soot.jimple.infoflow.methodSummary.Main when I add multi 'toAnalyse' class,such as

'Android\\Sdk\\platforms\\android-23\\android.jar";
Sdk\\platforms\\android-23\\data\\layoutlib.jar;" +
Sdk\\platforms\\android-23\\optional\\org.apache.http.legacy.jar;"
Sdk\\platforms\\android-23\\uiautomator.jar";'. 

It cause the exception of arraylist unexpected mod count which is a multithread safe exception. I use the absoulute path , not relative path.Above is just an example.

Hello,

Flowdroid is a very useful tool. I've been learning how to use flowdroid to generate application‘s function call graph recently. However, I found that the information in the figure below will appear when analyzing some applications, and it will not stop.

I look forward to your answer to my question. Thank you very much!

Hello @StevenArzt,

I experienced some analysis with no call graph in Scene with particular apps, I think I found the problem, take a look at this simplified activity declaration :

<?xml version="1.0" package="com.android.security">
     <application android:debuggable="true" android:icon="@drawable/ic_launcher" android:label="@string/app_name">
         <activity android:label="@string/app_name" android:name=".MainActivity">
         </activity>
     </application>
</manifest>

We can see that the full name of the activity is "com.android.security.MainActivity"

Now take a look at checkAndAddComponent method in Flowdroid :

private void checkAndAddComponent(Set<String> entryPoints, AXmlNode node) {
    AXmlAttribute<?> attrEnabled = node.getAttribute("enabled");
    if (attrEnabled == null || !attrEnabled.getValue().equals(Boolean.FALSE)) {
        AXmlAttribute<?> attr = node.getAttribute("name");
            if (attr != null) {
                String className = expandClassName((String) attr.getValue());
                if (!SystemClassHandler.isClassInSystemPackage(className))
                    entryPoints.add(className);
            } else {
                // This component does not have a name, so this might be
                // obfuscated malware. We apply a heuristic.
                for (Entry<String, AXmlAttribute<?>> a : node.getAttributes().entrySet()) {
                    AXmlAttribute<?> attrValue = a.getValue();
                    if (attrValue != null) {
                        String attrValueName = attrValue.getName();
                        if ((attrValueName == null || attrValueName.isEmpty())
                                && attrValue.getType() == AxmlVisitor.TYPE_STRING) {
                            String name = (String) attrValue.getValue();
                            if (isValidComponentName(name)) {
                                String expandedName = expandClassName(name);
                                if (!SystemClassHandler.isClassInSystemPackage(expandedName))
                                    entryPoints.add(expandedName);
                            }
                        }
                    }
                }
            }
        }
    }

The piece of code we are interested in is this one :

AXmlAttribute<?> attr = node.getAttribute("name");
    if (attr != null) {
        String className = expandClassName((String) attr.getValue());
        if (!SystemClassHandler.isClassInSystemPackage(className))
            entryPoints.add(className);
    }

attr get the value : name="com.android.security.MainActivity", so it is not null, then className get the value : com.android.security.MainActivity Then a check is performed on this name, this is the code of the check :

public static boolean isClassInSystemPackage(String className) {
        return className.startsWith("android.") || className.startsWith("java.") || className.startsWith("javax.")
                || className.startsWith("sun.") || className.startsWith("org.omg.")
                || className.startsWith("org.w3c.dom.") || className.startsWith("com.google.")
                || className.startsWith("com.android.");
}

We clearly see the problem here, it is assumed that if the className startsWith "com.android." it is a system class, so the class is not added as an entrypoint. But in this case, the className startsWith "com.android." as it is equals to "com.android.security.MainActivity" but is not a system class. I think the heuristic is not precise enough.

It is very likely that in #139 it is the same issue as the main activity of @BushraAloraini app is called "com.google.sample.echo.MainActivity".

Hi there,

I'm currently trying to use the latest version of FlowDroid, which looks very handy and more modular. However, I'm a bit stuck with the new way of setting up a taint analysis programatically with sources and sinks. I think one way to do it is to start with a InfoflowAndroidConfiguration instance, but not sure about all the options…

Do you have a working example somewhere that I could use as a starting point ? I would like to use it as a library because i'm already using Soot in my program to instrument some methods from apks.

Thank you in advance :)

Hi! First I want to thank you all for developing such a handy tool for flow analysis.

Since I saw you mentioned FlowDroid is also able to compute data flows for Java programs, just wondering is there any documentation on how to analyse Jar file (from a Java program) solely instead of including an Android JAR? I saw that soot-infoflow was implemented for Java programs but are there any documentation/guide on how to do a pure Java implementation with it? Sorry for the naive question :)

Thanks a lot!

Hi @StevenArzt , I found FlowDroid manifest a weird bug on this specific app (apk). It turns out the pointsTo analysis is correct but the call graph is not correct.

I simplify the inheritance hierarchy that is related to the bug as follows. CycleStreets extends MainNavDrawerActivity, whose method onNewVersion is then overridden by CycleStreets.

class CycleStreets extends MainNavDrawerActivity {
     protected void onCreate() {
         super.onCreate();
     }

     protected void onNewVersion() {...}
}

abstract class MainNavDrawerActivity {
     protected void onCreate() {
         onNewVersion();
     }

     protected void onNewVersion() {...}
}

Then I print the call graph, the expected result should be

MainNavDrawerActivity: onCreate() ==> CycleStreets: onNewVersion()

However, the actual output is

MainNavDrawerActivity: onCreate() ==> MainNavDrawerActivity: onNewVersion()

I also locate the callsite of onNewVersion() and see the pointTo results of the base local (i.e., r0 at virtualinvoke r0.<net.cyclestreets.MainNavDrawerActivity: void onNewVersion()>()). I found the only possible types of r0 is CycleStreets, which means the pointsTo result is correct. In this case, why the call graph is not correct?

BTW, I also make my own app to simulate this inheritance structure and it looks the call graph is correct. So the bug can only be reproduced on that specific app. Could you take a look at this issue? Thanks in advance!

considering this running example:

public class Case21CastingAfterMapGet {

    public static void main(String[] args) {
        Map<String, Object> conf = new HashMap<String, Object>();
        conf.put("mode", 'c');
        conf.put("jobs", 1);
        char mode = (char) (conf.get("mode"));

        if (mode == 'c') {
            System.out.println("mode is c");
        }

        int jobs = (int) (conf.get("jobs"));
        if (jobs == 1){
            System.out.println("jobs is 1");
        }
    }
}

the source method signature is "<java.util.Map: java.lang.Object get(java.lang.Object)>" the sink we foucus on is every if statement, so I instrument a dummy sink void sink(Object o) before every if statment, so that i can track if the log shows that [main] WARN No results found. so, the question i wanna know is What causes this?, i found a paper Analyzing Android Taint Analysis Tools: FlowDroid, Amandroid, and DroidSafe described this problem, but without any solution.

Hi @StevenArzt ,

I'm wondering if there are constructs or sections of code that compute the strongly connected components of a call graph/control flow graph.

Also is it possible to get the data flow graph for a method?

Kind regards, Zhijun

I'm trying to use FlowDroid for the first time and keep having an error while doing (on windows):

java -Xmx4g -cp sootclasses-trunk-jar-with-dependencies.jar;soot-infoflow.jar;soot-infoflow-android.jar;slf4j-api-1.7.5.jar;slf4j-simple-1.7.5.jar;axml-2.0.jar s
oot.jimple.infoflow.android.TestApps.Test "C:\Users\javie\AndroidStudioProjects\Project\malware\73ddc408b518826064878dfc0064c4cd4fe512c0.apk" C:\Users\javie\AppData\Local\Android\Sdk\platforms

Running data flow analysis... Exception in thread "main" java.lang.NoSuchMethodError: soot.Body.getUnits()Lsoot/PatchingChain; at soot.jimple.infoflow.cfg.LibraryClassPatcher.patchHandlerPostBody(LibraryClassPatcher.java:386) at soot.jimple.infoflow.cfg.LibraryClassPatcher.patchHandlerImplementation(LibraryClassPatcher.java:285) at soot.jimple.infoflow.cfg.LibraryClassPatcher.patchLibraries(LibraryClassPatcher.java:44) at soot.jimple.infoflow.android.SetupApplication.initializeSoot(SetupApplication.java:1021) at soot.jimple.infoflow.android.SetupApplication.runInfoflow(SetupApplication.java:1187) at soot.jimple.infoflow.android.SetupApplication.runInfoflow(SetupApplication.java:1160) at soot.jimple.infoflow.android.TestApps.Test.runAnalysis(Test.java:798) at soot.jimple.infoflow.android.TestApps.Test.main(Test.java:249)

It's my first time to use this tool, and I want to integrate it as part of my project. I tried to add dependency statement into 'pom.xml' file and failed for that the resource doesn't exist in the central repository of maven. After I looked at the Readme of soot project and issue submitted by @xcdu, I added the following code <repositories> <repository> <id>soot-snapshot</id> <name>soot snapshots</name> <url>https://soot-build.cs.uni-paderborn.de/nexus/repository/soot-snapshot/</url> </repository> </repositories> It still goes wrong, with maven's information that ' Failed to transfer file https://soot-build.cs.uni-paderborn.de/nexus/repository/soot-snapshot/de/tud/sse/soot-infoflow-android/2.6.1/soot-infoflow-android-2.6.1.pom with status code 400'. I guess there is still something wrong in my pom file. I have succeed in running flowdoird by downloading soot-infoflow-android, soot-infoflow, soot, heros and jasmin, but it's inconvenience compared with maven style. So I want to know how to simply build it with maven. Thanks.

Hello!

A little background

I am writing a framework to execute static android security analysis tools, and I would like to inlcude FlowDroid in it to show what it can do!

Issue

I have a (small) apk, which I test with to see if my framework works okay. I found that Flowdroid does not work with my test apk:

[main] ERROR soot.jimple.infoflow.android.SetupApplication$InPlaceInfoflow - No 
sources found, aborting analysis

My apk is malware, it has sources and sinks, confirmed by multiple analysers. e.g.: I have used IccTa (with IC3), which also uses soot. There, I got a welcoming

[main] INFO soot.jimple.infoflow.data.pathBuilders.ContextSensitivePathBuilder - Obtainted 3
connections between sources and sinks

I thought: Maybe it is because of the SourcesSinks definition text file (maybe IccTa uses more fitting source/sink rules for this apk), but: After launching flowdroid with the SourcesSinks-file of IccTa, the error persisted.

Question

Do you know, by any chance, how Flowdroid's soot cannot find sources, while IccTa's soot does find them, with the same source (and sink)-definition file?

With kind regards, Sebastiaan

Hi Steven. I'm currently trying to use flowdroid to analyze android apk and give some useful feedback to user. But now I'm having difficult in getting the line number of a certain (jimple) statement. I have tried the code below

Options.v().set_keep_line_number(true); // soot option

val unit: Unit = /*certain statement*/
val lineno: Int = (unit.getTag("LineNumberTag") as LineNumberTag).lineNumber

However, the getTag("LineNumberTag") above just return null. So I wonder is the way to get line number in source right? Or you can just offer some examples to get line number of source. Thanks!

I wanted to ask if the methods inside the MainActivity class of an apk are not supposed to be defined as a source or a sink. This is because during the taint analysis these types of methods are never recognized as such, despite being declared in the sourcessinks.xml file. Meanwhile, a method in any other class is correctly identified as a source or a sink depending on the xml file definition.

Thank you.

Hello Arzt:

I use runInfoflow() to perform taint analysis which also generates a call graph. I want to add a special edge from source method to sink method in the call graph for further malware detection task. Here's an example of what I get.

$r4 = virtualinvoke $r3.<android.telephony.TelephonyManager: java.lang.String getDeviceId()>() -> $r5 = virtualinvoke $r19.<java.lang.String: java.lang.String replace(java.lang.CharSequence,java.lang.CharSequence)>("UDIDPHONE", $r5),

But many source and sink methods like android.telephony.TelephonyManager.getDeviceId don't even appear in the call graph. I want to know the reason behind this. Also I want to know how to understand the following sentence:

The sink <...> in method <...> was called with values from the following sources: - <...>() in method <...>

What does the word 'in' mean?

Thank You!

Hello @StevenArzt ! FlowDroid by default gives the following: Callgraph construction took 0 seconds // for all the applications being analyzed (a set of 50 different apps) callgraph construction is the same irrespective of the apps being analyzed and callgraph being used. Furthermore, It also gives: Collecting callbacks and building a callgraph took 18 seconds // this time is different for all apps being analyzed and callgraph being used. So, I need to measure the accurate time taken to construct the callgraph. What is the best way to do this? Any suggestion Please!

Hi @StevenArzt, I am trying to run a single class test using the next command mvn test -Dtest=soot.jimple.infoflow.test.securibench.AliasingTests in the previous line, I am trying to run a tests from Infloflow folder in its securibench folder (which I imagine are their test) Am I right?