search

secure-software-engineering / FlowDroid

FlowDroid Static Data Flow Tracker
GNU Lesser General Public License v2.1
1.03k stars 293 forks source link

Can we use FlowDroid to analyse Java bytecode directly instead of android apps? Any quick suggestions are welcome ! #530

Open neupaneprakash opened 1 year ago

StevenArzt commented 1 year ago

FlowDroid has several modules. The base module soot-infoflow is a pure Java analyzer. Only the second module soot-infoflow-android adds the Android support.

If you need examples on analyzing Java code, have a look at the JUnit test cases in the soot-infoflow module. They are based on pure Java.

neupaneprakash commented 1 year ago

Thank you @StevenArzt ! Can we use FlowDroid to carry out data flow analysis for java based web applications ? If we can how? or if we can't why not? Just any high level suggestions will be helpful.

StevenArzt commented 1 year ago

You need an approproiate dummy main method for analyzing web applications, based on the IEntryPointCreator interface. OpenSource FlowDroid does not have such an implementation for Java web applications. However, our commercial scanner VUSC (which is based on Soot and FlowDroid) has it. We can offer free academic licenses including access to the source code for scholars employed at renowned universities, but it requires a license contract / NDA to be signed.

neupaneprakash commented 1 year ago

Thank you @StevenArzt for your kind and very helpful information. I am an MS scholar primarily working on the domain of program analysis and compiler at School of Computing and Electrical Engineering, Indian Institute of Technology (IIT) Mandi , India. How can I get VUSC license contract? I purely need it for academic research purposes. I will be happy to know about the procedure. Please!