Taming Reflection

Abstract

Android developers heavily use reflection in their apps for legitimate reasons. However, reflection is also significantly used for hiding malicious actions. Unfortunately, current state-of-the-art static analysis tools for Android are challenged by the presence of reflective calls, which they usually ignore. Thus, the results of their security analysis, e.g., for private data leaks, are incomplete, given the measures taken by malware writers to elude static detection. We propose a new instrumentation-based approach to address this issue in a non-invasive way. Specifically, we introduce to the community a prototype tool called DroidRA, which reduces the resolution of reflective calls to a composite constant propagation problem and then leverages the COAL solver to infer the values of reflection targets. After that, it automatically instruments the app to replace reflective calls with their corresponding Java calls in a traditional paradigm. Our approach augments an app so that it can be more effectively statically analyzable, including by such static analyzers that are not reflection-aware. We evaluate DroidRA on benchmark apps as well as on real-world apps, and we demonstrate that it can indeed infer the target values of reflective calls and subsequently allow state-of-the-art tools to provide more sound and complete analysis results.

Demystifying Hidden Sensitive Operations in Android Apps

“…Nevertheless, even for relection, our approach can still detect around one-third of HSOs. To better mitigate the impact of relection-based obfuscation on our approach, we further propose to strengthen the capability of HiSenDroid by integrating the state-of-the-art relection analysis tool DroidRA to handle relection usages [67]. After statically locating the relective calls, DroidRA can transform a relection-included Android app to a relection-free version, where the located relective calls will be represented by standard java calls.…”

“…Therefore, we believe that the technical capabilities and our results would not be signiicantly impacted by code obfuscation. Nevertheless, as part of our future work, we plan to integrate other approaches developed by our fellow researchers to mitigate these long-standing challenges, e.g., by applying DroidRA [40,67] to mitigate the impact of relection-enhanced code obfuscations.…”