[Soot-list] FlowDroid callback extraction in obfuscated library

[Faridah Akinotcho]

Hi,

My name is Faridah Akinotcho and I am currently using FlowDroid to build static app models. For this purpose, there are specific callbacks which I need to parse and analyze. In particular, I extended the AndroidCallbacks.txt file, with 'android.support.design.widget.NavigationView$OnNavigationItemSelected' in order to obtain the callback 'boolean onNavigationItemSelected(MenuItem menuItem)'

The APK that I am working with obfuscate some of the library methods by renaming, as shown in the picture:

My understanding was that, since FlowDroid parses bytecode, it would find and parse NavigationView$OnNavigationItemSelected, then extract its interface methods. However, logs show that FlowDroid extract NavigationView$a (the obfuscated version of the interface), which results in callbacks not being found.

I was hoping I could get some clarification on whether this is the expected behavior and if so, I would greatly appreciate any pointers on how to solve this issue. Please note that, building an exhaustive list of all the obfuscated APIs and adding them to AndroidCallbacks.txt wouldn't be feasible, as the analysis I am trying to perform, will involve multiple apps, with potentially different obfuscated methods.

Best regards,

Faridah Akinotcho

[Arzt, Steven]

Dear Faridah,

FlowDroid matches the class name inside the "AndroidCallbacks.txt" against the
parameter types of registration methods inside the app. This works fine for
classes from the Android SDK, i.e., the classes installed on the phone. For
Android support classes compiled into the app, on the other hand, it might not
work, since these apps may be obfuscated and the classes may be renamed. In
that case, the matching fails and the callback will not be found.

By default, FlowDroid does not have any mechanism to detect obfuscated
callbacks. Maybe some of the work that has been done on library detection in
obfuscated apps can be adapted to detect obfuscated callbacks. If you want to
work on that, merge requests are always welcome.

Best regards,
Steven

-----Original Message-----
From: Soot-list <soot-lis...@CS.McGill.CA> On Behalf Of Faridah
Akinotcho
Sent: Mittwoch, 28. Juli 2021 03:52
To: Soot-list <soot...@cs.mcgill.ca>
Subject: [Soot-list] FlowDroid callback extraction in obfuscated library

Hi,

My name is Faridah Akinotcho and I am currently using FlowDroid to build
static app models. For this purpose, there are specific callbacks which I need
to parse and analyze. In particular, I extended the AndroidCallbacks.txt file,
with 'android.support.design.widget.NavigationView$OnNavigationItemSelected'
in order to obtain the callback 'boolean onNavigationItemSelected(MenuItem
menuItem)'

The APK that I am working with obfuscate some of the library methods by
renaming, as shown in the picture:

[Faridah Akinotcho]

Dear Mr Arzt,

Thank you for your reply and the clarification. I will look into library detection as you suggested.

Best regards,

Faridah Akinotcho

Sent from Yahoo Mail on Android