arguslab / Argus-SAF

Argus static analysis framework
Apache License 2.0
181 stars 49 forks source link

about line mapping information #46

Closed tiandiyixian closed 6 years ago

tiandiyixian commented 6 years ago

Hi, Is there any way to identify line mapping information from jara file to java file,The current taint report are for jara files, not at the source java level. Can you give some advice for implementation? thanks!

fgwei commented 6 years ago

Java line number information is not available at the bytecode level. And if you are analyzing the bytecode, you will not have the access to its source code. (Otherwise, we can just apply the source code analyze.)

tiandiyixian commented 6 years ago

I think you may have misunderstood what I meant. What I mean is that in the final analysis of the results, the current defect information is mapped to the source code information.At least javac turned on debug compilation mode, bytecode file can retain line number mapping information, but I don't know if Argus is taken into account when converting from dex to jara files? Is there such an interface or API?

fgwei commented 6 years ago

You mean covert dex to jawa? jawa is able to track the source code number if it is there. But I don't think dex keeps the source code line number information.

tiandiyixian commented 6 years ago

谢谢,看了您的一些介绍,那我就用中文回复了。我的意思是源代码经过编译到class文件再到dex,这块应该是可以在编译的时候加debug信息,分析完jawa文件后,然后用来实现对源码级别(java文件层面)的问题回溯(jawa-java的行号映射),而不是报告jawa文件上代码问题。看了argus的相关代码,应该是暂未加上这块实现,我已经找到org.jf.dexlib2.dexbacked.de.DexBackedMethod上提供了关于getDebugItem这个函数可以实现行号的映射,再次感谢