX); LOGD("Start Y: %d", startY); LOGD("Canvas Hor: %d", canvasHorSize); LOGD("Canvas Ver: %d", canvasVerSize); LOGD("Draw Hor: %d", drawSizeHor); LOGD("Draw Ver: %d", drawSizeVer);*/ if(drawSizeHor < canvasHorSize || drawSizeVer < canvasVerSize){ FPDFBitmap_FillRect( pdfBitmap, 0, 0, canvasHorSize, canvasVerSize, 0x848484FF); //Gray } int baseHorSize = (canvasHorSize < drawSizeHor)? canvasHorSize : (int)drawSizeHor; int baseVerSize = (canvasVerSize < drawSizeVer)? canvasVerSize : (int)drawSizeVer; int baseX = (startX < 0)? 0 : (int)startX; int baseY = (startY < 0)? 0 : (int)startY; int flags = FPDF_REVERSE_BYTE_ORDER; if(renderAnnot) { flags |= FPDF_ANNOT; } FPDFBitmap_FillRect( pdfBitmap, baseX, baseY, baseHorSize, baseVerSize, 0xFFFFFFFF); //White FPDF_RenderPageBitmap( pdfBitmap, page, startX, startY, (int)drawSizeHor, (int)drawSizeVer, 0, flags ); if (info.format == ANDROID_BITMAP_FORMAT_RGB_565) { rgbBitmapTo565(tmp, sourceStride, addr, &info); free(tmp); } AndroidBitmap_unlockPixels(env, bitmap); }
specialinvoke r0.<com.shockwave.pdfium.PdfiumCore: void nativeRenderPageBitmap(long,android.graphics.Bitmap,int,int,int,int,int,boolean)>($l5, $r2, $i0_1, $i1, $i2, $i3, $i4, $z0)
$r7 = staticinvoke <android.graphics.Bitmap: android.graphics.Bitmap createBitmap(int,int,android.graphics.Bitmap$Config)>($i0_8, $i1, $r6_2) virtualinvoke $r3_3.<com.shockwave.pdfium.PdfiumCore: void renderPageBitmap(com.shockwave.pdfium.PdfDocument,android.graphics.Bitmap,int,int,int,int,int,boolean)>($r4_3, $r7, $i0_10, $i1_1, $i2, $i3, $i4, $z0_2) $r2 := @parameter1: android.graphics.Bitmap specialinvoke r0.<com.shockwave.pdfium.PdfiumCore: void nativeRenderPageBitmap(long,android.graphics.Bitmap,int,int,int,int,int,boolean)>($l5, $r2, $i0_1, $i1, $i2, $i3, $i4, $z0) $r1 := @parameter1: android.graphics.Bitmap $r3_7 = $r1 $r2_9 = (java.lang.String) $r3_7 staticinvoke <android.util.Log: int e(java.lang.String,java.lang.String)>("jniPdfium", $r2_9)
bitmap info is get and printed by log
private void nativeRenderPageBitmap(long, android.graphics.Bitmap, int, int, int, int, int, boolean) { long $p0; com.shockwave.pdfium.PdfiumCore $this; android.graphics.Bitmap $p1, $4_phi, $14_phi; int $p2, $p3, $p4, $p5, $p6, $opred, $8; java.lang.String $0_phi, $10_phi; boolean $p7; $this := @this; $p0 := @parameter0; $p1 := @parameter1; $p2 := @parameter2; $p3 := @parameter3; $p4 := @parameter4; $p5 := @parameter5; $p6 := @parameter6; $p7 := @parameter7; $0_phi = null; $opred = org.example.NativeSummaryAux.opaqueInt(); if $opred != 1 goto label1; $0_phi = "Fetching bitmap info failed: %s"; goto label2; label1: if $opred != 2 goto label2; $0_phi = null; label2: android.util.Log.e("jniPdfium", $0_phi); $4_phi = null; if $opred != 3 goto label3; $4_phi = "Bitmap format must be RGBA_8888 or RGB_565"; goto label4; label3: if $opred != 4 goto label4; $4_phi = $p1; label4: android.util.Log.e("jniPdfium", $4_phi); $8 = org.example.NativeSummaryFuncs.malloc(null); org.example.NativeSummaryFuncs.free($8); $10_phi = null; if $opred != 5 goto label5; $10_phi = null; goto label6; label5: if $opred != 6 goto label6; $10_phi = "Locking bitmap failed: %s"; label6: android.util.Log.e("jniPdfium", $10_phi); $14_phi = null; if $opred != 7 goto label7; $14_phi = "Render page pointers invalid"; goto label8; label7: if $opred != 8 goto label8; $14_phi = $p1; label8: android.util.Log.e("jniPdfium", $14_phi); return; }
1 bitmap info is get and printed by log log_sink
com.viper.simplert_2.apk Source: $r8_3 = virtualinvoke r0.<com.viper.simplert.TetherService: java.lang.String getString(int)>(2131165217) Sink: staticinvoke <android.util.Log: int d(java.lang.String,java.lang.String)>("SIMPLE_RT_JNI", $r0_5)
https://github.com/robinpaulson/SimpleRT/blob/2fd71f68132b819ddbfabece4ba27203d2722c62/simple-rt-android/app/src/main/jni/tetherservice.c#L95 JNIEXPORT void JNICALL Java_com_viper_simplert_Native_start(JNIEnv *env, jclass type, jint tun_fd, jint acc_fd) { LOGV("%s: tun_fd = %d, acc_fd = %d", __func__, tun_fd, acc_fd); if (module.is_started) { LOGE("Native threads already started!"); return; } module.is_started = true; module.tun_fd = tun_fd; module.acc_fd = acc_fd; int flags = fcntl(tun_fd, F_GETFL, 0); fcntl(tun_fd, F_SETFL, flags & ~O_NONBLOCK); flags = fcntl(acc_fd, F_GETFL, 0); fcntl(acc_fd, F_SETFL, flags & ~O_NONBLOCK); pthread_create(&module.tun_thread, NULL, thread_proc, TUN_THREAD); pthread_create(&module.acc_thread, NULL, thread_proc, ACC_THREAD); }
staticinvoke <com.viper.simplert.Native: void start(int,int)>($i0_3, $i1_1)
$r8_3 = virtualinvoke r0.<com.viper.simplert.TetherService: java.lang.String getString(int)>(2131165217) $i0_3 = virtualinvoke $r15.<android.os.ParcelFileDescriptor: int detachFd()>() staticinvoke <com.viper.simplert.Native: void start(int,int)>($i0_3, $i1_1) $i0 := @parameter0: int $r1 = staticinvoke <java.lang.Integer: java.lang.Integer valueOf(int)>($i0) $r0_5 = virtualinvoke $r1.<java.lang.Integer: java.lang.String toString()>() staticinvoke <android.util.Log: int d(java.lang.String,java.lang.String)>("SIMPLE_RT_JNI", $r0_5)
param0 -> log print
static void start(int, int) { java.lang.Integer boxed, boxed; int $p0, $p1, $opred; java.lang.String $0_phi, $casted, $casted, $4_phi, $8_phi; $p0 := @parameter0; $p1 := @parameter1; $0_phi = null; $opred = org.example.NativeSummaryAux.opaqueInt(); if $opred != 1 goto label1; boxed = java.lang.Integer.valueOf($p0); $casted = virtualinvoke boxed.toString(); $0_phi = $casted; goto label4; label1: if $opred != 2 goto label2; boxed = java.lang.Integer.valueOf($p1); $casted = virtualinvoke boxed.toString(); $0_phi = $casted; goto label4; label2: if $opred != 3 goto label3; $0_phi = "%s: tun_fd = %d, acc_fd = %d"; goto label4; label3: if $opred != 4 goto label4; $0_phi = "Java_com_viper_simplert_Native_start"; label4: android.util.Log.d("SIMPLE_RT_JNI", $0_phi); $4_phi = null; if $opred != 5 goto label5; $4_phi = null; goto label6; label5: if $opred != 6 goto label6; $4_phi = "Native threads already started!"; label6: android.util.Log.e("SIMPLE_RT_JNI", $4_phi); $8_phi = null; if $opred != 7 goto label7; $8_phi = null; goto label8; label7: if $opred != 8 goto label8; $8_phi = "Native threads already started!"; label8: android.util.Log.d("SIMPLE_RT_JNI", $8_phi); return; }
1 the param0 fd is printed by log print log_sink\
org.outline.android.client_42.apk Source: $r3_1 = virtualinvoke $r3.<org.json.JSONObject: org.json.JSONObject getJSONObject(java.lang.String)>("config") Sink: staticinvoke <android.util.Log: int e(java.lang.String,java.lang.String)>("go/Seq", $r0_16)
https://github.com/Jigsaw-Code/outline-apps/blob/41a97219d3440145f27544160846c77a8c75a4aa/src/tun2socks/outline/shadowsocks/client.go#L124 func CheckConnectivity(client *Client) (int, error) { errCode, err := connectivity.CheckConnectivity((*outline.Client)(client)) return errCode.Number(), err }
$l1_1 = staticinvoke <shadowsocks.Shadowsocks: long checkConnectivity(java.lang.String,long,java.lang.String,java.lang.String)>($r2, $l1, $r3, $r4)
$r3_1 = virtualinvoke $r3.<org.json.JSONObject: org.json.JSONObject getJSONObject(java.lang.String)>("config") $r6 = staticinvoke <org.outline.vpn.VpnTunnelService: org.outline.TunnelConfig makeTunnelConfig(java.lang.String,org.json.JSONObject)>($r5, $r3_1) $r3 := @parameter1: org.json.JSONObject $i0 = virtualinvoke $r3.<org.json.JSONObject: int getInt(java.lang.String)>("port") $r4_2.<org.outline.shadowsocks.ShadowsocksConfig: int port> = $i0 $i0 = $r1.<org.outline.shadowsocks.ShadowsocksConfig: int port> $l1 = (long) $i0 $l1_1 = staticinvoke <shadowsocks.Shadowsocks: long checkConnectivity(java.lang.String,long,java.lang.String,java.lang.String)>($r2, $l1, $r3, $r4) $l0 := @parameter1: long $r3_6 = staticinvoke <java.lang.Long: java.lang.Long valueOf(long)>($l0) $r0_16 = virtualinvoke $r3_6.<java.lang.Long: java.lang.String toString()>() staticinvoke <android.util.Log: int e(java.lang.String,java.lang.String)>("go/Seq", $r0_16)
param1 -> log
public static long checkConnectivity(java.lang.String, long, java.lang.String, java.lang.String) throws java.lang.Exception { java.lang.Long boxed, boxed, boxed, boxed, boxed, boxed, boxed, boxed, boxed; long $p1; int $opred; java.lang.String $p0, $p2, $p3, $2_phi, $casted, $7_phi, $casted, $11_phi, $casted, $19_phi, $casted, $24_phi, $casted, $28_phi, $casted, $36_phi, $casted, $41_phi, $casted, $45_phi, $casted; $p0 := @parameter0; $p1 := @parameter1; $p2 := @parameter2; $p3 := @parameter3; $2_phi = null; $opred = org.example.NativeSummaryAux.opaqueInt(); if $opred != 1 goto label01; boxed = java.lang.Long.valueOf($p1); $casted = virtualinvoke boxed.toString(); $2_phi = $casted; goto label02; label01: if $opred != 2 goto label02; $2_phi = "GetStringChars failed"; label02: android.util.Log.e("go/Seq", $2_phi); org.example.NativeSummaryFuncs.malloc(null); $7_phi = null; if $opred != 3 goto label03; $7_phi = "utf16Decode: malloc failed"; goto label04; label03: if $opred != 4 goto label04; boxed = java.lang.Long.valueOf($p1); $casted = virtualinvoke boxed.toString(); $7_phi = $casted; label04: android.util.Log.e("go/Seq", $7_phi); $11_phi = null; if $opred != 5 goto label05; boxed = java.lang.Long.valueOf($p1); $casted = virtualinvoke boxed.toString(); $11_phi = $casted; goto label06; label05: if $opred != 6 goto label06; $11_phi = "utf16Decode: buffer overflow"; label06: android.util.Log.e("go/Seq", $11_phi); $19_phi = null; if $opred != 7 goto label07; $19_phi = "GetStringChars failed"; goto label08; label07: if $opred != 8 goto label08; boxed = java.lang.Long.valueOf($p1); $casted = virtualinvoke boxed.toString(); $19_phi = $casted; label08: android.util.Log.e("go/Seq", $19_phi); org.example.NativeSummaryFuncs.malloc(null); $24_phi = null; if $opred != 9 goto label09; boxed = java.lang.Long.valueOf($p1); $casted = virtualinvoke boxed.toString(); $24_phi = $casted; goto label10; label09: if $opred != 10 goto label10; $24_phi = "utf16Decode: malloc failed"; label10: android.util.Log.e("go/Seq", $24_phi); $28_phi = null; if $opred != 11 goto label11; boxed = java.lang.Long.valueOf($p1); $casted = virtualinvoke boxed.toString(); $28_phi = $casted; goto label12; label11: if $opred != 12 goto label12; $28_phi = "utf16Decode: buffer overflow"; label12: android.util.Log.e("go/Seq", $28_phi); $36_phi = null; if $opred != 13 goto label13; boxed = java.lang.Long.valueOf($p1); $casted = virtualinvoke boxed.toString(); $36_phi = $casted; goto label14; label13: if $opred != 14 goto label14; $36_phi = "GetStringChars failed"; label14: android.util.Log.e("go/Seq", $36_phi); org.example.NativeSummaryFuncs.malloc(null); $41_phi = null; if $opred != 15 goto label15; $41_phi = "utf16Decode: malloc failed"; goto label16; label15: if $opred != 16 goto label16; boxed = java.lang.Long.valueOf($p1); $casted = virtualinvoke boxed.toString(); $41_phi = $casted; label16: android.util.Log.e("go/Seq", $41_phi); $45_phi = null; if $opred != 17 goto label17; boxed = java.lang.Long.valueOf($p1); $casted = virtualinvoke boxed.toString(); $45_phi = $casted; goto label18; label17: if $opred != 18 goto label18; $45_phi = "utf16Decode: buffer overflow"; label18: android.util.Log.e("go/Seq", $45_phi); return null; }
1 if error occurs, param1 will be logged log_sink