Error when create call graph: cannot convert Object to (Soot-)Constant.

[Gao-Chuan]

Hi folks,

I'm trying to use sootup to analyze apk files. However I met this error when I was trying to create a call graph:

Exception in thread "main" java.lang.IllegalArgumentException: cannot convert Object to (Soot-)Constant.
	at sootup.java.core.ConstantUtil.fromObject(ConstantUtil.java:70)
	at sootup.java.bytecode.frontend.AsmUtil.convertAnnotationValue(AsmUtil.java:376)
	at sootup.java.bytecode.frontend.AsmUtil.createAnnotationUsage(AsmUtil.java:343)
	at sootup.java.bytecode.frontend.AsmClassSource.convertAnnotation(AsmClassSource.java:82)
	at sootup.java.bytecode.frontend.AsmClassSource.lambda$resolveMethods$1(AsmClassSource.java:143)
	at java.base/java.util.stream.ReferencePipeline$3$1.accept(ReferencePipeline.java:197)
	at java.base/java.util.ArrayList$ArrayListSpliterator.forEachRemaining(ArrayList.java:1625)
	at java.base/java.util.stream.AbstractPipeline.copyInto(AbstractPipeline.java:509)
	at java.base/java.util.stream.AbstractPipeline.wrapAndCopyInto(AbstractPipeline.java:499)
	at java.base/java.util.stream.ReduceOps$ReduceOp.evaluateSequential(ReduceOps.java:921)
	at java.base/java.util.stream.AbstractPipeline.evaluate(AbstractPipeline.java:234)
	at java.base/java.util.stream.ReferencePipeline.collect(ReferencePipeline.java:682)
	at sootup.java.bytecode.frontend.AsmClassSource.resolveMethods(AsmClassSource.java:146)
	at sootup.core.model.SootClass.lazyMethodInitializer(SootClass.java:78)
	at com.google.common.base.Suppliers$NonSerializableMemoizingSupplier.get(Suppliers.java:183)
	at sootup.core.model.SootClass.getMethods(SootClass.java:95)
	at sootup.java.core.JavaSootClass.getMethods(JavaSootClass.java:103)
	at sootup.callgraph.AbstractCallGraphAlgorithm.findMainMethod(AbstractCallGraphAlgorithm.java:395)
	at sootup.callgraph.ClassHierarchyAnalysisAlgorithm.initialize(ClassHierarchyAnalysisAlgorithm.java:57)
	at org.example.Main.main(Main.java:61)

Here is my code:

public class Main {
    public static void main(String[] args) {
        String apk_path = "xxx.apk";
        String platform_path = "C:\\Users\\xxx\\AppData\\Local\\Android\\Sdk\\platforms";

        String targetClass = "target.class";
        String targetMethod = "targetMethod";

        JavaProject project =
                JavaProject.builder(new JavaLanguage(8))
                        .addInputLocation(
                                new JavaClassPathAnalysisInputLocation(apk_path))
                        .addInputLocation(
                                new JavaClassPathAnalysisInputLocation(platform_path + "\\android-33\\android.jar")
                        )
                        .build();
        JavaView view = project.createView();

        SootClass<JavaSootClassSource> target_class_obj =
                view.getClass(project.getIdentifierFactory()
                        .getClassType(targetClass))
                        .get();

        SootMethod entrypoint = null;
        CallGraphAlgorithm cha = new ClassHierarchyAnalysisAlgorithm(view);
        CallGraph cg = cha.initialize(Collections.singletonList(entrypoint.getSignature()));
        System.out.println(cg.callCount());
    }
}

I've checked the code, it seems this cha.initialize() should work without argument:

  /**
   * This method initializes and starts the call graph algorithm without given entry points. Before
   * the algorithm is started, all main methods are searched and set as entry points.
   *
   * @return a generated call graph with every main class as starting point.
   */
  @Nonnull
  CallGraph initialize();

[virusdefender]

please upload the apk file to this issue

[swissiety]

Hi, there seems to be a bug with the Annotation conversion. Please use the debugger to look into ConstantUtil.fromObject(...) to find out which type of Object can not be handled there.

[Gao-Chuan]

Hi, there seems to be a bug with the Annotation conversion. Please use the debugger to look into ConstantUtil.fromObject(...) to find out which type of Object can not be handled there.

The obj is:

((String[])obj)[1] = Cannot cast 'org.objectweb.asm.tree.AnnotationNode' to 'java.lang.String[]'
obj = {AnnotationNode@2247} 
 desc = "Lkotlin/ReplaceWith;"
 values = {ArrayList@2520}  size = 4
  0 = "expression"
  1 = "this.sortWith(comparator)"
  2 = "imports"
  3 = {ArrayList@2525}  size = 0
 api = 589824
 av = null

[Gao-Chuan]

please upload the apk file to this issue

It does not relate to a specific apk file. I've tried multiple apk file and met the same error

[JonasKlauke]

mmh it could be the same issue as #668

[Gao-Chuan]

mmh it could be the same issue as #668

Yes it is solved. Thank you!

[Gao-Chuan]

I met another error when creating the call graph. Although I find this error might be similar to this issue: https://github.com/soot-oss/SootUp/issues/528, I still can't find a way to solve it.

Does sootup provide some API like "allow phantom method" to avoid such exceptions?

Here is the error:

Exception in thread "main" sootup.core.frontend.ResolveException: Could not find concrete method for <com.google.android.exoplayer2.source.dash.DashMediaSource$DashTimeline: com.google.android.exoplayer2.Timeline$Window getWindow(int,com.google.android.exoplayer2.Timeline$Window,long)> because the method is abstract ./file-does-not-exist NoPositionInformation
	at sootup.core.typehierarchy.MethodDispatchResolver.resolveConcreteDispatch(MethodDispatchResolver.java:212)
	at sootup.callgraph.ClassHierarchyAnalysisAlgorithm.lambda$resolveAllSubClassCallTargets$4(ClassHierarchyAnalysisAlgorithm.java:114)
	at java.base/java.util.stream.ReferencePipeline$3$1.accept(ReferencePipeline.java:197)
	at java.base/java.util.HashMap$KeySpliterator.forEachRemaining(HashMap.java:1707)
	at java.base/java.util.stream.AbstractPipeline.copyInto(AbstractPipeline.java:509)
	at java.base/java.util.stream.AbstractPipeline.wrapAndCopyInto(AbstractPipeline.java:499)
	at java.base/java.util.stream.ForEachOps$ForEachOp.evaluateSequential(ForEachOps.java:150)
	at java.base/java.util.stream.ForEachOps$ForEachOp$OfRef.evaluateSequential(ForEachOps.java:173)
	at java.base/java.util.stream.AbstractPipeline.evaluate(AbstractPipeline.java:234)
	at java.base/java.util.stream.ReferencePipeline.forEach(ReferencePipeline.java:596)
	at java.base/java.util.stream.ReferencePipeline$7$1.accept(ReferencePipeline.java:276)
	at java.base/java.util.stream.ReferencePipeline$2$1.accept(ReferencePipeline.java:179)
	at java.base/java.util.ArrayList$ArrayListSpliterator.forEachRemaining(ArrayList.java:1625)
	at java.base/java.util.stream.AbstractPipeline.copyInto(AbstractPipeline.java:509)
	at java.base/java.util.stream.AbstractPipeline.wrapAndCopyInto(AbstractPipeline.java:499)
	at java.base/java.util.stream.StreamSpliterators$WrappingSpliterator.forEachRemaining(StreamSpliterators.java:310)
	at java.base/java.util.stream.Streams$ConcatSpliterator.forEachRemaining(Streams.java:734)
	at java.base/java.util.stream.ReferencePipeline$Head.forEach(ReferencePipeline.java:762)
	at sootup.callgraph.AbstractCallGraphAlgorithm.processWorkList(AbstractCallGraphAlgorithm.java:167)
	at sootup.callgraph.AbstractCallGraphAlgorithm.constructCompleteCallGraph(AbstractCallGraphAlgorithm.java:83)
	at sootup.callgraph.ClassHierarchyAnalysisAlgorithm.initialize(ClassHierarchyAnalysisAlgorithm.java:63)
	at org.example.Main.main(Main.java:65)

> Task :Main.main() FAILED

[JonasKlauke]

We now support incomplete inputloactions. Your error was caused by a missing class. It should be fixed in the dev branch. Could you maybe test again before I will close the issue?

[swissiety]

@Gao-Chuan s latestpost should be fixed, but the first one is not If Im not mistaken