The extractor has options to configure how the graph is generated. This should be configured before
Extractor::project() is called to have an effect. These options are configured via the
Call Graph Configuration Options
Plume makes use of Soot to construct the call graph using two of its points-to analysis algorithms. By default CHA is used but one can opt not to use any algorithm which will simply generate a intraprocedural CPG.
This option will skip any call graph construction and not generate any
REF edges between
CallVertex vertices and
ExtractorOptions.callGraphAlg = ExtractorOptions.CallGraphAlg.NONE
Class Heirarchy Analysis (CHA)
This is the default option will generate an imprecise call graph. CHA simply assumes that every variable might point to every other variable which is conservatively sound but not terribly accurate and may overapproximate. The pro is that this algorithm is fast.
// Configuration not necessary this is the default ExtractorOptions.callGraphAlg = ExtractorOptions.CallGraphAlg.CHA
Soot Pointer Analysis Research Kit (SPARK)
SPARK is much more precise than CHA and provides a rich set of options to configure. SPARK can be configured to use a naïve iterative algorithm or more efficient worklist algorithm. SPARK will take longer to construct a call graph than CHA but will produce a smaller and more precise call graph than CHA.
ExtractorOptions.callGraphAlg = ExtractorOptions.CallGraphAlg.SPARK
Plume makes the following configuration for SPARK by default via a map:
sparkOpts["verbose"] = "false" sparkOpts["propagator"] = "worklist" sparkOpts["simple-edges-bidirectional"] = "false" sparkOpts["on-fly-cg"] = "true" sparkOpts["set-impl"] = "double" sparkOpts["double-set-old"] = "hybrid" sparkOpts["double-set-new"] = "hybrid" sparkOpts["enabled"] = "true"
For more information on these options, check out the Soot options documentation.