LAB 1: STATIC ANALYSIS ON ANDROID APPLICATIONS Handed out Sunday Sep 18 2022 Due Monday Oct 17 2022 (Extended to Oct 20 2022)       1

LAB 1: STATIC ANALYSIS ON ANDROID APPLICATIONS

Handed out Sunday Sep 18 2022

Due Monday Oct 17 2022 (Extended to Oct 20 2022)

1. INTRODUCTION

In this lab, you will implement a static analyzer for Android applications. The static analyzer will be based on Soot, which is a open-source framework for analyzing and transforming Java and Android applications. Your static analyzers takes as input an Android app (an .apk file that is given by the instructor), and outputs two kinds of things: 1). control-flow graphs (in .dot file format) for each function; 2). a file that contains the sensitive API usage information within the given app.

You will be graded by reports. Randomly seletected students (~10%) are expected to explain your code and demonstrate that you understand what you did and why you did it that way.

2. GETTING STARTED

To get started:

a) Download the Android app.

b) Download the spreadsheet that contains Android sensitive API list (Android APIs that need permissions to run).

c) Download Soot and configure it up. Please check out this Soot tutorial for more information.

3. ASSIGNMENT

a) Collect sensitive API usage information. Given an Android application, your job is to perform static analysis to extract sensitive API usage information, and dump the info into a text file.

Each line should read: API_name:frequency:residing functions

For example: getLastLocation:2:foo(),bar() means the sensitive API getLastLocation() is called twice within the whole application, in functions foo() and bar() repectively.

b) Control-flow graph printing. For each function within the Android app, please print out its control-flow graph and save it in a dot file.

4. WHAT TO SUBMIT

You need to submit a report that includes the folowing:

Screenshot of your code (only your code)

Detailed explanation about the code

Screenshots about how you run the code and results