Points-to analysis工具Doop的命令行参数

接前两篇博客，这里总结一下Doop的命令行参数，另外记录一下我没搞清楚的一些东西。

在终端里运行：

./doop --help all

可以看到其给出一些参数选项：

== Configuration options ==
 -a,--analysis <NAME>                                      The name of the analysis. Valid values: 1-call-site-sensitive, 1-call-site-sensitive+heap, 1-object-1-type-sensitive+heap, 1-object-sensitive,
                                                           1-object-sensitive+heap, 1-type-sensitive, 1-type-sensitive+heap, 2-call-site-sensitive+2-heap, 2-call-site-sensitive+heap,
                                                           2-object-sensitive+2-heap, 2-object-sensitive+heap, 2-type-object-sensitive+2-heap, 2-type-object-sensitive+heap, 2-type-sensitive+heap,
                                                           3-object-sensitive+3-heap, 3-type-sensitive+2-heap, 3-type-sensitive+3-heap, adaptive-2-object-sensitive+heap, basic-only, context-insensitive,
                                                           context-insensitive-plus, context-insensitive-plusplus, data-flow, dependency-analysis, fully-guided-context-sensitive, micro,
                                                           partitioned-2-object-sensitive+heap, selective-2-object-sensitive+heap, sound-may-point-to, sticky-2-object-sensitive, types-only, xtractor,
                                                           ----- (LB analyses) -----, 2-object-sensitive+heap-plus, adaptive-insens-2objH, adaptive2-insens-2objH, must-point-to, naive,
                                                           paddle-2-object-sensitive, paddle-2-object-sensitive+heap, partial-insens-s2objH, refA-2-call-site-sensitive+heap, refA-2-object-sensitive+heap,
                                                           refA-2-type-sensitive+heap, refB-2-call-site-sensitive+heap, refB-2-object-sensitive+heap, refB-2-type-sensitive+heap,
                                                           scc-2-object-sensitive+heap, selective-2-type-sensitive+heap, selective_A-1-object-sensitive, selective_B-1-object-sensitive,
                                                           special-2-object-sensitive+heap, stutter-2-object-sensitive+heap, uniform-1-object-sensitive, uniform-2-object-sensitive+heap,
                                                           uniform-2-type-sensitive+heap
    --android                                              Force Android mode for code inputs that are not in .apk format.
    --app-only                                             Only analyze the application input(s), ignore libraries/platform.
    --auto-app-regex-mode <MODE>                           When no app regex is given, either compute an app regex for the first input ('first') or for all inputs ('all').
    --cfg                                                  Perform a CFG analysis.
    --coarse-grained-allocation-sites                      Aggressively merge allocation sites for all regular object types, in lib and app alike.
    --constant-folding                                     Enable constant folding logic.
    --cs-library                                           Enable context-sensitive analysis for internal library objects.
    --dacapo                                               Load additional logic for DaCapo (2006) benchmarks properties.
    --dacapo-bach                                          Load additional logic for DaCapo (Bach) benchmarks properties.
    --define-cpp-macro <MACRO>                             Define a C preprocessor macro that will be available in analysis logic.
    --disable-merge-exceptions                             Do not merge exception objects.
    --disable-points-to                                    Disable (most) points-to analysis reasoning. This should only be combined with analyses that compensate (e.g., types-only).
    --distinguish-all-string-buffers                       Avoids merging string buffer objects (not recommended).
    --distinguish-all-string-constants                     Treat string constants as regular objects.
    --dry-run                                              Do a dry run of the analysis (generate facts and compile but don't run analysis logic).
    --extra-logic <FILE>                                   Include files with extra rules.
    --featherweight-analysis                               Perform a featherweight analysis (global state and complex objects immutable).
    --gen-opt-directives                                   Generate additional relations for code optimization uses.

按道理来说都应该可以运行才对啊，可是当我尝试运行：

./doop -a must-point-to --app-only -i docs/doop-101-examples/Example.jar

就会报错：

Unsupported analysis: must-point-to
java.lang.RuntimeException: Unsupported analysis: must-point-to
        at org.clyze.utils.FileOps.findFileOrThrow(FileOps.groovy:60)
        at org.clyze.utils.FileOps.findFileOrThrow(FileOps.groovy:54)
        at org.clyze.doop.core.DoopAnalysisFactory.checkAnalysis(DoopAnalysisFactory.groovy:206)
        at org.clyze.doop.core.DoopAnalysisFactory.newAnalysis(DoopAnalysisFactory.groovy:130)
        at org.clyze.doop.core.DoopAnalysisFactory.newAnalysis(DoopAnalysisFactory.groovy:113)
        at org.clyze.doop.command.CommandLineAnalysisFactory.newAnalysis(CommandLineAnalysisFactory.groovy:96)
        at org.clyze.doop.Main.main2(Main.groovy:103)
        at org.clyze.doop.Main.main(Main.groovy:33)
ERROR: Unsupported analysis: must-point-to

这个真的是太奇怪了，看来是help没有及时更新吧？？

再仔细看一下，打开这个文件：doop/src/main/groovy/org/clyze/doop/core/DoopAnalysisFactory.groovy，可以看到其有这些代码：

	static final availableConfigurations = [
			"dependency-analysis"                : "TwoObjectSensitivePlusHeapConfiguration",
			"types-only"                         : "TypesOnlyConfiguration",
			"context-insensitive"                : "ContextInsensitiveConfiguration",
			"context-insensitive-plus"           : "ContextInsensitivePlusConfiguration",
			"context-insensitive-plusplus"       : "ContextInsensitivePlusPlusConfiguration",
			"1-call-site-sensitive"              : "OneCallSiteSensitiveConfiguration",
			"1-call-site-sensitive+heap"         : "OneCallSiteSensitivePlusHeapConfiguration",
			"1-type-sensitive"                   : "OneTypeSensitiveConfiguration",
			"1-type-sensitive+heap"              : "OneTypeSensitivePlusHeapConfiguration",
			"1-object-sensitive"                 : "OneObjectSensitiveConfiguration",
			"1-object-sensitive+heap"            : "OneObjectSensitivePlusHeapConfiguration",
			"2-call-site-sensitive"              : "TwoCallSiteSensitiveConfiguration",
			"2-call-site-sensitive+heap"         : "TwoCallSiteSensitivePlusHeapConfiguration",
			"2-call-site-sensitive+2-heap"       : "TwoCallSiteSensitivePlusTwoHeapConfiguration",
			"2-type-sensitive"                   : "TwoTypeSensitiveConfiguration",
			"2-type-sensitive+heap"              : "TwoTypeSensitivePlusHeapConfiguration",
			"2-object-sensitive"                 : "TwoObjectSensitiveConfiguration",
			"2-object-sensitive+heap"            : "TwoObjectSensitivePlusHeapConfiguration",
			"fully-guided-context-sensitive"     : "FullyGuidedContextSensitiveConfiguration",
			"special-2-type-sensitive+heap"      : "SpecialTwoTypeSensitivePlusHeapConfiguration",
			"2-object-sensitive+2-heap"          : "TwoObjectSensitivePlusTwoHeapConfiguration",
			"3-object-sensitive+3-heap"          : "ThreeObjectSensitivePlusThreeHeapConfiguration",
			"2-type-object-sensitive+heap"       : "TwoTypeObjectSensitivePlusHeapConfiguration",
			"2-type-object-sensitive+2-heap"     : "TwoTypeObjectSensitivePlusTwoHeapConfiguration",
			"3-type-sensitive+2-heap"            : "ThreeTypeSensitivePlusTwoHeapConfiguration",
			"3-type-sensitive+3-heap"            : "ThreeTypeSensitivePlusThreeHeapConfiguration",
			"selective-2-object-sensitive+heap"  : "SelectiveTwoObjectSensitivePlusHeapConfiguration",
			"partitioned-2-object-sensitive+heap": "PartitionedTwoObjectSensitivePlusHeapConfiguration",
			"1-object-1-type-sensitive+heap"     : "OneObjectOneTypeSensitivePlusHeapConfiguration",
			"web-app-sensitive"                  : "WebAppSensitiveConfiguration",
			"sticky-2-object-sensitive"          : "StickyTwoObjectSensitiveConfiguration",
			"adaptive-2-object-sensitive+heap"   : "AdaptiveTwoObjectSensitivePlusHeapConfiguration"
	]

看来上面--help中显示的选项确实有很多没有啊！！

另外，打开这个文件：doop/src/main/groovy/org/clyze/doop/core/DoopAnalysisFamily.groovy，可以看到一些关于must analysis的选项：

			/* TODO: deprecated or broken? */
			new AnalysisOption<String>(
					id: "MUST",
					name: "must",
					description: "Run the must-alias analysis.",
					cli: false
			),
			new BooleanAnalysisOption(
					id: "MUST_AFTER_MAY",
					cli: false,
					forPreprocessor: true
			),
			new BooleanAnalysisOption(
					id: "TRANSFORM_INPUT",
					name: "transform-input",
					description: "Transform input by removing redundant instructions.",
					forPreprocessor: true,
					cli: false
			),

但是似乎已经没什么作用了。不得不说，Doop的开发和文档还是很靠谱的，但是还存在这种细节上的问题，呵呵，也不知道该怎么办了。