Closed mdkk closed 9 months ago
{
"ConstStringTest1": {
"SliceMode": true,
"traceDepth": 28,
"desc": {
"name": "test",
"category": "ConstStringTest",
"detail": "ConstStringTest",
"wiki": "",
"possibility": "4",
"model": "middle"
},
"minLen": 2,
"source": {
"ConstString": [
"android.telephony.TelephonyManager"
]
},
"sink": {
"<com.example.test.util.test: * doTest()>": {
"TaintCheck": [
"p"
]
}
}
}
}
"next": {
"@this->ret": {
"I": [
"@this"
],
"O": [
"ret"
]
},
"@this.data->ret": {
"I": [
"@this.data"
],
"O": [
"ret"
]
}
},
EngineConfig.json5中的PointerFlowRule和VariableFlowRule非常强大,用于覆盖appshark的默认分析方式,可以根据自己的需要,自行调整。
测试代码如下:
package com.example.test.util;
package com.example.test;
测试规则:
{ "ConstStringTest1": { "ConstStringMode": true, "traceDepth": 26, "desc": { "name": "test", "category": "ConstStringTest", "detail": "ConstStringTest", "wiki": "", "possibility": "4", "model": "middle" }, "targetStringArr": ["android.telephony.TelephonyManager"], "minLen": 2, "source": { "ConstString": ["android.telephony.TelephonyManager"] }, "sink": { "<com.example.test.util.test: doTest()>": { "TaintCheck": [ "p*" ] } } } }