Android has become the most popular mobile operating system. Millions of applications, including many malwares, haven been developed for it. Android itself evolves constantly with changing features and higher complexities. It is challenging for application developers to keep up with the changes and maintain the compatibility of their apps across Android versions. Therefore, there are many challenges for application analysis tools to accurately model and analyze app behaviors across Android versions. Even though the overall system architecture of Android and many APIs are documented, many other APIs and implementation details are not, not to mention potential bugs and vulnerabilities. Techniques and tool supports are thus needed to automatically extract information from different versions of Android to help programmers understand system behaviors and APIs across different versions. This paper aims to address the need. It performs whole-system analysis for different versions of Android by using both backward and forward static analysis of intra-procedural and inter-procedural control-flow and data-flow graphs. It can collect information about functions in Android that can be invoked by applications, which are referred to as publicly accessible functions in this paper. Such information can help programmers better understand the ways in which their applications utilize system functions. We have analyzed Android versions 4.1.1, 4.2.2, 4.3, 4.4.4, 5.1.0, 6.0.1, and show basic statistics about the publicly accessible functions in different Android versions. We also use an example to illustrate that the information about publicly accessible functions can be useful in identifying unprotected system functions whose invocations may not be protected by proper permissions and may lead to security and privacy violations. * This work is done when the first author is a visiting student in the School of Information Systems at Singapore Management University.
[1]
Yingjiu Li,et al.
Attacking Android smartphone systems without permissions
,
2016,
2016 14th Annual Conference on Privacy, Security and Trust (PST).
[2]
Atanas Rountev,et al.
Rethinking Soot for summary-based whole-program analysis
,
2012,
SOAP '12.
[3]
Jacques Klein,et al.
Static Analysis for Extracting Permission Checks of a Large Scale Framework: The Challenges and Solutions for Analyzing Android
,
2014,
IEEE Transactions on Software Engineering.
[4]
Yan Wang,et al.
Static Control-Flow Analysis of User-Driven Callbacks in Android Applications
,
2015,
2015 IEEE/ACM 37th IEEE International Conference on Software Engineering.
[5]
Jacques Klein,et al.
FlowDroid: precise context, flow, field, object-sensitive and lifecycle-aware taint analysis for Android apps
,
2014,
PLDI.
[6]
Eric Bodden,et al.
How Current Android Malware Seeks to Evade Automated Code Analysis
,
2015,
WISTP.
[7]
Wenke Lee,et al.
CHEX: statically vetting Android apps for component hijacking vulnerabilities
,
2012,
CCS.
[8]
Eric Bodden,et al.
StubDroid: Automatic Inference of Precise Data-Flow Summaries for the Android Framework
,
2016,
2016 IEEE/ACM 38th International Conference on Software Engineering (ICSE).
[9]
Jacques Klein,et al.
IccTA: Detecting Inter-Component Privacy Leaks in Android Apps
,
2015,
2015 IEEE/ACM 37th IEEE International Conference on Software Engineering.