ANALYZING JAVA WITH THE SAWJA FRAMEWORK F ROM RESEARCH - PowerPoint PPT Presentation

ANALYZING JAVA WITH THE SAWJA FRAMEWORK F ROM RESEARCH SPECIFICATIONS TO REALISTIC TOOLS Laurent Hubert and David Pichardie INRIA Rennes, France FMCO 2010 COST Action IC0701 Session 30 November 2010 Tuesday, November 30, 2010 1

Static Analysis & Type Systems • Powerful and automatic verification techniques • Should never miss a true alarm • a soundness proof ensures it • Necessarily incomplete (i.e., raise false alarms ) • static analyses return «I don’t know» • some correct programs do not type checked • an experimental evaluation should ensure that false alarms does not appear too often in practice Tuesday, November 30, 2010 2

Static Verification of Java Tuesday, November 30, 2010 3

Static Verification of Java • Provides already a strong type system (BCV) class Point{ _x,_y; Point( x, y){ _x = x; _y = y; } equal( p){...} } Tuesday, November 30, 2010 3

Static Verification of Java • Provides already a strong type system (BCV) class Point{ _x,_y; Float Point( x, y){ int int _x = x; _y = y; } boolean equal( p){...} Point } Tuesday, November 30, 2010 3

Static Verification of Java • Provides already a strong type system (BCV) class Point{ _x,_y; Float Point( x, y){ int int _x = x; _y = y; Error! } boolean equal( p){...} Point } Tuesday, November 30, 2010 3

Static Verification of Java • Provides already a strong type system (BCV) • Many extensions are possible class Point{ • Java annotation system _x,_y; Float • allows to specify new types Point( x, y){ int int _x = x; _y = y; Error! } boolean equal( p){...} Point } Tuesday, November 30, 2010 3

Static Verification of Java • Provides already a strong type system (BCV) • Many extensions are possible class Point{ @NonNull • Java annotation system _x,_y; Float • allows to specify new types Point( x, y){ int int • e.g., overrides, _x = x; _y = y; Error! nullness type system } @overrides boolean equal( p){...} Point } Error! Tuesday, November 30, 2010 3

Static Verification of Java • Provides already a strong type system (BCV) !"#$"% • Many extensions are possible -./%0.% &'()*+$&, class Point{ $"'$1%#0%, @NonNull • Java annotation system _x,_y; Float • allows to specify new types Point( x, y){ int int • e.g., overrides, _x = x; _y = y; Error! nullness type system } • but does not provide support @overrides boolean for type checking them equal( p){...} Point } Error! Tuesday, November 30, 2010 3

Tuesday, November 30, 2010 4

Soundness Formal specification and proof Tuesday, November 30, 2010 4

Precision Soundness Formal specification Prototype and proof Tuesday, November 30, 2010 4

Precision Soundness Formal specification Prototype and proof Exceptions Proved JVM spec Lazy class loading on a toy compliant language Interfaces ... Tuesday, November 30, 2010 4

Formal specification Prototype and proof Exceptions Proved JVM spec Lazy class loading on a toy compliant language Interfaces ... Tuesday, November 30, 2010 4

Formal specification a backend: Prototype and the Sawja framework proof Exceptions Proved JVM spec Lazy class loading on a toy compliant language Interfaces ... Tuesday, November 30, 2010 4

Outlines • The Sawja framework [FoVeOOS'10] • A type system for Secure Object Initialization [ESORICS'10] • An implementation based on Sawja Tuesday, November 30, 2010 5

Sawja • OCaml library for developing Java bytecode static analyses (Gnu LGPL) • High level intermediate representation (language) • Transformation proven sound • High level API for efficient browsing of class hierarchy Did you ever look at the method resolution specification ? • Implements a large part of the JVM Specification (structural constraints, resolution, lookups, control flow, etc.) • Efficient Tuesday, November 30, 2010 6

Intermediate Representation • In a few words • Stackless representation, no sub-routines, etc. • Stingy with local variables • Time efficient • Formally proved on paper • More information D. Demange, T. Jensen, and D. Pichardie. A provably correct stackless intermediate representation for Java bytecode . APLAS’10. Tuesday, November 30, 2010 7

Several code representations type jopcode = | OpF2L | OpLoad of jvm_type * int | OpF2D | OpStore of jvm_type * int | OpD2I type opcode = | OpF2I | OpIInc of int * int | OpD2L | OpNop | OpF2L | OpPop | OpD2F | OpAConstNull | OpF2D | OpPop2 | OpI2B | OpIConst of int32 | OpD2I | OpDup | OpI2C | OpLConst of int64 | OpD2L | OpDupX1 | OpI2S | OpFConst of float | OpD2F | OpDupX2 | OpCmp of [ `DG | `DL | `FG | `FL | `L ] | OpDConst of float | OpI2B | OpDup2 | OpIf of [ `Eq | `Ge | `Gt | `Le | `Lt | `Ne | `NonNull | | OpBIPush of int | OpI2C | OpDup2X1 `Null ] * int | OpSIPush of int | OpI2S | OpDup2X2 | OpIfCmp of [ `AEq | `ANe | `IEq | `IGe | `IGt | `ILe | `ILt | | OpLdc1 of int | OpLCmp | OpSwap `INe ] * int | OpLdc1w of int | OpFCmpL | OpConst of [ `ANull | `Byte of int | OpGoto of int | OpLdc2w of int | OpFCmpG | `Class of object_type | OpJsr of int | OpLoad of jvm_basic_type * int | OpDCmpL | `Double of float | `Float of float | `Int of int32 Default | OpRet of int | OpALoad of int | OpDCmpG | `Long of int64 | `Short of int | `String of string ] | OpTableSwitch of int * int32 * int32 * int array | OpArrayLoad of [ `Double | `Float | `Int | `Long ] | OpIfEq of int | OpAdd of jvm_basic_type | OpLookupSwitch of int * (int32 * int) list | OpAALoad | OpIfNe of int | OpSub of jvm_basic_type | OpNew of class_name | OpBALoad | OpIfLt of int | OpMult of jvm_basic_type | OpNewArray of value_type | OpCALoad | OpIfGe of int | OpDiv of jvm_basic_type | OpAMultiNewArray of object_type * int | OpSALoad | OpIfGt of int Instruction | OpRem of jvm_basic_type representation | OpCheckCast of object_type | OpStore of jvm_basic_type * int | OpIfLe of int | OpNeg of jvm_basic_type | OpInstanceOf of object_type | OpAStore of int | OpICmpEq of int | OpIShl | OpGetStatic of class_name * field_signature | OpArrayStore of [ `Double | `Float | `Int | `Long ] | OpICmpNe of int | OpLShl | OpPutStatic of class_name * field_signature | OpAAStore | OpICmpLt of int | OpIShr | OpGetField of class_name * field_signature | OpBAStore | OpICmpGe of int | OpLShr | OpPutField of class_name * field_signature | OpCAStore | OpICmpGt of int | OpIUShr | OpArrayLength | OpSAStore | OpICmpLe of int | OpLUShr sets | OpArrayLoad of jvm_array_type | OpPop | OpACmpEq of int | OpIAnd | OpArrayStore of jvm_array_type | OpPop2 | OpACmpNe of int | OpLAnd | OpInvoke of [ `Interface of class_name | OpDup | OpGoto of int | OpIOr | `Special of class_name | OpDupX1 | OpJsr of int | OpLOr | `Static of class_name | OpDupX2 | OpRet of int | OpIXor | `Virtual of object_type ] * method_signature | OpDup2 | OpTableSwitch of int * int32 * int32 * int array | OpLXor | OpReturn of jvm_return_type | OpDup2X1 | OpLookupSwitch of int * (int32 * int) list | OpI2L | OpThrow | OpDup2X2 | OpReturn of jvm_basic_type | OpI2F | OpMonitorEnter | OpSwap | OpAReturn | OpI2D | OpMonitorExit | OpAdd of jvm_basic_type | OpReturnVoid | OpL2I Low level | OpNop | OpSub of jvm_basic_type | OpGetStatic of int | OpL2F | OpBreakpoint | OpMult of jvm_basic_type | OpPutStatic of int | OpL2D | OpInvalid | OpDiv of jvm_basic_type | OpGetField of int | OpF2I | OpRem of jvm_basic_type | OpPutField of int | OpNeg of jvm_basic_type | OpInvokeVirtual of int representation | OpIShl | OpInvokeNonVirtual of int type instr = | OpLShl | OpInvokeStatic of int | Nop | OpIShr | OpInvokeInterface of int * int | AffectVar of var * expr | OpLShr | OpNew of int | AffectArray of expr * expr * expr | OpIUShr | OpNewArray of java_basic_type | AffectField of expr * class_name * field_signature * expr Intermediate | OpLUShr | OpANewArray of int | AffectStaticField of class_name * field_signature * expr | OpIAnd | OpArrayLength | Goto of int | OpLAnd | OpThrow | Ifd of ([ `Eq | `Ge | `Gt | `Le | `Lt | `Ne ] * expr * expr) * int | OpIOr | OpCheckCast of int | Throw of expr | OpLOr | OpInstanceOf of int | Return of expr option representation | OpIXor | OpMonitorEnter | New of var * class_name * value_type list * expr list | OpLXor | OpMonitorExit | NewArray of var * value_type * expr list | OpIInc of int * int | OpAMultiNewArray of int * int | InvokeStatic of var option * class_name * method_signature * expr list | OpI2L | OpIfNull of int | InvokeVirtual of var option * expr * virtual_call_kind * method_signature * expr list | OpI2F | OpIfNonNull of int | InvokeNonVirtual of var option * expr * class_name * method_signature * expr list | OpI2D | OpGotoW of int | MonitorEnter of expr | OpL2I | OpJsrW of int | MonitorExit of expr | OpL2F | OpBreakpoint | MayInit of class_name | OpL2D | OpInvalid | Check of check Tuesday, November 30, 2010 8

Overview Sawja Static Analysis .class oriented Javalib (IR, CFG file oriented computation, etc.) (parsing, etc.) Tuesday, November 30, 2010 9