MQP:Static Analysis Tool 0.1 - Revision history

Jpolitz at 19:08, 12 September 2008

2008-09-12T19:08:03Z

Jpolitz at 18:56, 12 September 2008

2008-09-12T18:56:06Z

Jpolitz: /* A Simple Walkthrough */

2008-09-12T18:42:31Z

‎A Simple Walkthrough

Jpolitz: /* A Simple Walkthrough */

2008-09-12T18:42:09Z

‎A Simple Walkthrough

Jpolitz: New page: Category:MQP-Prototypes {{MQP:Navbar}} ==The Prototype== The initial prototype of the static analysis tool is available in this release. The tool at the moment has a simple command...

2008-09-12T18:41:07Z

New page: Category:MQP-Prototypes {{MQP:Navbar}} ==The Prototype== The initial prototype of the static analysis tool is available in this release. The tool at the moment has a simple command...

New page

[[Category:MQP-Prototypes]]

{{MQP:Navbar}}

==The Prototype==

The initial prototype of the static analysis tool is available in this release. The tool at the moment has a simple command line interface, and only has the static analysis tool using Soot available. The current version approximates the security requirements of a program ''very'' conservatively.

==A Simple Walkthrough==

To run the tool, invoke the

<pre>
java -Xmx600m -jar proofOfConcept0-1.jar
</pre>

When the tool is run, a shell prompt should appear like this:

<pre>
SecurityAnalyzer:>
</pre>

The "run" command runs analyses on tools. Currently the only tool available is the "SootAnalysisTool," which has tool number 1. The run command takes in a tool number, a directory in which to the source to be analyzed is located, and the fully qualified java classname of the main class of the application. In the future, it will be easier to specify different entry points other than a main class. To run the included test, invoke the run command as follows:

<pre>
SecurityAnalyzer:> run 1 test/ test.Test
</pre>

This will take a while to run (a very large call graph is being generated). The results of the analysis should appear in the directory in which the jar is located in a file called 'results.txt'. Specify other code sources to analyze by changing the directory to be analyzed, which must be the root of the package structure of the java code to be analyzed.

==Limitations==

Viewing the result file should make it apparent how conservative the tool is right now. Further work on narrowing down the runtime types of virtual method calls could help this somewhat, along with other improvements to the call graph construction. However, this prototype represents a proof of concept of this basic part of the analysis.

@@ Line 25: / Line 25: @@
 <pre>
-SecurityAnalyzer:> run 1 test/ test.Test
+SecurityAnalyzer:> run 1 Tests/ test.Test
 </pre>

@@ Line 9: / Line 9: @@
 ==A Simple Walkthrough==
-To run the tool, invoke the following command (this ensures the JVM will have enough memory to handle such a large call graph).
+To run the tool, invoke the following command (this ensures the JVM will have enough memory to handle the large call graph that will be created).
 <pre>

@@ Line 9: / Line 9: @@
 ==A Simple Walkthrough==
-To run the tool, invoke the
+To run the tool, invoke the following command (this ensures the JVM will have enough memory to handle such a large call graph).
 <pre>
@@ Line 16: / Line 16: @@
-When the tool is run, a shell prompt should appear like this:
+When this runs, a shell prompt should appear like this:
 <pre>

@@ Line 5: / Line 5: @@
 ==The Prototype==
-The initial prototype of the static analysis tool is available in this release.  The tool at the moment has a simple command line interface, and only has the static analysis tool using Soot available.  The current version approximates the security requirements of a program ''very'' conservatively.
+The initial prototype of the static analysis tool is available [https://sourceforge.wpi.edu/sf/frs/do/viewRelease/projects.java_security_analysis_tool/frs.proofofconcept0_1.proofofconcept0_1?_message=1221246979560 here].  The tool at the moment has a simple command line interface, and only has the static analysis tool using Soot available.  The current version approximates the security requirements of a program ''very'' conservatively.
 ==A Simple Walkthrough==