Giter VIP home page Giter VIP logo

jucify's Introduction

JuCify

Unifying Android code for enhanced static analysis.

⚠️ Please checkout to the following commit to use JuCify: 6897c58350773987da0a2c52a99fd4ebf1edc39e

Getting started

Downloading the tool

git clone --recursive https://github.com/JordanSamhi/JuCify.git

Installing the tool

cd JuCify
mvn clean install

Issues

If you stumble upon a stack overflow error while building JuCify, increase memory available with this command:

export MAVEN_OPTS=-Xss32m

Then, try to rebuild.

Using the tool

java -jar JuCify/target/JuCify-0.1-jar-with-dependencies.jar options

Options:

  • -a : The path to the APK to process.
  • -p : The path to Android platofrms folder.
  • -f : Provide paths to necessary files for native reconstruciton.
  • -r : Print raw results.
  • -ta : Perform taint analysis.
  • -c : Export call-graph to text file.
  • -e : Export call-graph to dot format.

Scripts

Better use the following script to use JuCify as described in the paper.

./main.sh -f PATH_TO_APK -p PATH_TO_PLATFORMS

Built With

  • Maven - Dependency Management

License

This project is licensed under the Apache License 2.0 - see the LICENSE file for details

Contact

For any question regarding this study, please contact us at: Jordan Samhi

jucify's People

Contributors

dependabot[bot] avatar gaojun0816 avatar graux-pierre avatar jordansamhi avatar

Stargazers

 avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar

Watchers

 avatar  avatar  avatar  avatar  avatar  avatar

jucify's Issues

Could not find artifact de.tud.sse:soot-infoflow-android:pom:2.7.1

It looks like the Maven project is currently not building correctly
When I modified it to look like this:

<dependency>
			<groupId>de.fraunhofer.sit.sse.flowdroid</groupId>
			<artifactId>soot-infoflow</artifactId>
			<version>2.10.0</version>
		</dependency>
		<dependency>
			<groupId>de.fraunhofer.sit.sse.flowdroid</groupId>
			<artifactId>soot-infoflow-android</artifactId>
			<version>2.10.0</version>
		</dependency>

He turned out like this

import soot.jimple.infoflow.android.InfoflowAndroidConfiguration.SootIntegrationMode;
Unable to resolve symbol 'SootIntegrationMode'

No Flow from bytecode to native

Hello, When I use JuCify to run the benchmark app proxy_double.apk, using following command:
-a /home/zjl/Project/JuCify/benchApps/proxy_double.apk
-p /home/zjl/Project/platform
-f /home/zjl/Project/output/proxy_double_result/libnative-lib.so.dot:/home/zjl/Project/output/proxy_double_result/libnative-lib.so.result
-b /home/zjl/Project/graph/before.txt
-c /home/zjl/Project/graph/result.txt
-e /home/zjl/Project/graph/proxy_double.dot
-ta
it shows results:
JuCify v0.1 started on Wed Nov 29 16:33:27 CST 2023

[] Processing: lu.uni.trux.proxy_double
[
] Loading binary call-graphs + java-to-native and native-to-java links...
[*] Adding java-to-native Edge from <lu.uni.trux.proxy_double.MainActivity: void onCreate(android.os.Bundle)> to <DummyBinaryClass: java.lang.String Java_lu_uni_trux_proxy_1double_MainActivity_nativeProxy(java.lang.String)>
public java.lang.String Java_lu_uni_trux_proxy_1double_MainActivity_nativeProxy(java.lang.String)
{
DummyBinaryClass $r0, $r2;
java.lang.String $r1;

    $r0 := @this: DummyBinaryClass;

    $r1 := @parameter0: java.lang.String;

    $r2 = $r0;

    return $r2;

    nop;
}

[✓] Binary callgraph imported.
[*] Exporting call graph to /home/zjl/Project/graph/proxy_double.dot...
[✓] Callgraph exported.
Results:

  • App name: proxy_double
  • Analysis elapsed time: 2
  • Instrumentation elapsed time: 0
  • Taint Analysis elapsed time: 0
  • Number of nodes before Jucify: 16
  • Number of nodes after Jucify: 111
  • Number of edges before Jucify: 16
  • Number of edges after Jucify: 151
  • Number new Java-to-Native Call-Graph edges: 1
  • Number new Native-to-Java Call-Graph edges: 0
  • Number new Call-Graph reachable nodes: 57
  • Number new Call-Graph reachable nodes Java: 0
  • Number new Call-Graph reachable nodes Native: 57
  • Number new Call-Graph edges: 135
  • Has flow through native: No
    there is no flow from bytecode to native, Did I do something wrong?Can you help me?

How to associate a .dot file with a .map file

Hello, I'm a novice programmer, how to associate the .dot file in the nativediscloser generation result with the mapping relationship in the .map, because after converting the .dot file to .png format, the call graph is full of numbers, and these numbers are associated with other parameters in the map file, resulting in numbers in the result call graph generated by JuCify, can you help me?
0b30813bc87a7e4155daec0c75f3704

How to use it for boost Flowdroid

Hi, How to use JuCify to boost the FlowDroid?I get the JuCify jar file. but I don't know that how to achieve it for FlowDroid.Help!

Related Papers

Hello, I would like to ask if there is a corresponding paper for this project, if so, please recommend me, thank you

nativeDisclosurer does not work properly

Hello, I am a programming novice and am trying to run JuCify
I try to use the following command to analyze the apk file in “benchApps”, and I provided -f and -p parameters

./main.sh -f getter_imei.apk -p ....../Android/sdk/platforms

However, JuCify shows that no new edges or nodes are found

[*] Processing lu.uni.trux.getter_imei
[*] Extracting Java-to-Binary and Binary-to-Java function calls...
JuCify v0.1 started on Tue Jan 17 13:15:46 CST 2023

[*] Processing: lu.uni.trux.getter_imei
[*] Loading binary call-graphs + java-to-native and native-to-java links...
[✓] Binary callgraph imported.
Results:
 - App name: getter_imei
 - Analysis elapsed time: 1
 - Instrumentation elapsed time: 0
 - Taint Analysis elapsed time: 0
 - Number of nodes before Jucify: 16
 - Number of nodes after Jucify: 16
 - Number of edges before Jucify: 16
 - Number of edges after Jucify: 16
 - Number new Java-to-Native Call-Graph edges: 0
 - Number new Native-to-Java Call-Graph edges: 0
 - Number new Call-Graph reachable nodes: 0
 - Number new Call-Graph reachable nodes Java: 0
 - Number new Call-Graph reachable nodes Native: 0
 - Number new Call-Graph edges: 0
 - Has flow through native: No

So I wondered if there was a problem with the nativedisclosurer.

I ran launch_native_disclosurer.sh alone, it made a lot of ANGR errors

ANGR ERROR:
WARNING | 2023-01-17 12:52:58,416 | angr.project | Address is already hooked, during hook(0x500030, <SimProcedure UnimplementedHook>). Not re-hooking.

launch_native_disclosurer.sh finally displayed Error:
RecursionError: maximum recursion depth exceeded while pickling an object

Did I do something wrong?
I would appreciate it if you could answer my question.

No Flow from bytecode to native

Hello, When I use JuCify to run the benchmark app delegation_proxy.apk, using following command:
java -jar JuCify-0.1-jar-with-dependencies.jar -a delegation_proxy.apk -b before.txt -c result.txt -p ~/Library/Android/sdk/platforms -e cg.dot -ta

it shows results:

JuCify v0.1 started on Wed Oct 26 11:01:23 CST 2022

[] Processing: lu.uni.trux.delegation_proxy
[
] Loading binary call-graphs + java-to-native and native-to-java links...
[✓] Binary callgraph imported.
[] Taint Analysis in progress...
[
] No Flow found.
[✓] Taint Analysis performed.
[*] Exporting call graph to cg.dot...
[✓] Callgraph exported.
Results:

  • App name: delegation_proxy
  • Analysis elapsed time: 5
  • Instrumentation elapsed time: 0
  • Taint Analysis elapsed time: 0
  • Number of nodes before Jucify: 11
  • Number of nodes after Jucify: 11
  • Number of edges before Jucify: 10
  • Number of edges after Jucify: 10
  • Number new Java-to-Native Call-Graph edges: 0
  • Number new Native-to-Java Call-Graph edges: 0
  • Number new Call-Graph reachable nodes: 0
  • Number new Call-Graph reachable nodes Java: 0
  • Number new Call-Graph reachable nodes Native: 0
  • Number new Call-Graph edges: 0
  • Has flow through native: No

there is no flow from bytecode to native, Did I do something wrong?

Precision on NativeFlowBench & docker image

I'm also doing research on android native code. I'm currently evaluating existing tools. I tried JuCify on NativeFlowBench.

To make the evaluation process easily reproducible, I packed JuCify into a docker image: https://github.com/am009/JuCify/tree/6897c58_docker and https://hub.docker.com/r/warrenwjk/jucify.

After solving some problems, I finally got it running on NativeFlowBench. I modified some scripts to save the output of running jar and nativediscloser. Here is the result: Jucify-NativeFlowBench-6897c58-2022-6-6.zip. Only 2 cases (native_set_field_from_arg and native_source) can be detected that have flow through native?

Besides, I have a bunch of other questions.

  1. The symbolic_expression_usage branch is currently not merged into master, so I guess this functionality is still not useable? ( The symbolic_expression_usage branch in nativediscloser is merged though). In current master branch, this seems to result in a mismatch between JuCify and nativediscloser on .result file format.

  2. in commit 6897c58(recommended in readme), the scripts folder appears to contain a copy of nativediscloser code. and launch_native_disclosurer.sh is executing python3 ./main.py instead of python3 ../nativediscloser/main.py ?

  3. When I run cases from NativeFlowBench, there are plenty of small problems, like

Finally, I noticed that, because of latest angr's API change, it seems not an easy task to port nativediscloser to latest Angr?

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. 📊📈🎉

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google ❤️ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.