JEB version 1.5.201404100 introduces new methods to the AST IElement objects, attachTag() and retrieveTag(). These methods allow an API user to tag elements of Abstract Syntax Trees. When a tagged tree is rendered (that is, when decompiled Java code is being generated), tags are processed and provided to the user alongside the decompiled code, with associated text coordinates (line, column). Within the API documentation, a “located tag” is referred to as a mark.
One example use case: Tagging nodes of an AST can be useful if the yielded source code is of specific interest, and potentially require follow-up human analysis.
The example below shows how one can navigate a Class tree, looking for specific calls to findViewById:
def processTree(e):
if isinstance(e, Call) and e.getMethod().getName() == 'findViewById' and ... :
print 'Tagging Call element:', e #e.getMethod().getName()
e.attachTag('testTag', 'Calling interesting findViewById')
if e:
# recursively process sub-elements
for e1 in e.getSubElements():
processTree(e1)
sig = ...
ast = self.jeb.getDecompiledClassTree(sig) # assume the class was decompiled
processTree(e)
The Class tree can be rendered by calling the newly introduced overloaded decompile(sig, is_class, regenerate, marks) method:
marks = [] decompiled_class = self.jeb.decompile(sig, True, False, marks) print marks
Remember to set regenerate to False since you want to avoid re-decompilation (doing so would generate a new, tag-less AST).
The marks array will contain the precise locations (lines and columns) of each tag within the decompiled_class text buffer.
Hopefully, this simplistic example showed you how to use the new AST tagging methods. Happy reversing and code analysis.
