Taint verification from Java application code

[marie]

Hi,
I developed an application that extract the IMEI of the android and stores it in a string.

My question is: How can I verify if this string is tainted or not by using eclipse? I want to know exactelly what command have I to write in the Java application code to test if the data are tainted?

Note that the taintdroid's notification does not appear in the emulator and no taint results appear in the Log file.

Thank you

[Tobias Markmann]

Hi,

you could try using the public static methods of dalvik.system.Taint [1]. If you want to get taint values of IPC parcels, you can try the modifications I made in [2] and [3].

Cheers,

Tobi

[1] https://github.com/FlowGraph/android_platform_libcore/blob/taintdroid-2.3.4_r1/dalvik/src/main/java/dalvik/system/Taint.java

[2] https://github.com/FlowGraph/android_platform_frameworks_base/commit/a3625332ae04d3e703bb95288ae6d9d9a53c610c

[3] https://github.com/FlowGraph/android_platform_frameworks_base/blob/2455ff6702527e93fc05674923db951b5528b125/core/java/android/os/Parcel.java

[marie chatti]

I used "getTaintString" as following:

            TelephonyManager tm = (TelephonyManager) getSystemService(Context.TELEPHONY_SERVICE);

            String device_id = tm.getDeviceId();
               getTaintString(device_id);

it displays this error message:

The method getTaintString(String) is undefined for the type HelloAndroid2Activity.

2013/5/13 Tobias Markmann <tmar...@googlemail.com>

--
You received this message because you are subscribed to the Google Groups "TaintDroid" group.
To unsubscribe from this group and stop receiving emails from it, send an email to taintdroid+...@googlegroups.com.
For more options, visit https://groups.google.com/groups/opt_out.
 
 

[Tobias Markmann]

On 13 May 2013 13:53, "marie chatti" <marm...@gmail.com> wrote:
>
> I used "getTaintString" as following:
>
>             TelephonyManager tm = (TelephonyManager) getSystemService(Context.TELEPHONY_SERVICE);
>
>             String device_id = tm.getDeviceId();
>                getTaintString(device_id);
> it displays this error message:
>
> The method getTaintString(String) is undefined for the type HelloAndroid2Activity.

Does Taint.getTaintString(...) work? have you imported dalvik.system?

[marie]

i have imported :

import dalvik.system.*;
import dalvik.annotation.*;

and i have added:

 Taint.getTaintString(device_id);

but it displays this error message:

"Taint cannot be resolved"

[William Enck]

Hi Marie,

To use the dalvik.system.Taint class in your code in Eclipse, you have
to build TaintDroid with "make sdk" and point Eclipse at the resulting
SDK. Please search the archives of this mailing list for additional
details on how to do this.

-Will

> --
> You received this message because you are subscribed to the Google Groups
> "TaintDroid" group.
> To unsubscribe from this group and stop receiving emails from it, send an
> email to taintdroid+...@googlegroups.com.
> For more options, visit https://groups.google.com/groups/opt_out.
>
>

--
William Enck
Assistant Professor
Department of Computer Science
North Carolina State University
Email: en...@cs.ncsu.edu
Web: http://www.enck.org