arkanalyzer 1.0.5

package/lib/callgraph/pointerAnalysis/PointerAnalysis.d.ts

@@ -0,0 +1,64 @@
+import { Scene } from '../../Scene';
+import { Value } from '../../core/base/Value';
+import { NodeID } from '../model/BaseGraph';
+import { CallGraph, CallSite, FuncID } from '../model/CallGraph';
+import { AbstractAnalysis } from '../algorithm/AbstractAnalysis';
+import { Type } from '../../core/base/Type';
+import { Stmt } from '../../core/base/Stmt';
+import { Pag } from './Pag';
+import { PointerAnalysisConfig } from './PointerAnalysisConfig';
+export declare class PointerAnalysis extends AbstractAnalysis {
+    private pag;
+    private pagBuilder;
+    private ptd;
+    private entries;
+    private worklist;
+    private ptaStat;
+    private typeDiffMap;
+    private config;
+    constructor(p: Pag, cg: CallGraph, s: Scene, config: PointerAnalysisConfig);
+    static pointerAnalysisForWholeProject(projectScene: Scene, config?: PointerAnalysisConfig): PointerAnalysis;
+    protected init(): void;
+    start(): void;
+    private postProcess;
+    protected preProcessMethod(funcID: FuncID): CallSite[];
+    setEntries(fIds: FuncID[]): void;
+    private solveConstraint;
+    /**
+     * get newly added Address Edge, and add them to initial WorkList
+     */
+    private initWorklist;
+    private solveWorklist;
+    private processNode;
+    private handleCopy;
+    private handleLoadWrite;
+    private handleFieldInEdges;
+    private handleFieldOutEdges;
+    /**
+     * If current node is a base of a called method, pointer in this node will be transfered into `this` Local in method
+     */
+    private handleThis;
+    private handlePt;
+    private propagate;
+    /**
+     * 1. 记录被更新的节点(记录cid, nodeid)
+     * 2. ( PAGLocalNode记录callsite(cid, value唯一))，通过1种的nodeID查询Node,拿到Callsite
+     * 3. 在addDynamicCall里对传入指针过滤（已处理指针和未处理指针）
+     */
+    private onTheFlyDynamicCallSolve;
+    private addToReanalyze;
+    /**
+     * compare interface
+     */
+    noAlias(leftValue: Value, rightValue: Value): boolean;
+    mayAlias(leftValue: Value, rightValue: Value): boolean;
+    getRelatedNodes(value: Value): Set<Value>;
+    private detectTypeDiff;
+    getTypeDiffMap(): Map<Value, Set<Type>>;
+    protected resolveCall(sourceMethod: NodeID, invokeStmt: Stmt): CallSite[];
+    getUnhandledFuncs(): FuncID[];
+    getHandledFuncs(): FuncID[];
+    getPTAConfig(): PointerAnalysisConfig;
+    private dumpUnhandledFunctions;
+}
+//# sourceMappingURL=PointerAnalysis.d.ts.map

package/lib/callgraph/pointerAnalysis/PointerAnalysis.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"PointerAnalysis.d.ts","sourceRoot":"","sources":["../../../src/callgraph/pointerAnalysis/PointerAnalysis.ts"],"names":[],"mappings":"AAeA,OAAO,EAAE,KAAK,EAAE,MAAM,aAAa,CAAC;AACpC,OAAO,EAAE,KAAK,EAAE,MAAM,uBAAuB,CAAC;AAC9C,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAG5C,OAAO,EAAE,SAAS,EAAiB,QAAQ,EAAe,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAC7F,OAAO,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AACjE,OAAO,EAAa,IAAI,EAAe,MAAM,sBAAsB,CAAC;AAEpE,OAAO,EAAE,IAAI,EAAE,MAAM,sBAAsB,CAAC;AAI5C,OAAO,EAAE,GAAG,EAAgF,MAAM,OAAO,CAAC;AAE1G,OAAO,EAAE,qBAAqB,EAAE,MAAM,yBAAyB,CAAC;AAKhE,qBAAa,eAAgB,SAAQ,gBAAgB;IACjD,OAAO,CAAC,GAAG,CAAM;IACjB,OAAO,CAAC,UAAU,CAAa;IAC/B,OAAO,CAAC,GAAG,CAA6C;IACxD,OAAO,CAAC,OAAO,CAAY;IAC3B,OAAO,CAAC,QAAQ,CAAY;IAE5B,OAAO,CAAC,OAAO,CAAU;IACzB,OAAO,CAAC,WAAW,CAAyB;IAC5C,OAAO,CAAC,MAAM,CAAwB;gBAE1B,CAAC,EAAE,GAAG,EAAE,EAAE,EAAE,SAAS,EAAE,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,qBAAqB;IAW1E,MAAM,CAAC,8BAA8B,CAAC,YAAY,EAAE,KAAK,EAAE,MAAM,CAAC,EAAE,qBAAqB,GAAG,eAAe;IAuB3G,SAAS,CAAC,IAAI;IAYP,KAAK;IAMZ,OAAO,CAAC,WAAW;IAgBnB,SAAS,CAAC,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,QAAQ,EAAE;IAK/C,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE;IAIhC,OAAO,CAAC,eAAe;IAoBvB;;OAEG;IACH,OAAO,CAAC,YAAY;IAiBpB,OAAO,CAAC,aAAa;IASrB,OAAO,CAAC,WAAW;IAUnB,OAAO,CAAC,UAAU;IAUlB,OAAO,CAAC,eAAe;IA+BvB,OAAO,CAAC,kBAAkB;IA4B1B,OAAO,CAAC,mBAAmB;IA0B3B;;OAEG;IACH,OAAO,CAAC,UAAU;IAUlB,OAAO,CAAC,QAAQ;IAWhB,OAAO,CAAC,SAAS;IAoBjB;;;;OAIG;IACH,OAAO,CAAC,wBAAwB;IAmChC,OAAO,CAAC,cAAc;IAWtB;;OAEG;IACI,OAAO,CAAC,SAAS,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,GAAG,OAAO;IAkCrD,QAAQ,CAAC,SAAS,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,GAAG,OAAO;IAItD,eAAe,CAAC,KAAK,EAAE,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC;IAqDhD,OAAO,CAAC,cAAc;IA2Cf,cAAc,IAAI,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;IAI9C,SAAS,CAAC,WAAW,CAAC,YAAY,EAAE,MAAM,EAAE,UAAU,EAAE,IAAI,GAAG,QAAQ,EAAE;IAIlE,iBAAiB,IAAI,MAAM,EAAE;IAI7B,eAAe,IAAI,MAAM,EAAE;IAI3B,YAAY,IAAI,qBAAqB;IAI5C,OAAO,CAAC,sBAAsB;CA+BjC"}

package/lib/callgraph/pointerAnalysis/PointerAnalysis.js

@@ -0,0 +1,502 @@
+"use strict";
+/*
+ * Copyright (c) 2024 Huawei Device Co., Ltd.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || function (mod) {
+    if (mod && mod.__esModule) return mod;
+    var result = {};
+    if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
+    __setModuleDefault(result, mod);
+    return result;
+};
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PointerAnalysis = void 0;
+const path_1 = __importDefault(require("path"));
+const fs = __importStar(require("fs"));
+const CallGraph_1 = require("../model/CallGraph");
+const AbstractAnalysis_1 = require("../algorithm/AbstractAnalysis");
+const Type_1 = require("../../core/base/Type");
+const CallGraphBuilder_1 = require("../model/builder/CallGraphBuilder");
+const logger_1 = __importStar(require("../../utils/logger"));
+const DummyMainCreater_1 = require("../../core/common/DummyMainCreater");
+const Statistics_1 = require("../common/Statistics");
+const Pag_1 = require("./Pag");
+const PagBuilder_1 = require("./PagBuilder");
+const PointerAnalysisConfig_1 = require("./PointerAnalysisConfig");
+const PtsDS_1 = require("./PtsDS");
+const logger = logger_1.default.getLogger(logger_1.LOG_MODULE_TYPE.ARKANALYZER, 'PTA');
+class PointerAnalysis extends AbstractAnalysis_1.AbstractAnalysis {
+    constructor(p, cg, s, config) {
+        super(s);
+        this.pag = p;
+        this.cg = cg;
+        this.ptd = new PtsDS_1.DiffPTData(PtsDS_1.PtsSet);
+        this.pagBuilder = new PagBuilder_1.PagBuilder(this.pag, this.cg, s, config.kLimit);
+        this.cgBuilder = new CallGraphBuilder_1.CallGraphBuilder(this.cg, s);
+        this.ptaStat = new Statistics_1.PTAStat(this);
+        this.config = config;
+    }
+    static pointerAnalysisForWholeProject(projectScene, config) {
+        let cg = new CallGraph_1.CallGraph(projectScene);
+        let cgBuilder = new CallGraphBuilder_1.CallGraphBuilder(cg, projectScene);
+        cgBuilder.buildDirectCallGraphForScene();
+        let pag = new Pag_1.Pag();
+        if (!config) {
+            config = new PointerAnalysisConfig_1.PointerAnalysisConfig(1, "out/", false, false);
+        }
+        const dummyMainCreator = new DummyMainCreater_1.DummyMainCreater(projectScene);
+        dummyMainCreator.createDummyMain();
+        const dummyMainMethod = dummyMainCreator.getDummyMain();
+        cgBuilder.buildDirectCallGraph([dummyMainMethod]);
+        let dummyMainMethodID = cg.getCallGraphNodeByMethod(dummyMainMethod.getSignature()).getID();
+        cg.setDummyMainFuncID(dummyMainMethodID);
+        let pta = new PointerAnalysis(pag, cg, projectScene, config);
+        pta.setEntries([dummyMainMethodID]);
+        pta.start();
+        return pta;
+    }
+    init() {
+        logger.warn(`========== Init Pointer Analysis ==========`);
+        // start statistics
+        this.ptaStat.startStat();
+        // build funcPag with entries
+        this.pagBuilder.buildForEntries(this.entries);
+        if (this.config.dotDump) {
+            this.pag.dump(path_1.default.join(this.config.outputDirectory, 'ptaInit_pag.dot'));
+            this.cg.dump(path_1.default.join(this.config.outputDirectory, 'cg_init.dot'));
+        }
+    }
+    start() {
+        this.init();
+        this.solveConstraint();
+        this.postProcess();
+    }
+    postProcess() {
+        this.ptaStat.endStat();
+        this.pagBuilder.doStat();
+        this.cg.printStat();
+        this.pagBuilder.printStat();
+        this.ptaStat.printStat();
+        if (this.config.dotDump) {
+            this.pag.dump(path_1.default.join(this.config.outputDirectory, 'ptaEnd_pag.dot'));
+            this.cg.dump(path_1.default.join(this.config.outputDirectory, 'cgEnd.dot'));
+        }
+        if (this.config.unhandledFuncDump) {
+            this.dumpUnhandledFunctions();
+        }
+    }
+    preProcessMethod(funcID) {
+        // do nothing
+        return [];
+    }
+    setEntries(fIds) {
+        this.entries = fIds;
+    }
+    solveConstraint() {
+        this.worklist = [];
+        logger.warn(`========== Pointer Analysis Start ==========`);
+        this.initWorklist();
+        let reanalyzer = true;
+        while (reanalyzer) {
+            this.ptaStat.iterTimes++;
+            logger.warn(`========== Pointer Analysis Round ${this.ptaStat.iterTimes} ==========`);
+            // do pointer transfer
+            this.solveWorklist();
+            // process dynamic call
+            reanalyzer = this.onTheFlyDynamicCallSolve();
+            if (this.config.dotDump) {
+                this.pag.dump(path_1.default.join(this.config.outputDirectory, `pta_pag_itor#${this.ptaStat.iterTimes}.dot`));
+            }
+        }
+    }
+    /**
+     * get newly added Address Edge, and add them to initial WorkList
+     */
+    initWorklist() {
+        for (let e of this.pag.getAddrEdges()) {
+            this.ptaStat.numProcessedAddr++;
+            let { src, dst } = e.getEndPoints();
+            this.ptd.addPts(dst, src);
+            if (this.pag.getNode(src) instanceof Pag_1.PagGlobalThisNode) {
+                // readd globalThis heapObj into workList
+                this.ptd.addPts(src, src);
+                this.worklist.push(src);
+            }
+            this.worklist.push(dst);
+        }
+        this.pag.resetAddrEdges();
+    }
+    solveWorklist() {
+        while (this.worklist.length > 0) {
+            let node = this.worklist.shift();
+            this.processNode(node);
+        }
+        return true;
+    }
+    processNode(nodeId) {
+        this.handleThis(nodeId);
+        this.handleLoadWrite(nodeId);
+        this.handleCopy(nodeId);
+        this.handlePt(nodeId);
+        this.detectTypeDiff(nodeId);
+        return true;
+    }
+    handleCopy(nodeID) {
+        var _a;
+        let node = this.pag.getNode(nodeID);
+        (_a = node.getOutgoingCopyEdges()) === null || _a === void 0 ? void 0 : _a.forEach(copyEdge => {
+            this.propagate(copyEdge);
+            this.ptaStat.numProcessedCopy++;
+        });
+        return true;
+    }
+    handleLoadWrite(nodeID) {
+        let node = this.pag.getNode(nodeID);
+        let diffPts = this.ptd.getDiffPts(nodeID);
+        if (!diffPts || diffPts.count() == 0) {
+            return false;
+        }
+        // get related field node with current node's value
+        let instanceFieldNodeMap = this.pag.getNodesByBaseValue(node.getValue());
+        if (instanceFieldNodeMap === undefined) {
+            return true;
+        }
+        instanceFieldNodeMap.forEach((nodeIDs, cid) => {
+            // TODO: check cid
+            if (cid != node.getCid()) {
+                return;
+            }
+            nodeIDs.forEach((nodeID) => {
+                // get abstract field node
+                let fieldNode = this.pag.getNode(nodeID);
+                this.handleFieldInEdges(fieldNode, diffPts);
+                this.handleFieldOutEdges(fieldNode, diffPts);
+            });
+        });
+        return true;
+    }
+    handleFieldInEdges(fieldNode, diffPts) {
+        fieldNode.getIncomingEdge().forEach((edge) => {
+            if (edge.getKind() !== Pag_1.PagEdgeKind.Write) {
+                return;
+                //throw new Error ("field node in edge is not write edge")
+            }
+            let srcNode = edge.getSrcNode();
+            this.ptaStat.numProcessedWrite++;
+            for (let pt of diffPts) {
+                // filter pt
+                // clone the real field node with abstract field node
+                let dstNode;
+                if (fieldNode instanceof Pag_1.PagArrayNode) {
+                    dstNode = this.pag.getOrClonePagArrayFieldNode(fieldNode, pt);
+                }
+                else {
+                    dstNode = this.pag.getOrClonePagFieldNode(fieldNode, pt);
+                }
+                if (dstNode && this.pag.addPagEdge(srcNode, dstNode, Pag_1.PagEdgeKind.Copy)) {
+                    this.ptaStat.numRealWrite++;
+                    if (this.ptd.resetElem(srcNode.getID())) {
+                        this.worklist.push(srcNode.getID());
+                    }
+                }
+            }
+        });
+    }
+    handleFieldOutEdges(fieldNode, diffPts) {
+        fieldNode.getOutgoingEdges().forEach((edge) => {
+            if (edge.getKind() !== Pag_1.PagEdgeKind.Load) {
+                return;
+            }
+            let dstNode = edge.getDstNode();
+            this.ptaStat.numProcessedLoad++;
+            for (let pt of diffPts) {
+                let srcNode;
+                if (fieldNode instanceof Pag_1.PagArrayNode) {
+                    srcNode = this.pag.getOrClonePagArrayFieldNode(fieldNode, pt);
+                }
+                else {
+                    srcNode = this.pag.getOrClonePagFieldNode(fieldNode, pt);
+                }
+                if (srcNode && this.pag.addPagEdge(srcNode, dstNode, Pag_1.PagEdgeKind.Copy)) {
+                    this.ptaStat.numRealLoad++;
+                    // TODO: if field is used before initialzed, newSrc node has no diff pts
+                    if (this.ptd.resetElem(srcNode.getID())) {
+                        this.worklist.push(srcNode.getID());
+                    }
+                }
+            }
+        });
+    }
+    /**
+     * If current node is a base of a called method, pointer in this node will be transfered into `this` Local in method
+     */
+    handleThis(nodeID) {
+        var _a;
+        let node = this.pag.getNode(nodeID);
+        (_a = node.getOutgoingThisEdges()) === null || _a === void 0 ? void 0 : _a.forEach(thisEdge => {
+            this.propagate(thisEdge);
+            this.ptaStat.numProcessedThis++;
+        });
+        return true;
+    }
+    handlePt(nodeID) {
+        let realDiff = this.ptd.calculateDiff(nodeID, nodeID);
+        if (realDiff.count() != 0) {
+            // record the updated nodes
+            this.pagBuilder.addUpdatedNode(nodeID, realDiff);
+        }
+        this.ptd.flush(nodeID);
+        this.pagBuilder.setPtForNode(nodeID, this.ptd.getPropaPts(nodeID));
+    }
+    propagate(edge) {
+        let changed = false;
+        let { src, dst } = edge.getEndPoints();
+        let diffPts = this.ptd.getDiffPts(src);
+        if (!diffPts) {
+            return changed;
+        }
+        let realDiffPts = this.ptd.calculateDiff(src, dst);
+        for (let pt of realDiffPts) {
+            changed = this.ptd.addPts(dst, pt) || changed;
+        }
+        if (changed) {
+            this.worklist.push(dst);
+        }
+        return changed;
+    }
+    /**
+     * 1. 记录被更新的节点(记录cid, nodeid)
+     * 2. ( PAGLocalNode记录callsite(cid, value唯一))，通过1种的nodeID查询Node,拿到Callsite
+     * 3. 在addDynamicCall里对传入指针过滤（已处理指针和未处理指针）
+     */
+    onTheFlyDynamicCallSolve() {
+        let changed = false;
+        let processedCallSites = new Set();
+        this.pagBuilder.getUpdatedNodes().forEach((pts, nodeID) => {
+            let node = this.pag.getNode(nodeID);
+            if (!(node instanceof Pag_1.PagLocalNode)) {
+                logger.warn(`node ${nodeID} is not local node, value: ${node.getValue()}`);
+                return;
+            }
+            let dynCallSites = node.getRelatedDynCallSites();
+            if (!dynCallSites) {
+                logger.warn(`node ${nodeID} has no related dynamic call site`);
+                return;
+            }
+            logger.info(`[process dynamic callsite] node ${nodeID}`);
+            dynCallSites.forEach((dynCallsite) => {
+                for (let pt of pts) {
+                    let srcNodes = this.pagBuilder.addDynamicCallEdge(dynCallsite, pt, node.getCid());
+                    changed = this.addToReanalyze(srcNodes) || changed;
+                }
+                processedCallSites.add(dynCallsite);
+            });
+        });
+        this.pagBuilder.resetUpdatedNodes();
+        this.pagBuilder.handleUnprocessedCallSites(processedCallSites);
+        changed = this.pagBuilder.handleReachable() || changed;
+        this.initWorklist();
+        return changed;
+    }
+    addToReanalyze(startNodes) {
+        let flag = false;
+        for (let node of startNodes) {
+            if (!this.worklist.includes(node) && this.ptd.resetElem(node)) {
+                this.worklist.push(node);
+                flag = true;
+            }
+        }
+        return flag;
+    }
+    /**
+     * compare interface
+     */
+    noAlias(leftValue, rightValue) {
+        var _a, _b;
+        let leftValueNodes = (_a = this.pag.getNodesByValue(leftValue)) === null || _a === void 0 ? void 0 : _a.values();
+        let rightValueNodes = (_b = this.pag.getNodesByValue(rightValue)) === null || _b === void 0 ? void 0 : _b.values();
+        let leftValuePts = new Set(), rightValuePts = new Set();
+        for (let nodeID of leftValueNodes) {
+            let node = this.pag.getNode(nodeID);
+            for (let pt of node.getPointTo()) {
+                leftValuePts.add(pt);
+            }
+        }
+        for (let nodeID of rightValueNodes) {
+            let node = this.pag.getNode(nodeID);
+            for (let pt of node.getPointTo()) {
+                rightValuePts.add(pt);
+            }
+        }
+        if (leftValuePts.size > rightValuePts.size) {
+            [leftValuePts, rightValuePts] = [rightValuePts, leftValuePts];
+        }
+        for (const elem of leftValuePts) {
+            if (rightValuePts.has(elem)) {
+                return false;
+            }
+        }
+        // no alias
+        return true;
+    }
+    mayAlias(leftValue, rightValue) {
+        return !this.noAlias(leftValue, rightValue);
+    }
+    getRelatedNodes(value) {
+        var _a;
+        let valueNodes = (_a = this.pag.getNodesByValue(value)) === null || _a === void 0 ? void 0 : _a.values();
+        let relatedAllNodes = new Set();
+        let workListNodes = [];
+        let processedNodes = new Set();
+        for (const nodeID of valueNodes) {
+            workListNodes.push(nodeID);
+        }
+        while (workListNodes.length !== 0) {
+            let valueNodeID = workListNodes.shift();
+            if (processedNodes.has(valueNodeID)) {
+                continue;
+            }
+            let valueNode = this.pag.getNode(valueNodeID);
+            let inCopyEdges = valueNode.getIncomingCopyEdges();
+            if (!inCopyEdges) {
+                continue;
+            }
+            inCopyEdges.forEach(edge => {
+                let srcID = edge.getSrcID();
+                if (!processedNodes.has(srcID)) {
+                    workListNodes.push(srcID);
+                }
+            });
+            let outCopyEdges = valueNode.getOutgoingCopyEdges();
+            if (!outCopyEdges) {
+                continue;
+            }
+            outCopyEdges.forEach(edge => {
+                let dstID = edge.getDstID();
+                if (!processedNodes.has(dstID)) {
+                    workListNodes.push(dstID);
+                }
+            });
+            processedNodes.add(valueNodeID);
+        }
+        processedNodes.forEach(nodeID => {
+            let valueNode = this.pag.getNode(nodeID);
+            relatedAllNodes.add(valueNode.getValue());
+        });
+        return relatedAllNodes;
+    }
+    detectTypeDiff(nodeId) {
+        var _a;
+        if (this.config.detectTypeDiff == false) {
+            return;
+        }
+        this.typeDiffMap = (_a = this.typeDiffMap) !== null && _a !== void 0 ? _a : new Map();
+        let node = this.pag.getNode(nodeId);
+        let value = node.getValue();
+        let origType = node.getValue().getType();
+        // TODO: union type
+        if (!(origType instanceof Type_1.ClassType || origType instanceof Type_1.UnknownType)) {
+            return;
+        }
+        let findSameType = false;
+        let pts = node.getPointTo();
+        if (pts.size == 0) {
+            return;
+        }
+        pts.forEach(pt => {
+            var _a;
+            let ptNode = this.pag.getNode(pt);
+            let type = ptNode.getValue().getType();
+            if (type.toString() != origType.toString()) {
+                let diffSet = (_a = this.typeDiffMap.get(value)) !== null && _a !== void 0 ? _a : new Set();
+                this.typeDiffMap.set(value, diffSet);
+                if (!diffSet.has(type)) {
+                    diffSet.add(type);
+                }
+            }
+            else {
+                findSameType = true;
+            }
+        });
+        // If find pts to original type, 
+        // need add original type back since it is a correct type
+        let diffSet = this.typeDiffMap.get(value);
+        if (diffSet && findSameType) {
+            diffSet.add(origType);
+        }
+    }
+    getTypeDiffMap() {
+        return this.typeDiffMap;
+    }
+    resolveCall(sourceMethod, invokeStmt) {
+        return [];
+    }
+    getUnhandledFuncs() {
+        return this.pagBuilder.getUnhandledFuncs();
+    }
+    getHandledFuncs() {
+        return this.pagBuilder.getHandledFuncs();
+    }
+    getPTAConfig() {
+        return this.config;
+    }
+    dumpUnhandledFunctions() {
+        const filePath = path_1.default.join(this.config.outputDirectory, 'PtaUnhandledFunctionList.txt');
+        fs.access(filePath, fs.constants.F_OK, (err) => {
+            if (!err) {
+                fs.truncate(filePath, 0, (err) => {
+                    if (err) {
+                        console.log('Error to truncate file ', err);
+                    }
+                });
+            }
+            let updatedContent = '';
+            this.getUnhandledFuncs().forEach(funcID => {
+                let cgNode = this.cg.getNode(funcID);
+                if (cgNode.getIsSdkMethod()) {
+                    return;
+                }
+                let f = this.cg.getArkMethodByFuncID(funcID);
+                if (f) {
+                    updatedContent += f.getSignature().toString() + '\n';
+                }
+            });
+            fs.writeFile(filePath, updatedContent, 'utf8', (err) => {
+                if (err) {
+                    console.error('Error to write file', err);
+                }
+            });
+        });
+    }
+}
+exports.PointerAnalysis = PointerAnalysis;

package/lib/callgraph/pointerAnalysis/PointerAnalysisConfig.d.ts

@@ -0,0 +1,9 @@
+export declare class PointerAnalysisConfig {
+    kLimit: number;
+    outputDirectory: string;
+    detectTypeDiff: boolean;
+    dotDump: boolean;
+    unhandledFuncDump: boolean;
+    constructor(kLimit: number, outputDirectory: string, detectTypeDiff?: boolean, dotDump?: boolean, unhandledFuncDump?: boolean);
+}
+//# sourceMappingURL=PointerAnalysisConfig.d.ts.map

package/lib/callgraph/pointerAnalysis/PointerAnalysisConfig.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"PointerAnalysisConfig.d.ts","sourceRoot":"","sources":["../../../src/callgraph/pointerAnalysis/PointerAnalysisConfig.ts"],"names":[],"mappings":"AAiBA,qBAAa,qBAAqB;IACvB,MAAM,EAAE,MAAM,CAAC;IACf,eAAe,EAAE,MAAM,CAAC;IACxB,cAAc,EAAE,OAAO,CAAC;IACxB,OAAO,EAAE,OAAO,CAAC;IACjB,iBAAiB,EAAE,OAAO,CAAC;gBAEtB,MAAM,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,EAAE,cAAc,GAAE,OAAa,EAC9E,OAAO,GAAE,OAAe,EAAE,iBAAiB,GAAE,OAAe;CAcnE"}

package/lib/callgraph/pointerAnalysis/PointerAnalysisConfig.js

@@ -0,0 +1,57 @@
+"use strict";
+/*
+ * Copyright (c) 2024 Huawei Device Co., Ltd.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || function (mod) {
+    if (mod && mod.__esModule) return mod;
+    var result = {};
+    if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
+    __setModuleDefault(result, mod);
+    return result;
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PointerAnalysisConfig = void 0;
+const fs = __importStar(require("fs"));
+class PointerAnalysisConfig {
+    constructor(kLimit, outputDirectory, detectTypeDiff = false, dotDump = false, unhandledFuncDump = false) {
+        if (kLimit > 5) {
+            throw new Error("K Limit too large");
+        }
+        this.kLimit = kLimit;
+        this.outputDirectory = outputDirectory;
+        this.detectTypeDiff = detectTypeDiff;
+        this.dotDump = dotDump;
+        this.unhandledFuncDump = unhandledFuncDump;
+        if (!fs.existsSync(outputDirectory)) {
+            fs.mkdirSync(outputDirectory, { recursive: true });
+        }
+    }
+}
+exports.PointerAnalysisConfig = PointerAnalysisConfig;