Steven Arzt

You have built FlowDroid from source code, which is a good first step. For constructing a callgraph, you create your own Java program and reference FlowDroid as a Maven dependency....

FlowDroid does not use Trove backends for MySQL, Cassandra, etc.

Yes, that is possible. If you initialize Soot on your own, you can mark the classes to exclude as "library classes" in Soot's terminology. In the ``InfoflowConfiguration``, you then have...

The command-line application does not support such exclusions.

You only put additional JAR files on the classpath. If your APK file references classes from these JAR files, they will be analyzed together with the app. However, FlowDroid will...

I understand your goal, but it won't be easy. The APK dynamically loads the additional DEX files and uses a special class loader and reflection to transfer the control flow...

This the Jimple code: ``` public void onCreate(android.os.Bundle) { android.os.Bundle $r1; int i0; java.lang.String $r2; com.example.javatestapp.MainActivity r0; java.util.ArrayList r3, $r4; r0 := @this: com.example.javatestapp.MainActivity; $r1 := @parameter0: android.os.Bundle; specialinvoke r0.($r1);...

That's strange. I had to update quite a few things to get the SecuriBench test cases running again because they were originally based on a highly outdated version of the...

Please provide your precise FlowDroid configuration. The taint analysis should normally not look at ``if`` statements at all, unless you enable implicit flows (which I would advise against, unless you...

The ``-d`` option for merging the DEX file just makes sure that all DEX files inside the APK are processed. Without this option, a a lot of code will just...