I want to perform taint analysis on java programs. I want to do this by finding functions calls, variable being modified, variable being accessed. So my question is how do I do this? I think Java parsers can be used here. But I will have to implement my own logic to find variable being accessed and modified. So I want to know if there is any high level library already present for this?

closed as off-topic by S.L. Barth, multithr3at3d, forest, Tom K., Overmind Jun 7 '18 at 10:28

This question appears to be off-topic. The users who voted to close gave this specific reason:

If this question can be reworded to fit the rules in the help center, please edit the question.

  • Can you run the code, if so the Java debugging protocol may help – jrtapsell May 31 '18 at 10:38
  • @jrtapsell yeah ! – WSS May 31 '18 at 10:39
  • @jrtapsell I have worked on JDI layer of JPDA and it does not support those things. – WSS May 31 '18 at 11:12

You need a Java parser. Most exactly, a static Java code analyzer.

There is a lot from them, for example SonarQube.

It has already a lot of builtin rules, but also you can implement your own ones.

Its core follows the most common lexycal analyzer flow:

  • it constructs a tree structure from the syntactical elements
  • then walks this tree, and
  • you can attach hooks (the instance of your lexycal analyzer classes will be called upon) entering or leaving the nodes of this tree.

Not the answer you're looking for? Browse other questions tagged or ask your own question.