Runtime Exception: Attempt to create VarNode of type boolean during FlowDroid analysis

[DionysisTheodosis]

Description of the Bug:
I encountered a runtime exception during the analysis of an APK using FlowDroid, which is based on Soot. The error occurs while processing a method in the call graph. The error message is as follows:

[main] INFO soot.jimple.infoflow.android.SetupApplication - Constructing the callgraph...
[main] ERROR soot.jimple.toolkits.typing.fast.TypePromotionUseVisitor - Failed Typing in <Fh.Y: java.lang.Object call()> at statement $u-1#220 = staticinvoke <java.lang.Boolean: java.lang.Boolean valueOf(boolean)>($u0#1): Is not cast compatible: boolean <-- [0..127]
[main] ERROR soot.jimple.infoflow.android.SetupApplication - Could not calculate callback methods
java.lang.RuntimeException: An error occurred while processing <rQ.c: java.lang.Object invoke(java.lang.Object)> in callgraph
at soot.jimple.spark.solver.OnFlyCallGraph.processReachables(OnFlyCallGraph.java:125)
at soot.jimple.spark.solver.OnFlyCallGraph.build(OnFlyCallGraph.java:106)
at soot.jimple.spark.solver.PropWorklist.handleVarNode(PropWorklist.java:157)
at soot.jimple.spark.solver.PropWorklist.propagate(PropWorklist.java:80)
at soot.jimple.spark.SparkTransformer.propagatePAG(SparkTransformer.java:238)
at soot.jimple.spark.SparkTransformer.internalTransform(SparkTransformer.java:155)
at soot.SceneTransformer.transform(SceneTransformer.java:36)
at soot.Transform.apply(Transform.java:105)
at soot.RadioScenePack.internalApply(RadioScenePack.java:64)
at soot.jimple.toolkits.callgraph.CallGraphPack.internalApply(CallGraphPack.java:61)
at soot.Pack.apply(Pack.java:118)
at soot.jimple.infoflow.android.SetupApplication.constructCallgraphInternal(SetupApplication.java:672)
at soot.jimple.infoflow.android.SetupApplication.calculateCallbackMethods(SetupApplication.java:790)
at soot.jimple.infoflow.android.SetupApplication.calculateCallbacks(SetupApplication.java:574)
at soot.jimple.infoflow.android.SetupApplication.calculateCallbacks(SetupApplication.java:524)
at soot.jimple.infoflow.android.SetupApplication.processEntryPoint(SetupApplication.java:1625)
at soot.jimple.infoflow.android.SetupApplication.runInfoflow(SetupApplication.java:1585)
at soot.jimple.infoflow.android.SetupApplication.runInfoflow(SetupApplication.java:1532)
at soot.jimple.infoflow.cmd.MainClass.run(MainClass.java:362)
at soot.jimple.infoflow.cmd.MainClass.main(MainClass.java:260)
Caused by: java.lang.RuntimeException: Attempt to create VarNode of type boolean
at soot.jimple.spark.pag.VarNode.(VarNode.java:135)
at soot.jimple.spark.pag.LocalVarNode.(LocalVarNode.java:52)
at soot.jimple.spark.pag.PAG.makeLocalVarNode(PAG.java:746)
at soot.jimple.spark.builder.MethodNodeFactory.caseLocal(MethodNodeFactory.java:346)
at soot.jimple.internal.JimpleLocal.apply(JimpleLocal.java:119)
at soot.jimple.spark.builder.MethodNodeFactory.caseCastExpr(MethodNodeFactory.java:323)
at soot.jimple.internal.AbstractCastExpr.apply(AbstractCastExpr.java:136)
at soot.jimple.spark.builder.MethodNodeFactory$1.caseAssignStmt(MethodNodeFactory.java:164)
at soot.jimple.internal.JAssignStmt.apply(JAssignStmt.java:217)
at soot.jimple.spark.builder.MethodNodeFactory.handleStmt(MethodNodeFactory.java:150)
at soot.jimple.spark.pag.MethodPAG.buildNormal(MethodPAG.java:224)
at soot.jimple.spark.pag.MethodPAG.build(MethodPAG.java:186)
at soot.jimple.spark.solver.OnFlyCallGraph.processReachables(OnFlyCallGraph.java:119)
... 19 more
[main] INFO soot.jimple.infoflow.memory.MemoryWarningSystem - Shutting down the memory warning system...
The data flow analysis has failed. Error message: An error occurred while processing <rQ.c: java.lang.Object invoke(java.lang.Object)> in callgraph
java.lang.RuntimeException: An error occurred while processing <rQ.c: java.lang.Object invoke(java.lang.Object)> in callgraph
at soot.jimple.spark.solver.OnFlyCallGraph.processReachables(OnFlyCallGraph.java:125)
at soot.jimple.spark.solver.OnFlyCallGraph.build(OnFlyCallGraph.java:106)
at soot.jimple.spark.solver.PropWorklist.handleVarNode(PropWorklist.java:157)
at soot.jimple.spark.solver.PropWorklist.propagate(PropWorklist.java:80)
at soot.jimple.spark.SparkTransformer.propagatePAG(SparkTransformer.java:238)
at soot.jimple.spark.SparkTransformer.internalTransform(SparkTransformer.java:155)
at soot.SceneTransformer.transform(SceneTransformer.java:36)
at soot.Transform.apply(Transform.java:105)
at soot.RadioScenePack.internalApply(RadioScenePack.java:64)
at soot.jimple.toolkits.callgraph.CallGraphPack.internalApply(CallGraphPack.java:61)
at soot.Pack.apply(Pack.java:118)
at

soot.jimple.infoflow.android.SetupApplication.constructCallgraphInternal(SetupApplication.java:672)

at soot.jimple.infoflow.android.SetupApplication.calculateCallbackMethods(SetupApplication.java:790)
at soot.jimple.infoflow.android.SetupApplication.calculateCallbacks(SetupApplication.java:574)
at soot.jimple.infoflow.android.SetupApplication.calculateCallbacks(SetupApplication.java:524)
at soot.jimple.infoflow.android.SetupApplication.processEntryPoint(SetupApplication.java:1625)
at soot.jimple.infoflow.android.SetupApplication.runInfoflow(SetupApplication.java:1585)
at soot.jimple.infoflow.android.SetupApplication.runInfoflow(SetupApplication.java:1532)
at soot.jimple.infoflow.cmd.MainClass.run(MainClass.java:362)
at soot.jimple.infoflow.cmd.MainClass.main(MainClass.java:260)
Caused by: java.lang.RuntimeException: Attempt to create VarNode of type boolean
at soot.jimple.spark.pag.VarNode.(VarNode.java:135)
at soot.jimple.spark.pag.LocalVarNode.(LocalVarNode.java:52)
at soot.jimple.spark.pag.PAG.makeLocalVarNode(PAG.java:746)
at soot.jimple.spark.builder.MethodNodeFactory.caseLocal(MethodNodeFactory.java:346)
at soot.jimple.internal.JimpleLocal.apply(JimpleLocal.java:119)
at soot.jimple.spark.builder.MethodNodeFactory.caseCastExpr(MethodNodeFactory.java:323)
at soot.jimple.internal.AbstractCastExpr.apply(AbstractCastExpr.java:136)
at soot.jimple.spark.builder.MethodNodeFactory$1.caseAssignStmt(MethodNodeFactory.java:164)
at soot.jimple.internal.JAssignStmt.apply(JAssignStmt.java:217)
at soot.jimple.spark.builder.MethodNodeFactory.handleStmt(MethodNodeFactory.java:150)
at soot.jimple.spark.pag.MethodPAG.buildNormal(MethodPAG.java:224)
at soot.jimple.spark.pag.MethodPAG.build(MethodPAG.java:186)
at soot.jimple.spark.solver.OnFlyCallGraph.processReachables(OnFlyCallGraph.java:119)
... 19 more

[Ling521314]

I have the same problem as you, have you solved it yet?

[t1mlange]

Hi,

this is likely a bug in Soot's points-to call-graph generation. Could you provide a small reproducer?

[t1mlange]

I meant the code that is being analyzed, i.e., a small code snippet, when analyzed, crashes FlowDroid

[Ling521314]

Sorry, I got my questions mixed up.
The code I analyzed crashed FlowDroid as bellow:

private void a(Context var1, Intent var2, String var3, String var4, int var5, String var6, String var7, String var8, IAppReceiver var9, int var10) {
        if (ALog.isPrintLog(Level.D)) {
            ALog.d("MsgDistribute", "handleControlMsg", new Object[]{"configTag", var3, "dataId", var8, "serviceId", var7, "command", var5, "errorCode", var10, "appReceiver", var9 == null ? null : var9.getClass().getName()});
        }

        if (var9 != null) {
            switch (var5) {
                case 1:
                    if (var9 instanceof IAppReceiverV1) {
                        ((IAppReceiverV1)var9).onBindApp(var10, (String)null);
                    } else {
                        var9.onBindApp(var10);
                    }
                    break;
                case 2:
                    if (var10 == 200) {
                        UtilityImpl.disableService(var1);
                    }

                    var9.onUnbindApp(var10);
                    break;
                case 3:
                    var9.onBindUser(var6, var10);
                    break;
                case 4:
                    var9.onUnbindUser(var10);
                    break;
                case 100:
                    if (TextUtils.isEmpty(var7)) {
                        var9.onSendData(var8, var10);
                    }
                    break;
                case 101:
                    if (TextUtils.isEmpty(var7)) {
                        ALog.d("MsgDistribute", "handleControlMsg serviceId isEmpty", new Object[0]);
                        byte[] var11 = var2.getByteArrayExtra("data");
                        if (var11 != null) {
                            var9.onData(var6, var8, var11);
                        }
                    }
            }
        }

        if (var5 == 1 && GlobalClientInfo.b != null && var4 != null && var4.equals(Config.a(var1))) {
            ALog.d("MsgDistribute", "handleControlMsg agoo receiver onBindApp", new Object[0]);
            GlobalClientInfo.b.onBindApp(var10, (String)null);
        } else {
            if (var9 == null && var5 != 100 && var5 != 104 && var5 != 103) {
                k.a("accs", "send_fail", var7, "1", "appReceiver null return");
                UTMini.getInstance().commitEvent(66001, "MsgToBuss7", "commandId=" + var5, "serviceId=" + var7 + " errorCode=" + var10 + " dataId=" + var8, 221);
            }

        }
    }

and the error information:

[main] ERROR soot.jimple.infoflow.android.SetupApplication - Could not calculate callback methods
java.lang.RuntimeException: An error occurred while processing <com.taobao.accs.data.g: void a(android.content.Context,android.content.Intent,java.lang.String,java.lang.String,int,java.lang.String,java.lang.String,java.lang.String,com.taobao.accs.IAppReceiver,int)> in callgraph
at soot.jimple.spark.solver.OnFlyCallGraph.processReachables(OnFlyCallGraph.java:125)
at soot.jimple.spark.solver.OnFlyCallGraph.build(OnFlyCallGraph.java:106)
at soot.jimple.spark.solver.PropWorklist.handleVarNode(PropWorklist.java:157)
at soot.jimple.spark.solver.PropWorklist.propagate(PropWorklist.java:80)
at soot.jimple.spark.SparkTransformer.propagatePAG(SparkTransformer.java:238)
at soot.jimple.spark.SparkTransformer.internalTransform(SparkTransformer.java:155)
at soot.SceneTransformer.transform(SceneTransformer.java:36)
at soot.Transform.apply(Transform.java:105)
at soot.RadioScenePack.internalApply(RadioScenePack.java:64)
at soot.jimple.toolkits.callgraph.CallGraphPack.internalApply(CallGraphPack.java:61)
at soot.Pack.apply(Pack.java:118)
at soot.jimple.infoflow.android.SetupApplication.constructCallgraphInternal(SetupApplication.java:672)
at soot.jimple.infoflow.android.SetupApplication.calculateCallbackMethods(SetupApplication.java:790)
at soot.jimple.infoflow.android.SetupApplication.calculateCallbacks(SetupApplication.java:574)
at soot.jimple.infoflow.android.SetupApplication.calculateCallbacks(SetupApplication.java:524)
at soot.jimple.infoflow.android.SetupApplication.processEntryPoint(SetupApplication.java:1625)
at soot.jimple.infoflow.android.SetupApplication.runInfoflow(SetupApplication.java:1585)
at soot.jimple.infoflow.android.SetupApplication.runInfoflow(SetupApplication.java:1532)
at org.example.appMisuseAnalysis.TaintAnalysis.sensitiveApiTaintAnalysis(TaintAnalysis.java:66)
at org.example.appMisuseAnalysis.PathAnalysis.appMisuseAnalysis(PathAnalysis.java:20)
at org.example.Main.main(Main.java:18)
Caused by: java.lang.RuntimeException: Attempt to create VarNode of type boolean
at soot.jimple.spark.pag.VarNode.(VarNode.java:135)
at soot.jimple.spark.pag.LocalVarNode.(LocalVarNode.java:52)
at soot.jimple.spark.pag.PAG.makeLocalVarNode(PAG.java:746)
at soot.jimple.spark.builder.MethodNodeFactory.caseLocal(MethodNodeFactory.java:346)
at soot.jimple.internal.JimpleLocal.apply(JimpleLocal.java:119)
at soot.jimple.spark.builder.MethodNodeFactory.caseCastExpr(MethodNodeFactory.java:323)
at soot.jimple.internal.AbstractCastExpr.apply(AbstractCastExpr.java:136)
at soot.jimple.spark.builder.MethodNodeFactory$1.caseAssignStmt(MethodNodeFactory.java:164)
at soot.jimple.internal.JAssignStmt.apply(JAssignStmt.java:217)
at soot.jimple.spark.builder.MethodNodeFactory.handleStmt(MethodNodeFactory.java:150)
at soot.jimple.spark.pag.MethodPAG.buildNormal(MethodPAG.java:224)
at soot.jimple.spark.pag.MethodPAG.build(MethodPAG.java:186)
at soot.jimple.spark.solver.OnFlyCallGraph.processReachables(OnFlyCallGraph.java:119)
... 20 more

[StevenArzt]

The problem is definitely with Soot and not with FlowDroid.

Can you check the Jimple body of method <com.taobao.accs.data.g: void a(android.content.Context,android.content.Intent,java.lang.String,java.lang.String,int,java.lang.String,java.lang.String,java.lang.String,com.taobao.accs.IAppReceiver,int)>? Maybe the Jimple code has type errors, which would indicate a problem with Dex loading and lifting.

[Ling521314]

The Jimple code as follow:

r0 := @this: com.taobao.accs.data.g
$r4 := @parameter0: android.content.Context
$r5 := @parameter1: android.content.Intent
$r6 := @parameter2: java.lang.String
$r7 := @parameter3: java.lang.String
$i1 := @parameter4: int
$r8 := @parameter5: java.lang.String
$r1 := @parameter6: java.lang.String
$r2 := @parameter7: java.lang.String
$r3 := @parameter8: com.taobao.accs.IAppReceiver
$i0 := @parameter9: int
$r9 = <com.taobao.accs.utl.ALog$Level: com.taobao.accs.utl.ALog$Level D>
$z0 = staticinvoke <com.taobao.accs.utl.ALog: boolean isPrintLog(com.taobao.accs.utl.ALog$Level)>($r9)
if $z0 == 0 goto $r14 = $r3
$r10 = staticinvoke <java.lang.Integer: java.lang.Integer valueOf(int)>($i1)
$r11 = staticinvoke <java.lang.Integer: java.lang.Integer valueOf(int)>($i0)
if $r3 != null goto $r13 = virtualinvoke $r3.<java.lang.Object: java.lang.Class getClass()>()
$r12 = null
goto [?= $r14 = $r3]
$r13 = virtualinvoke $r3.<java.lang.Object: java.lang.Class getClass()>()
$r12 = virtualinvoke $r13.<java.lang.Class: java.lang.String getName()>()
$r14 = $r3
$r15 = newarray (java.lang.Object)[12]
$r15[0] = "configTag"
$r15[1] = $r6
$r15[2] = "dataId"
$r15[3] = $r2
$r15[4] = "serviceId"
$r15[5] = $r1
$r15[6] = "command"
$r15[7] = $r10
$r15[8] = "errorCode"
$r15[9] = $r11
$r15[10] = "appReceiver"
$r15[11] = $r12
staticinvoke <com.taobao.accs.utl.ALog: void d(java.lang.String,java.lang.String,java.lang.Object[])>("MsgDistribute", "handleControlMsg", $r15)
goto [?= (branch)]
$r14 = $r3
if $r14 == null goto $r6 = $r2
if $i1 == 1 goto $r6 = $r2
if $i1 == 2 goto $r6 = $r2
if $i1 == 3 goto $r6 = $r2
if $i1 == 4 goto $r6 = $r2
if $i1 == 100 goto $r6 = $r2
if $i1 == 101 goto $z0 = staticinvoke <android.text.TextUtils: boolean isEmpty(java.lang.CharSequence)>($r1)
goto [?= $r6 = $r2]
$z0 = staticinvoke <android.text.TextUtils: boolean isEmpty(java.lang.CharSequence)>($r1)
if $z0 == 0 goto $r6 = $r2
$r15 = newarray (java.lang.Object)[0]
staticinvoke <com.taobao.accs.utl.ALog: void d(java.lang.String,java.lang.String,java.lang.Object[])>("MsgDistribute", "handleControlMsg serviceId isEmpty", $r15)
$r16 = virtualinvoke $r5.<android.content.Intent: byte[] getByteArrayExtra(java.lang.String)>("data")
$r6 = $r2
if $r16 == null goto $i2 = $i0
interfaceinvoke $r14.<com.taobao.accs.IAppReceiver: void onData(java.lang.String,java.lang.String,byte[])>($r8, $r2, $r16)
goto [?= $i2 = $i0]
$r6 = $r2
$z0 = staticinvoke <android.text.TextUtils: boolean isEmpty(java.lang.CharSequence)>($r1)
if $z0 == 0 goto $i2 = $i0
$i2 = $i0
interfaceinvoke $r14.<com.taobao.accs.IAppReceiver: void onSendData(java.lang.String,int)>($r2, $i0)
goto [?= (branch)]
$r6 = $r2
$i2 = $i0
interfaceinvoke $r3.<com.taobao.accs.IAppReceiver: void onUnbindUser(int)>($i0)
goto [?= (branch)]
$r6 = $r2
$i2 = $i0
interfaceinvoke $r14.<com.taobao.accs.IAppReceiver: void onBindUser(java.lang.String,int)>($r8, $i0)
goto [?= (branch)]
$r6 = $r2
$i2 = $i0
if $i0 != 200 goto interfaceinvoke $r3.<com.taobao.accs.IAppReceiver: void onUnbindApp(int)>($i0)
staticinvoke <com.taobao.accs.utl.UtilityImpl: void disableService(android.content.Context)>($r4)
interfaceinvoke $r3.<com.taobao.accs.IAppReceiver: void onUnbindApp(int)>($i0)
goto [?= (branch)]
$r6 = $r2
$i2 = $i0
$z0 = $r14 instanceof com.taobao.accs.IAppReceiverV1
if $z0 == 0 goto interfaceinvoke $r3.<com.taobao.accs.IAppReceiver: void onBindApp(int)>($i0)
$r17 = (com.taobao.accs.IAppReceiverV1) $r14
interfaceinvoke $r17.<com.taobao.accs.IAppReceiverV1: void onBindApp(int,java.lang.String)>($i0, null)
goto [?= (branch)]
interfaceinvoke $r3.<com.taobao.accs.IAppReceiver: void onBindApp(int)>($i0)
goto [?= (branch)]
$r6 = $r2
$i2 = $i0
if $i1 != 1 goto (branch)
$r18 = <com.taobao.accs.client.GlobalClientInfo: com.taobao.accs.IAgooAppReceiver b>
if $r18 == null goto (branch)
if $r7 == null goto (branch)
$r8 = staticinvoke <org.android.agoo.common.Config: java.lang.String a(android.content.Context)>($r4)
$z0 = virtualinvoke $r7.<java.lang.String: boolean equals(java.lang.Object)>($r8)
if $z0 == 0 goto (branch)
$r15 = newarray (java.lang.Object)[0]
staticinvoke <com.taobao.accs.utl.ALog: void d(java.lang.String,java.lang.String,java.lang.Object[])>("MsgDistribute", "handleControlMsg agoo receiver onBindApp", $r15)
$r18 = <com.taobao.accs.client.GlobalClientInfo: com.taobao.accs.IAgooAppReceiver b>
interfaceinvoke $r18.<com.taobao.accs.IAgooAppReceiver: void onBindApp(int,java.lang.String)>($i2, null)
return
if $r14 != null goto return
if $i1 == 100 goto return
if $i1 == 104 goto return
if $i1 == 103 goto return
staticinvoke <com.taobao.accs.utl.k: void a(java.lang.String,java.lang.String,java.lang.String,java.lang.String,java.lang.String)>("accs", "send_fail", $r1, "1", "appReceiver null return")
$r19 = staticinvoke <com.taobao.accs.utl.UTMini: com.taobao.accs.utl.UTMini getInstance()>()
$r20 = new java.lang.StringBuilder
specialinvoke $r20.<java.lang.StringBuilder: void <init>(java.lang.String)>("commandId=")
$r20 = virtualinvoke $r20.<java.lang.StringBuilder: java.lang.StringBuilder append(int)>($i1)
$r7 = virtualinvoke $r20.<java.lang.StringBuilder: java.lang.String toString()>()
$r20 = new java.lang.StringBuilder
specialinvoke $r20.<java.lang.StringBuilder: void <init>(java.lang.String)>("serviceId=")
$r20 = virtualinvoke $r20.<java.lang.StringBuilder: java.lang.StringBuilder append(java.lang.String)>($r1)
$r20 = virtualinvoke $r20.<java.lang.StringBuilder: java.lang.StringBuilder append(java.lang.String)>(" errorCode=")
$r20 = virtualinvoke $r20.<java.lang.StringBuilder: java.lang.StringBuilder append(int)>($i2)
$r20 = virtualinvoke $r20.<java.lang.StringBuilder: java.lang.StringBuilder append(java.lang.String)>(" dataId=")
$r20 = virtualinvoke $r20.<java.lang.StringBuilder: java.lang.StringBuilder append(java.lang.String)>($r6)
$r6 = virtualinvoke $r20.<java.lang.StringBuilder: java.lang.String toString()>()
$r10 = staticinvoke <java.lang.Integer: java.lang.Integer valueOf(int)>(221)
virtualinvoke $r19.<com.taobao.accs.utl.UTMini: void commitEvent(int,java.lang.String,java.lang.Object,java.lang.Object,java.lang.Object)>(66001, "MsgToBuss7", $r7, $r6, $r10)
return

[StevenArzt]

At first sight, this looks reasonable. What is the VarNode for which this fails? The only boolean local should be $z0 and that seems to be fine.

[DionysisTheodosis]

Hi, after your replies, I believe the issue is related to Soot, as I encountered different errors when using PyFlowDroid and FlowDroid.
Error in PyFlowDroid
Initially, when running PyFlowDroid, I encountered the following Soot-related error:

[main] ERROR soot.jimple.infoflow.android.resources.ARSCFileParser - Error when looking for XML resource files in apk C:\Users\theo_\Desktop\viber.apk
java.lang.RuntimeException: File format violation, res1 was not zero
This suggests that Soot is having trouble parsing the APK’s XML resources.

But after i found that pyflowdroid is wraper for FlowDroid i continue to try it by FlowDroid. So I downloaded FlowDroid from this repository and ran it from Eclipse with the following configuration:

-a "C:\Users\theo_\Desktop\viber.apk" 
-p "C:\Users\theo_\AppData\Local\Android\Sdk\platforms" 
-s "C:\Users\theo_\Documents\05_Apps\FlowDroid-2.14.1\FlowDroid-2.14.1\soot-infoflow-android\SourcesAndSinks.txt"

However, instead of the previous error, FlowDroid failed with the errors described at the start of this issue (related to call graph construction and type inference).

Given these errors, I’m wondering:

1. Is there a known fix or workaround for this issue, or is it an internal Soot issue that requires a fix from the developers?
2. Would it be more appropriate to report the FlowDroid-specific errors in the Soot GitHub repository instead? If so, where should I open the issue?