898 lines
20 KiB
HTML
898 lines
20 KiB
HTML
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
|
|
|
|
<html>
|
|
<head>
|
|
<title>Dalvik bytecode constraints</title>
|
|
<link rel=stylesheet href="dalvik-constraints.css">
|
|
</head>
|
|
|
|
<body>
|
|
|
|
<h1>Dalvik bytecode constraints</h1>
|
|
|
|
<!--
|
|
<h1>General integrity constraints</h1>
|
|
|
|
<table>
|
|
<tr>
|
|
<th>
|
|
Identifier
|
|
</th>
|
|
|
|
<th>
|
|
Description
|
|
</th>
|
|
</tr>
|
|
|
|
<tr>
|
|
<td>
|
|
A1
|
|
</td>
|
|
|
|
<td>
|
|
The magic number of the DEX file must be "dex\n035\0".
|
|
</td>
|
|
</tr>
|
|
|
|
<tr>
|
|
<td>
|
|
A1
|
|
</td>
|
|
|
|
<td>
|
|
The checksum must be an Adler-32 checksum of the whole file contents
|
|
except magic and checksum field.
|
|
</td>
|
|
</tr>
|
|
|
|
|
|
The signature must be a SHA-1 hash of the whole file contents except magic,
|
|
checksum, and signature.
|
|
|
|
The file_size must match the actual file size in bytes.
|
|
|
|
The header_size must have the value 0x70.
|
|
|
|
The endian_tag must have either the value ENDIAN_CONSTANT or
|
|
REVERSE_ENDIAN_CONSTANT.
|
|
|
|
For each of the link, string_ids, type_ids, proto_ids, field_ids, method_ids, class_defs
|
|
and data sections, the offset and size fields must be either both zero or both
|
|
non-zero. In the latter case, the offset must be four-byte-aligned.
|
|
|
|
All offset fields in the header except map_off must be four-byte-aligned.
|
|
|
|
The map_off field must be either zero or point into the data section. In the
|
|
latter case, the data section must exist.
|
|
|
|
None of the link, string_ids, type_ids, proto_ids, field_ids, method_ids, class_defs
|
|
and data sections must overlap each other or the header.
|
|
|
|
If a map exists, then each map entry must have a valid type. Each type may
|
|
appear at most once.
|
|
|
|
If a map exists, then each map entry must have a nonzero offset and size. The
|
|
offset must point into the corresponding section of the file (i.e. a
|
|
string_id_item must point into the string_ids section) and the explicit or
|
|
implicit size of the item must match the actual contents and size of the
|
|
section.
|
|
|
|
If a map exists, then the offset of map entry n+1 must be greater or equal to
|
|
the offset of map entry n plus then size of map entry n. This implies
|
|
non-overlapping entries and low-to-high ordering.
|
|
|
|
The following types of entries must have an offset that is
|
|
four-byte-aligned: string_id_item, type_id_item, proto_id_item, field_id_item,
|
|
method_id_item, class_def_item, type_list, code_item,
|
|
annotations_directory_item.
|
|
|
|
For each string_id_item, the string_data_off field must contain a valid
|
|
reference into the data section. For the referenced string_data_item, the data
|
|
field must contain a valid MUTF-8 string, and the utf16_size must match the
|
|
decoded length of the string.
|
|
|
|
For each type_id_item, the desciptor_idx field must contain a valid reference
|
|
into the string_ids list. The referenced string must be a valid type descriptor.
|
|
|
|
For each proto_id_item, the shorty_idx field must contain a valid reference
|
|
into the string_ids list. The referenced string must be a valid shorty descriptor.
|
|
Also, the return_type_idx field must be a valid index into the type_ids section,
|
|
and the parameters_off field must be either zero or a valid offset pointing
|
|
into the data section. If nonzero, the parameter list must not contain any void
|
|
entries.
|
|
|
|
For each field_id_item, both the class_idx and type_idx fields must be a valid
|
|
indices into the
|
|
type_ids list. The entry referenced by class_idx must be a non-array reference type.
|
|
In addition, the name_idx field must be a valid reference into the string_ids
|
|
section, and the contents of the referenced entry must conform to the MemberName
|
|
specification.
|
|
|
|
For each method_id_item, the class_idx field must be a valid index into the
|
|
type_ids section, and the
|
|
referenced entry must be a non-array reference type. The proto_id field must
|
|
be a valid reference into the proto_ids list. The name_idx field must be a
|
|
valid reference into the string_ids
|
|
section, and the contents of the referenced entry must conform to the MemberName
|
|
specification.
|
|
|
|
For each class_def_item, ...
|
|
|
|
For each field_id_item, the class_idx field must be a valid index into the
|
|
type_ids list. The referenced entry must be a non-array reference type.
|
|
|
|
...
|
|
|
|
-->
|
|
|
|
<h2>
|
|
Static constraints
|
|
</h2>
|
|
|
|
<p>
|
|
Static constraints are constraints on individual elements of the bytecode.
|
|
They usually can be checked without employing control or data-flow analysis
|
|
techniques.
|
|
</p>
|
|
|
|
<table>
|
|
<tr>
|
|
<th>
|
|
Identifier
|
|
</th>
|
|
|
|
<th>
|
|
Description
|
|
</th>
|
|
|
|
<th>
|
|
Spec equivalent
|
|
</th>
|
|
</tr>
|
|
|
|
<tr>
|
|
<td>
|
|
A1
|
|
</td>
|
|
|
|
<td>
|
|
The <code>insns</code> array must not be empty.
|
|
</td>
|
|
|
|
<td>
|
|
4.8.1.1
|
|
</td>
|
|
</tr>
|
|
|
|
<tr>
|
|
<td>
|
|
A2
|
|
</td>
|
|
|
|
<td>
|
|
The first opcode in the <code>insns</code> array must have index zero.
|
|
</td>
|
|
|
|
<td>
|
|
4.8.1.3
|
|
</td>
|
|
</tr>
|
|
|
|
<tr>
|
|
<td>
|
|
A3
|
|
</td>
|
|
|
|
<td>
|
|
The <code>insns</code> array must only contain valid Dalvik opcodes.
|
|
</td>
|
|
|
|
<td>
|
|
4.8.1.4
|
|
</td>
|
|
</tr>
|
|
|
|
<tr>
|
|
<td>
|
|
A4
|
|
</td>
|
|
|
|
<td>
|
|
The index of instruction <code>n+1</code> must equal the index of
|
|
instruction <code>n</code> plus the length of instruction
|
|
<code>n</code>, taking into account possible operands.
|
|
</td>
|
|
|
|
<td>
|
|
4.8.1.5
|
|
</td>
|
|
</tr>
|
|
|
|
<tr>
|
|
<td>
|
|
A5
|
|
</td>
|
|
|
|
<td>
|
|
The last instruction in the <code>insns</code> array must end at index
|
|
<code>insns_size-1</code>.
|
|
</td>
|
|
|
|
<td>
|
|
4.8.1.6
|
|
</td>
|
|
</tr>
|
|
|
|
<tr>
|
|
<td>
|
|
A6
|
|
</td>
|
|
|
|
<td>
|
|
All <code>goto</code> and <code>if-<kind></code> targets must
|
|
be opcodes within in the same method.
|
|
</td>
|
|
|
|
<td>
|
|
4.8.1.7
|
|
</td>
|
|
</tr>
|
|
|
|
<tr>
|
|
<td>
|
|
A7
|
|
</td>
|
|
|
|
<td>
|
|
All targets of a <code>packed-switch</code> instruction must be
|
|
opcodes within in the same method. The size and the list of targets
|
|
must be consistent.
|
|
</td>
|
|
|
|
<td>
|
|
4.8.1.8
|
|
</td>
|
|
</tr>
|
|
|
|
<tr>
|
|
<td>
|
|
A8
|
|
</td>
|
|
|
|
<td>
|
|
All targets of a <code>sparse-switch</code> instruction must be
|
|
opcodes within in the same method. The corresponding table must be
|
|
consistent and sorted low-to-high.
|
|
</td>
|
|
|
|
<td>
|
|
4.8.1.9
|
|
</td>
|
|
</tr>
|
|
|
|
<tr>
|
|
<td>
|
|
A9
|
|
</td>
|
|
|
|
<td>
|
|
The <code>B</code> operand of the <code>const-string</code> and
|
|
<code>const-string/jumbo</code> instructions must be a valid index
|
|
into the string constant pool.
|
|
</td>
|
|
|
|
<td>
|
|
4.8.1.10
|
|
</td>
|
|
</tr>
|
|
|
|
<tr>
|
|
<td>
|
|
A10
|
|
</td>
|
|
|
|
<td>
|
|
The <code>C</code> operand of the <code>iget<kind></code> and
|
|
<code>iput<kind></code> instructions must be a valid index into
|
|
the field constant pool. The referenced entry must represent an
|
|
instance field.
|
|
</td>
|
|
|
|
<td>
|
|
4.8.1.12
|
|
</td>
|
|
</tr>
|
|
|
|
<tr>
|
|
<td>
|
|
A11
|
|
</td>
|
|
|
|
<td>
|
|
The <code>C</code> operand of the <code>sget<kind></code> and
|
|
<code>sput<kind></code> instructions must be a valid index into
|
|
the field constant pool. The referenced entry must represent a static
|
|
field.
|
|
</td>
|
|
|
|
<td>
|
|
4.8.1.12
|
|
</td>
|
|
</tr>
|
|
|
|
<tr>
|
|
<td>
|
|
A12
|
|
</td>
|
|
|
|
<td>
|
|
The <code>C</code> operand of the <code>invoke-virtual</code>,
|
|
<code>invoke-super</code>, <code<invoke-direct</code> and
|
|
<code>invoke-static</code> instructions must be a valid index into the
|
|
method constant pool. In all cases, the referenced
|
|
<code>method_id</code> must belong to a class (not an interface).
|
|
</td>
|
|
|
|
<td>
|
|
4.8.1.13
|
|
</td>
|
|
</tr>
|
|
|
|
<tr>
|
|
<td>
|
|
A13
|
|
</td>
|
|
|
|
<td>
|
|
The <code>B</code> operand of the <code>invoke-virtual/range</code>,
|
|
<code>invoke-super/range</code>, <code>invoke-direct/range</code>, and
|
|
<code>invoke-static/range</code> instructions must be a valid index
|
|
into the method constant pool. In all cases, the referenced
|
|
<code>method_id</code> must belong to a class (not an interface).
|
|
</td>
|
|
|
|
<td>
|
|
4.8.1.13
|
|
</td>
|
|
</tr>
|
|
|
|
<tr>
|
|
<td>
|
|
A14
|
|
</td>
|
|
|
|
<td>
|
|
A method the name of which starts with a '<' must only be invoked
|
|
implicitly by the VM, not by code originating from a Dex file. The
|
|
only exception is the instance initializer, which may be invoked by
|
|
<code>invoke-direct</code>.
|
|
</td>
|
|
|
|
<td>
|
|
4.8.1.14
|
|
</td>
|
|
</tr>
|
|
|
|
<tr>
|
|
<td>
|
|
A15
|
|
</td>
|
|
|
|
<td>
|
|
The <code>C</code> operand of the <code>invoke-interface</code>
|
|
instruction must be a valid index into the method constant pool. The
|
|
referenced <code>method_id</code> must belong to an interface (not a
|
|
class).
|
|
</td>
|
|
|
|
<td>
|
|
4.8.1.15
|
|
</td>
|
|
</tr>
|
|
|
|
<tr>
|
|
<td>
|
|
A16
|
|
</td>
|
|
|
|
<td>
|
|
The <code>B</code> operand of the <code>invoke-interface/range</code>
|
|
instruction must be a valid index into the method constant pool.
|
|
The referenced <code>method_id</code> must belong to an interface (not
|
|
a class).
|
|
</td>
|
|
|
|
<td>
|
|
4.8.1.15
|
|
</td>
|
|
</tr>
|
|
|
|
<tr>
|
|
<td>
|
|
A17
|
|
</td>
|
|
|
|
<td>
|
|
The <code>B</code> operand of the <code>const-class</code>,
|
|
<code>check-cast</code>, <code>new-instance</code>, and
|
|
<code>filled-new-array/range</code> instructions must be a valid index
|
|
into the type constant pool.
|
|
</td>
|
|
|
|
<td>
|
|
4.8.1.16
|
|
</td>
|
|
</tr>
|
|
|
|
<tr>
|
|
<td>
|
|
A18
|
|
</td>
|
|
|
|
<td>
|
|
The <code>C</code> operand of the <code>instance-of</code>,
|
|
<code>new-array</code>, and <code>filled-new-array</code>
|
|
instructions must be a valid index into the type constant pool.
|
|
</td>
|
|
|
|
<td>
|
|
4.8.1.16
|
|
</td>
|
|
</tr>
|
|
|
|
<tr>
|
|
<td>
|
|
A19
|
|
</td>
|
|
|
|
<td>
|
|
The dimensions of an array created by a <code>new-array</code>
|
|
instruction must be less than <code>256</code>.
|
|
</td>
|
|
|
|
<td>
|
|
4.8.1.17
|
|
</td>
|
|
</tr>
|
|
|
|
<tr>
|
|
<td>
|
|
A20
|
|
</td>
|
|
|
|
<td>
|
|
The <code>new</code> instruction must not refer to array classes,
|
|
interfaces, or abstract classes.
|
|
</td>
|
|
|
|
<td>
|
|
4.8.1.18
|
|
</td>
|
|
</tr>
|
|
|
|
<tr>
|
|
<td>
|
|
A21
|
|
</td>
|
|
|
|
<td>
|
|
The type referred to by a <code>new-array</code> instruction must be
|
|
a valid, non-reference type.
|
|
</td>
|
|
|
|
<td>
|
|
4.8.1.20
|
|
</td>
|
|
</tr>
|
|
|
|
<tr>
|
|
<td>
|
|
A22
|
|
</td>
|
|
|
|
<td>
|
|
All registers referred to by an instruction in a single-width
|
|
(non-pair) fashion must be valid for the current method. That is,
|
|
their indices must be non-negative and smaller than
|
|
<code>registers_size</code>.
|
|
</td>
|
|
|
|
<td>
|
|
4.8.1.21
|
|
</td>
|
|
</tr>
|
|
|
|
<tr>
|
|
<td>
|
|
A23
|
|
</td>
|
|
|
|
<td>
|
|
All registers referred to by an instruction in a double-width (pair)
|
|
fashion must be valid for the current method. That is, their indices
|
|
must be non-negative and smaller than <code>registers_size-1</code>.
|
|
</td>
|
|
|
|
<td>
|
|
4.8.1.23
|
|
</td>
|
|
</tr>
|
|
</table>
|
|
|
|
<h2>
|
|
Structural constraints
|
|
</h2>
|
|
|
|
<p>
|
|
Structural constraints are constraints on relationships between several
|
|
elements of the bytecode. They usually can't be checked without employing
|
|
control or data-flow analysis techniques.
|
|
</p>
|
|
|
|
<table>
|
|
<tr>
|
|
<th>
|
|
Identifier
|
|
</th>
|
|
|
|
<th>
|
|
Description
|
|
</th>
|
|
|
|
<th>
|
|
Spec equivalent
|
|
</th>
|
|
</tr>
|
|
|
|
<tr>
|
|
<td>
|
|
B1
|
|
</td>
|
|
|
|
<td>
|
|
The number and types of arguments (registers and immediate values)
|
|
must always match the instruction.
|
|
</td>
|
|
|
|
<td>
|
|
4.8.2.1
|
|
</td>
|
|
</tr>
|
|
|
|
<tr>
|
|
<td>
|
|
B2
|
|
</td>
|
|
|
|
<td>
|
|
Register pairs must never be broken up.
|
|
</td>
|
|
|
|
<td>
|
|
4.8.2.3
|
|
</td>
|
|
</tr>
|
|
|
|
<tr>
|
|
<td>
|
|
B3
|
|
</td>
|
|
|
|
<td>
|
|
A register (or pair) has to be assigned first before it can be
|
|
read.
|
|
</td>
|
|
|
|
<td>
|
|
4.8.2.4
|
|
</td>
|
|
</tr>
|
|
|
|
<tr>
|
|
<td>
|
|
B4
|
|
</td>
|
|
|
|
<td>
|
|
An <code>invoke-direct</code> instruction must only invoke an instance
|
|
initializer or a method in the current class or one of its
|
|
superclasses.
|
|
</td>
|
|
|
|
<td>
|
|
4.8.2.7
|
|
</td>
|
|
</tr>
|
|
|
|
<tr>
|
|
<td>
|
|
B5
|
|
</td>
|
|
|
|
<td>
|
|
An instance initializer must only be invoked on an uninitialized
|
|
instance.
|
|
</td>
|
|
|
|
<td>
|
|
4.8.2.8
|
|
</td>
|
|
</tr>
|
|
|
|
<tr>
|
|
<td>
|
|
B6
|
|
</td>
|
|
|
|
<td>
|
|
Instance methods may only be invoked on and instance fields may only
|
|
be accessed on already initialized instances.
|
|
</td>
|
|
|
|
<td>
|
|
4.8.2.9
|
|
</td>
|
|
</tr>
|
|
|
|
<tr>
|
|
<td>
|
|
B7
|
|
</td>
|
|
|
|
<td>
|
|
A register which holds the result of a <code>new-instance</code>
|
|
instruction must not be used if the same
|
|
<code>new-instance</code> instruction is again executed before
|
|
the instance is initialized.
|
|
</td>
|
|
|
|
<td>
|
|
4.8.2.10
|
|
</td>
|
|
</tr>
|
|
|
|
<tr>
|
|
<td>
|
|
B8
|
|
</td>
|
|
|
|
<td>
|
|
An instance initializer must call another instance initializer (same
|
|
class or superclass) before any instance members can be accessed.
|
|
Exceptions are non-inherited instance fields, which can be assigned
|
|
before calling another initializer, and the <code>Object</code> class
|
|
in general.
|
|
</td>
|
|
|
|
<td>
|
|
4.8.2.11
|
|
</td>
|
|
</tr>
|
|
|
|
<tr>
|
|
<td>
|
|
B9
|
|
</td>
|
|
|
|
<td>
|
|
All actual method arguments must be assignment-compatible with their
|
|
respective formal arguments.
|
|
</td>
|
|
|
|
<td>
|
|
4.8.2.12
|
|
</td>
|
|
</tr>
|
|
|
|
<tr>
|
|
<td>
|
|
B10
|
|
</td>
|
|
|
|
<td>
|
|
For each instance method invocation, the actual instance must be
|
|
assignment-compatible with the class or interface specified in the
|
|
instruction.
|
|
</td>
|
|
|
|
<td>
|
|
4.8.2.13
|
|
</td>
|
|
</tr>
|
|
|
|
<tr>
|
|
<td>
|
|
B11
|
|
</td>
|
|
|
|
<td>
|
|
A <code>return<kind></code> instruction must match its
|
|
method's return type.
|
|
</td>
|
|
|
|
<td>
|
|
4.8.2.14
|
|
</td>
|
|
</tr>
|
|
|
|
<tr>
|
|
<td>
|
|
B12
|
|
</td>
|
|
|
|
<td>
|
|
When accessing protected members of a superclass, the actual type of
|
|
the instance being accessed must be either the current class or one
|
|
of its subclasses.
|
|
</td>
|
|
|
|
<td>
|
|
4.8.2.15
|
|
</td>
|
|
</tr>
|
|
|
|
<tr>
|
|
<td>
|
|
B13
|
|
</td>
|
|
|
|
<td>
|
|
The type of a value stored into a static field must be
|
|
assignment-compatible with or convertible to the field's type.
|
|
</td>
|
|
|
|
<td>
|
|
4.8.2.16
|
|
</td>
|
|
</tr>
|
|
|
|
<tr>
|
|
<td>
|
|
B14
|
|
</td>
|
|
|
|
<td>
|
|
The type of a value stored into a field must be assignment-compatible
|
|
with or convertible to the field's type.
|
|
</td>
|
|
|
|
<td>
|
|
4.8.2.17
|
|
</td>
|
|
</tr>
|
|
|
|
<tr>
|
|
<td>
|
|
B15
|
|
</td>
|
|
|
|
<td>
|
|
The type of every value stored into an array must be
|
|
assignment-compatible with the array's component type.
|
|
</td>
|
|
|
|
<td>
|
|
4.8.2.18
|
|
</td>
|
|
</tr>
|
|
|
|
<tr>
|
|
<td>
|
|
B16
|
|
</td>
|
|
|
|
<td>
|
|
The <code>A</code> operand of a <code>throw</code> instruction must
|
|
be assignment-compatible with <code>java.lang.Throwable</code>.
|
|
</td>
|
|
|
|
<td>
|
|
4.8.2.19
|
|
</td>
|
|
</tr>
|
|
|
|
<tr>
|
|
<td>
|
|
B17
|
|
</td>
|
|
|
|
<td>
|
|
The last reachable instruction of a method must either be a backwards
|
|
<code>goto</code> or branch, a <code>return</code>, or a
|
|
<code>throw</code> instruction. It must not be possible to leave the
|
|
<code>insns</code> array at the bottom.
|
|
</td>
|
|
|
|
<td>
|
|
4.8.2.20
|
|
</td>
|
|
</tr>
|
|
|
|
<tr>
|
|
<td>
|
|
B18
|
|
</td>
|
|
|
|
<td>
|
|
The unassigned half of a former register pair may not be read (is
|
|
considered invalid) until it has been re-assigned by some other
|
|
instruction.
|
|
</td>
|
|
|
|
<td>
|
|
4.8.2.3, 4.8.2.4
|
|
</td>
|
|
</tr>
|
|
|
|
<tr>
|
|
<td>
|
|
B19
|
|
</td>
|
|
|
|
<td>
|
|
A <code>move-result<kind></code> instruction must be immediately
|
|
preceded (in the <code>insns</code> array) by an
|
|
<code>invoke-<kind></code> instruction. The only exception is
|
|
the <code>move-result-object</code> instruction, which may also be
|
|
preceded by a <code>filled-new-array</code> instruction.
|
|
</td>
|
|
|
|
<td>
|
|
-
|
|
</td>
|
|
</tr>
|
|
|
|
<tr>
|
|
<td>
|
|
B20
|
|
</td>
|
|
|
|
<td>
|
|
A <code>move-result<kind></code> instruction must be immediately
|
|
preceded (in actual control flow) by a matching
|
|
<code>return-<kind></code> instruction (it must not be jumped
|
|
to). The only exception is the <code>move-result-object</code>
|
|
instruction, which may also be preceded by a
|
|
<code>filled-new-array</code> instruction.
|
|
</td>
|
|
|
|
<td>
|
|
-
|
|
</td>
|
|
</tr>
|
|
|
|
<tr>
|
|
<td>
|
|
B21
|
|
</td>
|
|
|
|
<td>
|
|
A <code>move-exception</code> instruction must only appear as the
|
|
first instruction in an exception handler.
|
|
</td>
|
|
|
|
<td>
|
|
-
|
|
</td>
|
|
</tr>
|
|
|
|
<tr>
|
|
<td>
|
|
B22
|
|
</td>
|
|
|
|
<td>
|
|
The <code>packed-switch-data</code>, <code>sparse-switch-data</code>,
|
|
and <code>fill-array-data</code> pseudo-instructions must not be
|
|
reachable by control flow.
|
|
</td>
|
|
|
|
<td>
|
|
-
|
|
</td>
|
|
</tr>
|
|
</table>
|
|
|
|
</body>
|
|
</html>
|