FlowDroid icon indicating copy to clipboard operation
FlowDroid copied to clipboard

Does FlowDroid suppoert Reflection in Call Graph?

Open Reza-saeedi opened this issue 3 years ago • 0 comments

Hi, I created a test application which includes following classes :

MainActivity :

public class MainActivity extends AppCompatActivity {
    @Override
    protected void onCreate(Bundle savedInstanceState) {
        super.onCreate(savedInstanceState);
        setContentView(R.layout.activity_main);
        IMEIManager.initIMEI(this);
    }
}

IMEIManager :

public class IMEIManager {

    public static void initIMEI(Context context)
    {
        try {
            Class.forName("com.test.app.ReflectiveClass").getDeclaredMethod("sendIMEI", new Class[]{Context.class}).invoke(null, new Object[]{context});
        } catch (Exception unused) {
            Toast.makeText(context,"IMEI Reflection Error",Toast.LENGTH_LONG).show();
        }

    }
}

ReflectiveClass:

public class ReflectiveClass{

    public static void sendIMEI(Context context)
    {
        if (ActivityCompat.checkSelfPermission(context, Manifest.permission.READ_PHONE_STATE) != PackageManager.PERMISSION_GRANTED) {
            return;
        }
        String imei="";
        TelephonyManager tm = (TelephonyManager)
                context.getSystemService(MainActivity.TELEPHONY_SERVICE);
        if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.O) {
            tm.getImei();
            imei = tm.getImei();
        } else {
            tm.getDeviceId();
            imei = tm.getDeviceId();
        }
        Toast.makeText(context,"IMEI: "+imei,Toast.LENGTH_LONG).show();
    }
}

then i used this code to generate call graph

SetupApplication app = new SetupApplication(androidPlatform, appToRun);
app.getConfig().setEnableReflection(true);
app.runInfoflow("SourcesAndSinks.txt");
Scene.v().getCallGraph().toString();

But as a result of this run i get an incomplete graph, which only contained the following information about ReflectiveClass and nothing about TelephonyManager .

.
.
.
STATIC edge: $r2 = staticinvoke <java.lang.Class: java.lang.Class forName(java.lang.String)>("com.test.app.ReflectiveClass") in <com.test.app.IMEIManager: void initIMEI(android.content.Context)> ==> <java.lang.Class: java.lang.Class forName(java.lang.String)>

STATIC edge: $r6 = staticinvoke <android.widget.Toast: android.widget.Toast makeText(android.content.Context,java.lang.CharSequence,int)>($r1, "IMEI Reflection Error", 1) in <com.test.app.IMEIManager: void initIMEI(android.content.Context)> ==> <android.widget.Toast: android.widget.Toast makeText(android.content.Context,java.lang.CharSequence,int)>

VIRTUAL edge: $r4 = virtualinvoke $r2.<java.lang.Class: java.lang.reflect.Method getDeclaredMethod(java.lang.String,java.lang.Class[])>("sendIMEI", $r3) in <com.test.app.IMEIManager: void initIMEI(android.content.Context)> ==> <java.lang.Class: java.lang.reflect.Method getDeclaredMethod(java.lang.String,java.lang.Class[])>
.
.
.

I know FlowDroid use soot to create call graph, but i want to know if this is a soot problem or because of the wrong commands i used to run FlowDroid.

Thank you very much.

Reza-saeedi avatar Dec 17 '20 17:12 Reza-saeedi