The dynamic proxy API is one of Java’s most widely-used dynamic features, permitting principled run-time code generation and linking. Dynamic proxies can implement any set of interfaces and forward method calls to a special object that handles them reflectively. The flexibility of dynamic proxies, however, comes at the cost of having a dynamically generated layer of bytecode that cannot be penetrated by current static analyses.

In this paper, we observe that the dynamic proxy API is stylized enough to permit static analysis. We show how the semantics of dynamic proxies can be modeled in a straightforward manner as logical rules in the Doop static analysis framework. This concise set of rules enables Doop’s standard analyses to process code behind dynamic proxies. We evaluate our approach by analyzing XCorpus, a corpus of real Java programs containing dynamic proxies: we fully handle 61% of the dynamic proxies found, missing the rest due to lack of computing resources or front-end (Soot) error. Our handling results in the analysis of significant portions of previously unreachable or incompletely-modeled code.