sootup-wrapper

sootup-wrapper contains the Java implementation, tests, and build pipeline for the SootUp-based call graph generator used by Debricked reachability analysis.

This repository is intentionally separate from the CLI repository so the wrapper can be developed, tested, and versioned independently.

What this repo provides

• A runnable Java wrapper: com.debricked.sootup.SootUpWrapper
• A shaded (fat) JAR artifact: SootUpWrapper.jar
• Maven-based build and test setup
• CI workflow for validation

Repository structure

java/common/
├─ pom.xml
└─ src/
   ├─ main/java/com/debricked/sootup/SootUpWrapper.java
   └─ test/java/com/debricked/sootup/SootUpWrapperTest.java

Prerequisites

• Java 11+ (project is compiled to Java 11 bytecode)
• Maven 3.8+

Build

From repository root:

mvn -f java/common/pom.xml clean package

Generated artifact:

java/common/target/sootup-wrapper-1.0.0.jar

This JAR includes all required dependencies (shade plugin) and can be executed directly.

Test

mvn -f java/common/pom.xml test

Local usage

Example:

java -jar java/common/target/sootup-wrapper-1.0.0.jar \
  -u /path/to/compiled/classes \
  -l /path/to/dependency/jars \
  -f debricked-call-graph.java

Supported flags:

• -u <dir>: user class directory (repeatable)
• -l <dir>: dependency JAR directory (optional)
• -f <file>: output file path (default: debricked-call-graph.java)
• -a <algo>: algorithm (rta or cha, default cha)

Output

The wrapper writes a Debricked call graph JSON payload (version 5) to the output file.

How CLI consumes this

The CLI does not own this Java source. It consumes the built wrapper artifact and uses it when the Java callgraph engine is set to sootup.

Engine behavior

SootUp is an alternative Java call graph engine. The default engine in Debricked CLI remains Soot.

• SootUp is opt-in and is only used when explicitly selected through configuration or a parameter.
• Each scan uses one engine only: either Soot or SootUp. Results are never merged into a hybrid call graph.
• Results may differ from the default Soot engine because SootUp is a separate implementation with different analysis behavior.
• Some libraries may currently trigger SootUp analysis issues that reduce call graph coverage in certain cases.
• Coverage and stability are being improved incrementally while keeping the default Soot engine unchanged.

In CLI release/build flow:

1. Build this project (java/common)
2. Take the produced JAR
3. Embed/copy it into CLI packaging input (SootUpWrapper.jar)

Notes

• Do not commit extracted dependency trees like sootup/core, cache, frontend, etc. Those are dependency artifacts, not maintained source code.
• Keep API/CLI compatibility stable for wrapper flags so CLI integration remains seamless.
• sootup.dummy.InvokeDynamic placeholders are filtered from exported payload output.
• If the SootUp TypeAssigner workaround is triggered, excluded jars are printed to stderr/stdout for CLI/user visibility.