Creating a class from scratch

First, we need to create a class to put methods into. The following steps are necessary to create a class file.

Loading java.lang.Object and Library Classes

Load java.lang.Object, the root of the Java class hierarchy.

This step is not necessary when building code that extends the Soot framework; in that case, loading of classfiles is already done when user code is called.

Scene.v().loadClassAndSupport("java.lang.Object");

This line of code causes Soot to load the java.lang.Object class and create the corresponding SootClass object, as well as SootMethods and SootFields for its fields. Of course, java.lang.Object has references to other objects. The call to loadClassAndSupport will load the transitive closure of the specified class, so that all types needed in order to load java.lang.Object are themselves loaded.

This process is known as resolution.

Since our HelloWorld program will be using classes in the standard library, we must also resolve these:

Scene.v().loadClassAndSupport("java.lang.System");

These lines reference Scene.v(). The Scene is the container for all of the SootClasses in a program, and provides various utility methods. There is a singleton Scene object, accessible by calling Scene.v().

Implementation note: Soot loads these classes from either classfiles or .jimple input files. When the former is used, Soot will load all class names referred to in the constant pool of each class file. Loading from .jimple will make Soot load only the required types.

Creation of a new SootClass object

Create the `HelloWorld' SootClass, and set its super class as ``java.lang.Object''.

sClass = new SootClass("HelloWorld", Modifier.PUBLIC);

This code creates a SootClass object for a public class named HelloWorld.

sClass.setSuperclass(Scene.v().getSootClass("java.lang.Object"));

This sets the superclass of the newly-created class to the SootClass object for java.lang.Object. Note the use of the utility method getSootClass on the Scene.

Scene.v().addClass(sClass);

This adds the newly-created HelloWorld class to the Scene. All classes should belong to the Scene once they are created.

Adding methods to SootClasses

Create a main() method for HelloWorld with an empty body.

Now that we have a SootClass, we need to add methods to it.

method = new SootMethod("main",                 
    Arrays.asList(new Type[] {ArrayType.v(RefType.v("java.lang.String"), 1)}),
    VoidType.v(), Modifier.PUBLIC | Modifier.STATIC);

We create a new public static method, main, declare that it takes an array of java.lang.String objects, and that it returns void.

The constructor for SootMethod takes a list, so we call the Java utility method Arrays.asList to create a list from the one-element array which we generate on the fly with new Type[] ... . In the list, we put an array type, corresponding to a one-dimensional ArrayType of java.lang.String objects. The call to RefType fetches the type corresponding to the java.lang.String class.

Types Each SootClass represents a Java object. We can instantiate the class, giving an object with a given type. The two notions - type and class - are closely related, but distinct. To get the type for the java.lang.String class, by name, we call RefType.v("java.lang.String"). Given a SootClass object sc, we could also call sc.getType() to get the corresponding type.

sClass.addMethod(method);

This code adds the method to its containing class.

Adding code to methods

A method is useless if it doesn't contain any code. We proceed to add some code to the main method. In order to do so, we must pick an intermediate representation for the code.

Create JimpleBody

In Soot, we attach a Body to a SootMethod to associate some code with the method. Each Body knows which SootMethod it corresponds to, but a SootMethod only has one active Body at once (accessible via SootMethod.getActiveBody()). Different types of Body's are provided by the various intermediate representations; Soot has JimpleBody,ShimpleBody, BafBody and GrimpBody.

More precisely, a Body has three important features: chains of Locals, Traps and Units. A Chain is a list-like structure that provides O(1) access to insert and delete elements. Locals are the local variables in the body; Traps say which units catch which exceptions; and Units are the statements themselves.

Note that Unit is the term which denotes both statements (as in Jimple) and instructions (as in Baf).

Create a Jimple Body for main class, adding locals and instructions to body.

JimpleBody body = Jimple.v().newBody(method);
method.setActiveBody(body);

We call the Jimple singleton object to get a new JimpleBody associated with our method, and make it the active body for our method.

Adding a Local

arg = Jimple.v().newLocal("l0", ArrayType.v(RefType.v("java.lang.String"), 1));
body.getLocals().add(arg);

We create a few new Jimple Locals and add them to our Body.

Adding a Unit

units.add(Jimple.v().newIdentityStmt(arg, 
      Jimple.v().newParameterRef(ArrayType.v
        (RefType.v("java.lang.String"), 1), 0)));

The SootMethod declares that it has parameters, but these are not bound to the Locals of the Body. The IdentityStmt does this; it assigns into arg the value of the first parameter, which has type array of strings.

// insert "tmpRef.println("Hello world!")"
{
    SootMethod toCall = Scene.v().getMethod
      ("<java.io.PrintStream: void println(java.lang.String)>");
    units.add(Jimple.v().newInvokeStmt
        (Jimple.v().newVirtualInvokeExpr
           (tmpRef, toCall.makeRef(), StringConstant.v("Hello world!"))));
}

We get the method with signature <java.io.PrintStream: void println(java.lang.String)> (it is named println, belongs to PrintStream, returns void and takes a String as its argument - this is enough to uniquely identify the method), and invoke it with the StringConstant "Hello world!".

Write to class file

The preferred way to write the program as a .class file is using ASM backend.

int java_version = Options.v().java_version();
String fileName = SourceLocator.v().getFileNameFor(sClass, Options.output_format_class);
OutputStream streamOut = new FileOutputStream(fileName);
BafASMBackend backend = new BafASMBackend(sClass, java_version);
backend.generateClassFile(streamOut);
streamOut.close();

It is also possible to use the outdated Jasmin backend. We first construct the output stream that will take Jasmin source and output a .class file. We can either specify the filename manually, or we can let Soot determine the correct filename. We do the latter, here.

String fileName = SourceLocator.v().getFileNameFor(sClass, Options.output_format_class);
OutputStream streamOut = new JasminOutputStream(new FileOutputStream(fileName));
PrintWriter writerOut = new PrintWriter(new OutputStreamWriter(streamOut));
JasminClass jasminClass = new soot.jimple.JasminClass(sClass);
jasminClass.print(writerOut);
writerOut.flush();
streamOut.close();

If we wished to output jimple source instead of a .class file, we would use the following code:

String fileName = SourceLocator.v().getFileNameFor(sClass, Options.output_format_jimple);
OutputStream streamOut = new FileOutputStream(fileName);
PrintWriter writerOut = new PrintWriter(new OutputStreamWriter(streamOut));
Printer.v().printTo(sClass, writerOut);
writerOut.flush();
streamOut.close();

We have omitted the JasminOutputStream, and are calling the printTo method on Printer.

The Jimple created for the HelloWorld class is:

public class HelloWorld extends java.lang.Object
{
   public static void main(java.lang.String[])
   {
       java.lang.String[] r0;
       java.io.PrintStream r1;

       r0 := @parameter0: java.lang.String[];
       r1 = <java.lang.System: java.io.PrintStream out>;
       virtualinvoke r1.<java.io.PrintStream: void println(java.lang.String)>("Hello world!");
       return;
   }
}

A file with the whole working file of this tutorial can be found here