Skip to content
Python bindings for Shimple/Jimple IR from Soot.
Python Other
  1. Python 98.9%
  2. Other 1.1%
Branch: master
Clone or download
Latest commit 051ab8d Apr 17, 2019
Type Name Latest commit message Commit time
Failed to load latest commit information.
bin public release Dec 1, 2017
doc public release Dec 1, 2017
pysoot Add pred blocks info in PhiExpr Dec 20, 2018
.gitignore public release Dec 1, 2017
.gitlab-ci.yml public release Dec 1, 2017 summary image Apr 16, 2019
pysoot_arch.png summary image Apr 16, 2019 set version number. Dec 2, 2017


pysoot is a lifter from JAR/APK files to a Soot-like Python IR.

The master branch supports Python 3, the py2k branch supports Python2.


pip install -e .

How to use

from pysoot.lifter import Lifter
input_file = "tests/test_samples/simple1.jar" # the jar/apk you want to analyze
lifter = Lifter(input_file) # the default IR is Shimple, the default input_format is jar
classes = lifter.classes # get the IR of all the classes (as a dict of classes)
print classes[classes.keys()[0]] # print the IR of one of the translated classes

Many other examples are in tests/

lifter.soot_wrapper gives direct access to some Soot functionality. As of now, I added functions from, but it is easy (and "almost" automatic) to add others.


  • Java. Currently tested using OpenJDK 8 (sudo apt-get install openjdk-8-jdk).

Other components used by pysoot are:

  • Jython. Already included in this repo, it is not neccesary to install it. The embedded version "simulates" a virtualenv with pysoot installed.
  • soot-trunk.jar. This is a slightly modified version of the pre-compiled Soot JAR. At some point, I will upload its source code and the compilation script somewhere. pysoot should also work with a normal version of soot-trunk.jar.



pysoot works by running Soot (compiled in the embedded soot-trunk.jar) using Jython (embedded) and the code in and establish an IPC bi-directional channel which allows a Python process to call methods of an instance of a class in Jython (data is serialized/deserialized using pickle). runs in Python, while runs in Jython. In the future we could release this IPC-layer as a separate component. uses this IPC channel to ask Jython to create and serialize the IR.

Classes in pysoot.sootir are used both by the Jython code and the Python one.

Data-Flow Overview

Python --> --> --> Jython --> --> --> Soot --> Soot IR

Jython --> Soot IR --> classes in pysoot.sootir -->, pickle --> Python -->, unpickle --> classes in pysoot.sootir -->

Pysoot Architecture

You can’t perform that action at this time.