Predicate callback summaries

Danilo Dominguez Perez, Wei Le

Abstract: One of the challenges to analyze, test and debug Android apps is that the potential execution orders of callbacks are missing from the apps' source code, however, bugs, vulnerabilities and refactoring transformations have been found to be related to callback sequences. Existing work on control flow analysis of Android apps focuses on analyzing GUI behaviors. Our observation is that orthogonal to GUI, the Android API methods also play an important role in determining the order of callbacks, and previously, the APIs were modeled manually in an ad-hoc way. This paper presents a complementary solution of constructing program paths for Android apps. We proposed a specification called Predicate Callback Summary (PCS) that represents the callback control flow information (including callback sequences as well as the conditions the callbacks are invoked) in Android API methods. Our experiments show we can compute PCSs with reasonable accuracy and scalability and use them to build inter-callback control flow graphs for apps. Our detailed experimental data are available at: http://www.cs.iastate.edu/~weile/toolsdata/SummarizeAndroidFramework/lithium.html.