YABR 1.0.1

A unified, bidirectional framework for Java (de)compilation, analysis, and transformation.

Layers

Class Files

The parsed class file: constant pool, members, attributes, and the pool of classes they resolve through. Everything above this reads and writes through it.

Bytecode

One type per JVM instruction, a code writer for structural edits, StackMapTable frame computation, and fluent builders for new classes.

SSA IR

Bytecode lifted into single static assignment form over a control flow graph, with the analyses and optimisation passes that run on it, and lowering back to bytecode.

Decompiler

Recovery of a Java syntax tree from the IR, the transforms that turn it into idiomatic source, the emitter that renders it, and the parser and lowerer that take source back down.

Analyses

Graphs over the IR: call graph, code property graph, program and system dependence graphs with slicing, taint tracking, data flow, cross-references, fingerprinting and similarity.

Execution

Running bytecode three ways: a concrete interpreter with debugging, abstract simulation with a points-to heap and escape analysis, and abstract execution for def-use links. Also instrumentation weaving and the bytecode verifier.

Query

A query language over a class pool, from parsing through planning to evaluation.

Renaming

Hierarchy-aware renaming of classes, fields and methods, with descriptor and signature rewriting.

Package	Description
com.tonic.analysis	Reading and writing bytecode: disassembly, editing through a code writer, and constant pool remapping.
com.tonic.analysis.absexec	Abstract execution that builds def-use links by walking every path through a method.
com.tonic.analysis.callgraph	The call graph over a class pool.
com.tonic.analysis.common	References shared by the bytecode analysis passes.
com.tonic.analysis.cpg	The code property graph, joining syntax, control flow and data flow in one graph.
com.tonic.analysis.cpg.edge	Edges of the code property graph.
com.tonic.analysis.cpg.node	Nodes of the code property graph.
com.tonic.analysis.cpg.query	Queries over a code property graph.
com.tonic.analysis.cpg.taint	Taint tracking from sources to sinks over the code property graph.
com.tonic.analysis.dataflow	The data flow graph over a method's values.
com.tonic.analysis.dependency	Dependencies between classes.
com.tonic.analysis.execution.core	The bytecode interpreter with the context it runs against and the result it returns.
com.tonic.analysis.execution.debug	Breakpoints, stepping and state inspection over a running interpreter.
com.tonic.analysis.execution.dispatch	Per-opcode dispatch and the call site information it resolves.
com.tonic.analysis.execution.frame	The interpreter's call stack and its frames.
com.tonic.analysis.execution.heap	The interpreter's heap: objects, arrays and the interned string pool.
com.tonic.analysis.execution.invoke	Invocation handling, covering native dispatch, lambda proxies and string concatenation.
com.tonic.analysis.execution.invoke.handlers	Native handlers for the JDK methods the interpreter cannot run as bytecode.
com.tonic.analysis.execution.listener	Listeners notified as the interpreter runs.
com.tonic.analysis.execution.resolve	Resolution of classes, methods and fields for the interpreter.
com.tonic.analysis.execution.result	The result an interpreter run reports.
com.tonic.analysis.execution.state	Concrete interpreter state: the operand stack, the locals and the values they hold.
com.tonic.analysis.fingerprint	Structural fingerprints of methods and the matching between them.
com.tonic.analysis.fingerprint.features	The feature levels a method fingerprint is built from.
com.tonic.analysis.frame	StackMapTable frame computation and the type lattice it infers over.
com.tonic.analysis.graph.export	Export of the analysis graphs to DOT.
com.tonic.analysis.graph.print	Textual printing of the analysis graphs.
com.tonic.analysis.instruction	One type per JVM instruction, with the factory that decodes a method body into them.
com.tonic.analysis.instrumentation	Weaving hooks into a class.
com.tonic.analysis.instrumentation.factory	Construction of instrumentation from a configuration.
com.tonic.analysis.instrumentation.filter	Filters selecting what instrumentation applies to.
com.tonic.analysis.instrumentation.hook	The hook kinds that can be woven, one per intercepted event.
com.tonic.analysis.instrumentation.transform	Application of instrumentation as a class transform.
com.tonic.analysis.pattern	Search for instruction patterns within a method.
com.tonic.analysis.pdg	The program dependence graph for a method.
com.tonic.analysis.pdg.edge	Edges of the program dependence graph.
com.tonic.analysis.pdg.node	Nodes of the program dependence graph.
com.tonic.analysis.pdg.sdg	The system dependence graph, linking per-method dependence graphs across calls.
com.tonic.analysis.pdg.sdg.node	The call and parameter nodes that join methods in the system dependence graph.
com.tonic.analysis.pdg.sdg.slice	Slicing over the system dependence graph.
com.tonic.analysis.pdg.slice	Slicing over a program dependence graph.
com.tonic.analysis.query.ast	The query language's syntax tree.
com.tonic.analysis.query.eval	Evaluation of a query's conditions against a subject.
com.tonic.analysis.query.exec	Running queries against a class pool.
com.tonic.analysis.query.parser	The query language parser and the tokens it reads.
com.tonic.analysis.query.planner	Planning a parsed query into probes over candidate targets.
com.tonic.analysis.query.planner.filter	Filters that narrow query candidates before probing.
com.tonic.analysis.query.planner.visitor	Scope traversal used while planning a query.
com.tonic.analysis.query.util	Argument type analysis for queries.
com.tonic.analysis.query.value	The values and operators a query condition compares.
com.tonic.analysis.similarity	Comparison of methods by bytecode, opcode sequence and structure.
com.tonic.analysis.simulation.core	Abstract simulation of a method, intra-procedurally or across calls.
com.tonic.analysis.simulation.heap	The simulated heap, with allocation sites, points-to queries and escape analysis.
com.tonic.analysis.simulation.listener	Listeners notified as a simulation proceeds.
com.tonic.analysis.simulation.metrics	Metrics collected from the simulation listeners.
com.tonic.analysis.simulation.query	Queries over a simulation result.
com.tonic.analysis.simulation.state	Immutable simulation state: stack, locals, call stack and the values they hold.
com.tonic.analysis.simulation.util	State transitions shared by the simulation engines.
com.tonic.analysis.source.ast	The AST node model, its locations, and the list type that keeps parent links consistent.
com.tonic.analysis.source.ast.decl	Declaration nodes: compilation units, types, members and parameters.
com.tonic.analysis.source.ast.expr	Expression nodes and their operators.
com.tonic.analysis.source.ast.stmt	Statement nodes.
com.tonic.analysis.source.ast.transform	Passes that reshape a recovered AST into idiomatic source and undo what the compiler desugared.
com.tonic.analysis.source.ast.type	Source-level types, from primitives through generics, wildcards and intersections.
com.tonic.analysis.source.ast.validation	Structural checks over a built AST.
com.tonic.analysis.source.decompile	The decompilation entry point and its configuration.
com.tonic.analysis.source.editor	Editing a recovered AST by matching nodes and replacing them.
com.tonic.analysis.source.editor.handler	Per-node handlers the editor dispatches an edit to.
com.tonic.analysis.source.editor.matcher	Predicates selecting the statements and expressions an edit applies to.
com.tonic.analysis.source.editor.util	Node construction helpers for edits.
com.tonic.analysis.source.emit	Rendering an AST as formatted Java source.
com.tonic.analysis.source.lower	Lowering an AST back into the SSA IR.
com.tonic.analysis.source.parser	The Java source parser and the tokens it reads.
com.tonic.analysis.source.recovery	Recovering statements, expressions, names and types from the IR.
com.tonic.analysis.source.recovery.rcs	Reaching-condition structuring, recovering control flow through boolean formulas and BDDs.
com.tonic.analysis.source.visitor	Visitors over the source AST.
com.tonic.analysis.ssa	Entry point for building, transforming and printing the SSA intermediate representation.
com.tonic.analysis.ssa.analysis	Analyses over the IR: dominance, liveness, loops and def-use chains.
com.tonic.analysis.ssa.cfg	The control flow graph: methods, blocks, edges and exception handlers.
com.tonic.analysis.ssa.ir	The IR instruction set and the operators its instructions carry.
com.tonic.analysis.ssa.lift	Lifting bytecode into SSA form, including phi insertion and renaming.
com.tonic.analysis.ssa.llvm	Lowering the IR to an LLVM textual module.
com.tonic.analysis.ssa.llvm.lift	Parsing LLVM text back into the IR.
com.tonic.analysis.ssa.lower	Lowering SSA back to bytecode: phi elimination, register allocation, scheduling and emission.
com.tonic.analysis.ssa.transform	Optimisation passes over the IR, at method and class level.
com.tonic.analysis.ssa.type	The IR type lattice.
com.tonic.analysis.ssa.util	Cloning support for IR methods.
com.tonic.analysis.ssa.value	SSA values and the constants they can hold.
com.tonic.analysis.ssa.visitor	Visitors over IR methods, blocks and instructions.
com.tonic.analysis.typeinference	Inference of value types and nullability.
com.tonic.analysis.verifier	Bytecode verification and the errors it reports.
com.tonic.analysis.verifier.controlflow	Verification of branch targets and exception table ranges.
com.tonic.analysis.verifier.stackmap	Verification of a method against its StackMapTable.
com.tonic.analysis.verifier.structural	Verification of instruction operands and overall method structure.
com.tonic.analysis.verifier.type	The type rules the verifier checks assignments and invocations against.
com.tonic.analysis.visitor	Visitor over decoded instructions.
com.tonic.analysis.xref	Cross-references from a method or field to the places that use it.
com.tonic.builder	Fluent builders for classes, fields, methods, code and annotations.
com.tonic.exception	Failures raised when a class file does not match the format it claims.
com.tonic.parser	The class file model: a pool of loaded classes, one parsed class, its constant pool and its members.
com.tonic.parser.attribute	The attribute structures a class, field, method or code block can carry.
com.tonic.parser.attribute.annotation	Annotation values as stored in the runtime annotation attributes.
com.tonic.parser.attribute.module	The directive entries of a module attribute.
com.tonic.parser.attribute.stack	StackMapTable frames and the verification types their slots hold.
com.tonic.parser.attribute.table	Row types for the tables attributes carry, from exception handlers to local variable ranges.
com.tonic.parser.constpool	Constant pool entries, one type per tag.
com.tonic.parser.constpool.structure	Resolved views over the pool entries that reference other entries.
com.tonic.parser.util	Descriptor parsing shared by the class file model.
com.tonic.parser.visitor	Visitors over a parsed class and its methods.
com.tonic.renamer	Renaming of classes, fields and methods across a class pool.
com.tonic.renamer.descriptor	Rewriting of descriptors and generic signatures under a rename mapping.
com.tonic.renamer.exception	Failures raised when a rename is invalid or collides.
com.tonic.renamer.hierarchy	The class hierarchy a rename has to stay consistent with.
com.tonic.renamer.mapping	The old-to-new name mappings a rename applies.
com.tonic.renamer.validation	Checks that a rename mapping is legal before it is applied.
com.tonic.type	Access flags, method handles and type descriptors shared across the toolchain.
com.tonic.util	Shared facts and helpers: opcodes, instruction lengths, descriptors, class names and logging.