search

secure-software-engineering / FlowDroid

FlowDroid Static Data Flow Tracker
GNU Lesser General Public License v2.1
1.02k stars 292 forks source link

Design my own source and sinks #600

Open TDklm opened 1 year ago

TDklm commented 1 year ago

Hello guys I'm a fresh man in this field,trying to find source and sinks in apk. But in the past days I have ran the test apks and follow the process. Now I just know may be I should design them in sourcesAndSinks.xml. Another questions is if I want to test thousands of apks， I think after I give the source and sinks as a set Flowdroid can automatic matching them in different apks is it right? SourcesAndSinksOldFormat.xml this expression looks more intuitive and concise. Can I still define it in this way Last question the purpose of sourcesAndSinks.txt, Thank you in advance

StevenArzt commented 1 year ago

You only provide a source/sink definition. FlowDroid will match these definitions against each APK individually. The normal source/sink definitions are not specific to a single APK.

There are two different formats in which you can specify sources and sinks: The simple, but not very expressive textual format and the much more expressive XML format. You choose depending on your requirements. The repository contains examples for both formats.

TDklm commented 1 year ago

Here is my long overdue thank you. The previous problems has been solved. Now I want to find out the transmit of dataflow between different functions or API ，or understood as path of the dataflow between source and sink.My current idea is based on IFDS to output related nodes of the callgraph to make the path.Is this method feasible？ I'm trying to find out where to modify the project to make it out put the path of the dataflow. Thank you！

StevenArzt commented 1 year ago

FlowDroid can report the data flow path, i.e., all statements on the data flow path. If you use FlowDroid inside your own program, you need to set InfoflowConfiguration.PathConfiguration.pathReconstructionMode. If you use FlowDroid as a command-line application, specify the -cp option.