Undeclared Method isMethodSynthetic being called in LibraryProfiler.java 155 and many other places

[chamorajg]

isMethodSyntetic is not a method in IMethod class in com.ibm.wala.classLoader . There is a method named isSynthetic which is defined instead.
Here is the link https://www.ibm.com/support/knowledgecenter/SSS9LM_9.0.0/com.ibm.rational.appscansrc.utilities.osx.doc/api/com/ibm/wala/classLoader/IMethod.html

[reddr]

You are right. I added isMethodSynthetic to prevent undesired side-effects. Large parts of the code always assumed isSynthetic to return false. By correctly implementing this functionality, I encountered quite a number of issues at various places. As I'm unsure about all the possible side-effects in the WALA code base, I decided to add this new class that only my code is calling.

Find attached the patch I applied. If someone is familiar with the WALA code base, I would for sure welcome to get rid of this extra method again.
wala_add_check_synthethic_methods.txt

[chamorajg]

Thank you sir for your reply.
One more issue is to be answered.
At
->/src/de/infsec/tpl/utils/WalaUtils.java:243

eturn clazz.getClassHierarchy().getScope().isApplicationLoader(clazz.getClassLoader()) && !isAndroidResourceClass(clazz) && !isEmptyInnerClass && !clazz.isSynthetic()
symbol: method isSynthetic()
location: variable clazz of type IClass
IClass is using the method isSynthetic() which is actually an IMethod function. So is there any patch to this or any correction as of now ???
Thanks for your early reply.

[eighthave]

Seems like this patch should either be included by upstream in WALA, or it should be handled by changing the code in LibScout. It is generally better to fix things in their code base than patch them in Debian.

[eighthave]

If WALA upstream accepts the patch, then we'll just included it in the Debian WALA package immediately.

[eighthave]

If WALA upstream accepts the patch, then we'll just included it in the Debian WALA package immediately.

[reddr]

@ryuzaki-yagami clazz.isSythetic is referring to IClass.isSynthetic not IMethod. This was already integrated in the WALA code and is not something I added. Thus, the code is correct.

@eighthave The problem with the IMethod.isSynthethic patch is that it might have side-effects on other WALA code. Including the patch is trivial, however checking the entire WALA code is very time-consuming if you're not familiar with all the internals.

[chamorajg]

@reddr isSynthetic is an IMethod function but clazz is an IClass member so it creates an error if clazz was a variable of IClass it would have been correct.

[reddr]

Can't follow you on this. In this code location (WalaUtils.isAppClass), the clazz variable is of type IClass and calls the isSynthetic method defined by the WALA framework. Can't see any issue there.

[eighthave]

perhaps separate from the issue in the title of this, if LibScout requires a patched version of WALA to work, that makes it a lot harder to manage inside of Debian. We couldn't include a second, patched WALA since general Debian does not allow multiple packages from the same source. This is to keep the security profile manageable. It also doesn't feel right to make Debian only include the WALA patched for LibScout since that decision should be made by the WALA community, not the Debian packager. How about submitting your WALA patch upstream to see what they say?

[reddr]

@eighthave This is more than just submitting a single patch. I adopted WALA from the JOANA project (https://github.com/joana-team/joana). They integrated SCanDroids WALA dex frontend and developed it further. There were plans to, at some point, submit this dex frontend upstream, but I haven't checked the current status for a while.

LibScout uses JOANA's fork WALA. I applied around 10 additional patches on top of their code base (mainly fixing bugs, 2-3 to customize functionalty to fit my needs). A few patches might be already in their code base, but I haven't followed the development for at least a year, As I rarely change code in this WALA fork, I decided to ship the pre-compiled custom jar for convenience since I don't have time to check both the fork and whatever is merged into the WALA master.

[reddr]

Moving to WALA master is now discussed in #20.