How soot-oss/sootup works
SootUp is a static-analysis library that loads JVM-family program inputs, represents methods in Jimple, and builds analyses and graph representations over that program. The principal workflow is input loading and body conversion, optional body interception, then call-graph and data-flow analysis, with results available as analysis graphs or code property graphs. The README also documents Jimple parsing/serialization and class-hierarchy generation. The supplied source samples are selective, so links for those documented capabilities are shown only at the subsystem level; no unsupported internal call sequence is asserted.
Main entry points: jimple Jimple IR · callgraph Call Graph · BodySource.java Method Bodies · graph Control-Flow Graphs
Components 19
Program Inputs
- Input Locations
sootup.core/src/main/java/sootup/core/inputlocation - APK / Dex Frontend
sootup.apk.frontend/src/main/java/sootup/apk/frontend - Class Providers
sootup.core/src/main/java/sootup/core/frontend - Method Bodies
sootup.core/src/main/java/sootup/core/frontend/BodySource.java
Jimple Model
- Body Interceptors
sootup.core/src/main/java/sootup/core/interceptor - Jimple IR
sootup.core/src/main/java/sootup/core/jimple - Jimple Parse / Serialize
sootup.core/src/main/java/sootup/core/jimple
Program Graphs
- Class Hierarchy
sootup.core/src/main/java/sootup/core - Call Graph
sootup.callgraph/src/main/java/sootup/callgraph - Control-Flow Graphs
sootup.core/src/main/java/sootup/core/graph - Interprocedural CFG
sootup.analysis.interprocedural/src/main/java/sootup/analysis/interprocedural/icfg
Static Analysis
- Intraprocedural Analysis
sootup.analysis.intraprocedural/src/main/java/sootup/analysis/intraprocedural - Reaching Definitions
sootup.analysis.intraprocedural/src/main/java/sootup/analysis/intraprocedural/reachingdefs/ReachingDefs.java - IFDS / IDE Solvers
sootup.analysis.interprocedural/src/main/java/sootup/analysis/interprocedural - Pointer Analysis
sootup.qilin/src/main/java/qilin
Graph Representations
- Code Property Graph
sootup.codepropertygraph/src/main/java/sootup/codepropertygraph
Other components
- Library User
- Program Files
- Analysis Results
Connections 27
- Library User → Input Locations: selects inputs
- Program Files → Input Locations: provides files
- Input Locations → Class Providers: resolves classes
- Program Files → APK / Dex Frontend: provides APK
- APK / Dex Frontend → Method Bodies: provides Dex bodies
- Class Providers → Method Bodies: provides sources
- Method Bodies → Body Interceptors: intercepts bodies
- Method Bodies → Jimple IR: produces Jimple
- Body Interceptors → Jimple IR: transforms bodies
- Library User → Jimple Parse / Serialize: parses or serializes
- Jimple IR → Class Hierarchy: supports resolution
- Jimple IR → Call Graph: analyzes calls
- Class Hierarchy → Call Graph: resolves targets
- Jimple IR → Control-Flow Graphs: builds control flow
- Control-Flow Graphs → Intraprocedural Analysis: supports flow analysis
- Intraprocedural Analysis → Reaching Definitions: implements analysis
- Control-Flow Graphs → Interprocedural CFG: extends across methods
- Interprocedural CFG → IFDS / IDE Solvers: supports tabulation
- Call Graph → Interprocedural CFG: connects methods
- Jimple IR → Pointer Analysis: analyzes pointers
- Call Graph → Pointer Analysis: guides reachability
- Jimple IR → Code Property Graph: builds graph
- Call Graph → Analysis Results: produces graph
- Intraprocedural Analysis → Analysis Results: produces facts
- IFDS / IDE Solvers → Analysis Results: produces facts
- Pointer Analysis → Analysis Results: produces points-to results
- Code Property Graph → Analysis Results: exposes representation