Towards a generic framework for automating extensive analysis of Android applications

Abstract

Despite much effort in the community, the momentum of Android research has not yet produced complete tools to perform thorough analysis on Android apps, leaving users vulnerable to malicious apps. Because it is hard for a single tool to efficiently address all of the various challenges of Android programming which make analysis difficult, we propose to instrument the app code for reducing the analysis complexity, e.g., transforming a hard problem to a easy-resolvable one. To this end, we introduce in this paper Apkpler, a plugin-based framework for supporting such instrumentation. We evaluate Apkpler with two plugins, demonstrating the feasibility of our approach and showing that Apkpler can indeed be leveraged to reduce the analysis complexity of Android apps.

Mining AndroZoo: A Retrospect

“…• We intent to summarize the common parts of conducting code analysis and thereby propose generic frameworks for promoting the reuse of the implementation of fundamental functionalities [32]. For example, we plan to design a Jimple-based Instrumentation Language (JIL) and a solver that interprets JIL descriptions and thus solves instrumentation problems in a generic way [33].…”

DroidRA: taming reflection to support whole-program analysis of Android apps

“…(3) Leveraging the information yielded by the RAM module, the BOM module instruments the app and transforms it in a new app where reflective calls are augmented with standard java calls. The objective of BOM is to produce an equivalent app whose analysis by state-of-the-art tools will yield more precise results [24,25]. …”

Boosting static analysis of Android apps through code instrumentation

“…Furthermore, we have implemented a generic framework called Apkpler [15], which integrates a plugin system to reduce the analysis complexity of Android apps. With the help of Apkpler, FlowDroid can actually benefit from IccTA's output to detect ICC-aware sensitive data leaks.…”