What is Soot?

Originally, Soot started off as a Java optimization framework. By now, researchers and practitioners from around the world use Soot to analyze, instrument, optimize and visualize Java and Android applications.

IMPORTANT: Soot is now succeeded by SootUp!

In December 2022, we have officially released SootUp, a version of Soot with a completely overhauled, more modular, testable, maintainable and usable architecture. Please check this out in case you wish to start a new program-analysis project.

Since there has been some confusion: SootUp is not yet feature-complete. Therefore, the “old” Soot needs to live on for the time being, especially for projects that require instrumentation capabilities or robust Android support. The “old” Soot is still being maintained until it can safely be dropped for a feature-complete successor.

What input formats does Soot provide?

Currently, Soot can process code from the following sources:

• Java (bytecode and source code up to Java 7), including other languages that compile to Java bytecode, e.g. Scala
• Android bytecode
• Jimple intermediate representation (see below)
• Jasmin, a low-level intermediate representation.

What output formats does Soot provide?

Soot can produce (possibly transformed/instrumented/optimized) code in these output formats:

• Java bytecode
• Android bytecode
• Jimple
• Jasmin

Soot can go from any input format to any output format, i.e., for instance, allows the translation from Android to Java or Java to Jasmin.

Who develops and maintains Soot?

Soot was originally developed by the Sable Research Group of McGill University. The first publication on Soot appeared at CASCON 1999. Since then, Soot has seen contributions from many people inside and outside the research community. The current maintenance is driven by Eric Bodden’s Software Engineering Group at Heinz Nixdorf Institute of Paderborn University.

This publication provides an insight into the first ten years of Soot’s development.

What kind of analyses does Soot provide?

• Call-graph construction
• Points-to analysis
• Def/use chains
• Template-driven Intra-procedural data-flow analysis
• Template-driven Inter-procedural data-flow analysis, in combination with heros (uses IFDS/IDE) or Weighted Pushdown Systems
• Aliasing can be resolved using the flow-, field-, context-sensitive demand-driven pointer analysis Boomerang
• Taint analysis in combination with FlowDroid or IDEal

What extensions exist to Soot?

• We maintain a list of extensions that can be used in combination with Soot. Feel free to add your own!

How does Soot work internally?

Soot transforms programs into an intermediate representation, which can then be analyzed. Soot provides four intermediate representations for analyzing and transforming Java bytecode:

• Baf: a streamlined representation of bytecode which is simple to manipulate.
• Jimple: a typed 3-address intermediate representation suitable for optimization.
• Shimple: an SSA variation of Jimple.
• Grimp: an aggregated version of Jimple suitable for decompilation and code inspection.

Jimple is Soot’s primary IR and most analyses are implemented on the Jimple level. Custom IRs may be added when desired.

How do I get started with Soot?

We have some documentation on Soot in the wiki, including a large range of tutorials on Soot. We also have a JavaDoc documentation and a reference on the command line options.

Including Soot in your Project

Bleeding Edge

A Soot snapshot release is currently built for each commit to the develop branch. You can include Soot as a dependency via Maven, Gradle, SBT, etc using the following coordinates:

<dependencies>
  <dependency>
    <groupId>org.soot-oss</groupId>
    <artifactId>soot</artifactId>
    <version>4.6.0-SNAPSHOT</version>
  </dependency>
</dependencies>
<repositories>
  <repository>
      <id>sonatype-snapshots</id>
      <url>https://oss.sonatype.org/content/repositories/snapshots</url>
      <releases>
          <enabled>false</enabled>
      </releases>
  </repository>
</repositories> 

You can also obtain older builds of the develop branch. A complete listing of builds can be found in Sonatype’s SNAPSHOT repository.

Stable Releases

For each commit to the master branch, a new release is pushed to Maven Central. You can include Soot as a dependency via Maven, Gradle, SBT, etc using the following coordinates:

<dependencies>
  <dependency>
    <groupId>org.soot-oss</groupId>
    <artifactId>soot</artifactId>
    <version>4.5.0</version>
  </dependency>
</dependencies>

You can also obtain older builds of the master branch. A complete listing of builds can be found on Maven Central.

How do I obtain Soot without Maven?

We recommend using Soot with Maven

You can obtain the latest release build of Soot directly.

The soot-<RELEASE>-jar-with-dependencies.jar file is an all-in-one file that also contains all the required libraries.

The soot-<RELEASE>.jar file contains only Soot, allowing you to manually pick dependencies as you need them. If you do not want to bother with dependencies, we recommend using the former.

Building Soot yourself

If you cannot work with the prebuild versions and need to build Soot on your own, please consider the wiki for further steps.

About Soot’s source code

Soot follows the git-flow convention. Releases and hotfixes are maintained in the master branch. Development happens in the develop branch. To catch the bleeding edge of Soot, check out the latter. In case of any questions, please consult the Soot mailing list at: http://www.sable.mcgill.ca/mailman/listinfo/soot-list/

Please help us improve Soot!

You are using Soot and would like to help us support it in the future? Then please support us by filling out this little web form.

That way you can help us in two ways:

• By letting us know how we can improve Soot you can directly help us prioritize newly planned features.
• By stating your name and affiliation you help us showcasing Soot’s large user base. Thanks!

Supporters

The further development of Soot is financed by generous support from the German Research Foundation, the Heinz Nixdorf Institute and Amazon Web Services.

           

Amazon Web Services is a Gold Sponsor.

Read more here about how to become a sponsor on your own.

Also many thanks to for supporting Soot with a free-to-use open source license!

Tweets by sootAnalyzer