GlassWing: A Tailored Static Analysis Approach for Flutter Android Apps
This program is tentative and subject to change.
The variety of mobile operating systems available in the market has led to the emergence of cross-platform frameworks, which simplify the development and deployment of mobile applications across multiple platforms simultaneously. Among these, the Flutter framework promoted by Google has become the most widely used cross-platform development framework. To date, no work has provided support for the static analysis of Flutter applications on the Android platform. State-of-the-art static analyzers fail to “see” the implicit invocation between the Dart language used by the Flutter framework and the Java used by the native Android platform, posing a significant threat to the completeness of the mobile software analysis. In this paper, we present GlassWing, the first tailored approach to static analysis for Flutter Android apps. GlassWing leverages a data-flow-oriented approach to conduct key program semantic extraction of Flutter apps and discloses the implicit Dart-Java invocation relations, thereby making cross-language invocation visible. Extensive evaluation on 1,023 popular real-world Flutter apps indicates that GlassWing enhances static analysis of Flutter apps integrated with Soot by parsing 141% more Jimple code lines, extending the call graph with more edges and nodes, and revealing almost 3X sensitive data leaks that were previously undetected with FlowDroid. GlassWing sheds light on downstream research fields for Flutter apps (e.g., program graph analysis, taint analysis, and malicious software analysis). Many current and future Android analysis initiatives can be enhanced by seamlessly incorporating GlassWing’s insights.
This program is tentative and subject to change.
Wed 19 NovDisplayed time zone: Seoul change
11:00 - 12:30 | |||
11:00 10mTalk | Resolving Conditional Implicit Calls to Improve Static and Dynamic Analysis in Android Apps Journal-First Track Jordan Samhi University of Luxembourg, Luxembourg, René Just University of Washington, Michael D. Ernst University of Washington, Tegawendé F. Bissyandé University of Luxembourg, Jacques Klein University of Luxembourg | ||
11:10 10mTalk | GlassWing: A Tailored Static Analysis Approach for Flutter Android Apps Research Papers Xiangyu Zhang DISSec, NDST, College of Cyber Science, Nankai University, China, Yucheng Su Intelligence and Offensive Defense Lab, Xiaohongshu Inc., China, Lingling Fan Nankai University, Miaoying Cai DISSec, NDST, College of Cyber Science, Nankai University, China, Sen Chen Nankai University | ||
11:20 10mTalk | Characterizing and Repairing Color-Related Accessibility Issues in Android Apps Research Papers | ||
11:30 10mTalk | Generating Failure-Based Oracles to Support Testing of Reported Bugs in Android Apps Research Papers Jack Johnson University of Minnesota, Junayed Mahmud University of Central Florida, Oscar Chaparro William & Mary, Kevin Moran University of Central Florida, Mattia Fazzini University of Minnesota | ||
11:40 10mTalk | On the (In)Security of Non-resettable Device Identifiers in Custom Android Systems Research Papers Zikan Dong Beijing University of Posts and Telecommunications, Liu Wang Beijing University of Posts and Telecommunications, Guoai Xu Harbin Institute of Technology, Shenzhen, Haoyu Wang Huazhong University of Science and Technology | ||
11:50 10mTalk | Don't Mess with Bro's Cheese! An Empirical Study of Resource Conflict in Android Multi-window Research Papers Chenkai Guo Nankai University, China, Huimin Zhao College of Cryptology and Cyber Science, Nankai University, Tianhong Wang College of Computer Science, Nankai University, Naipeng Dong The University of Queensland, Australia, Qingqing Dong College of Cryptology and Cyber Science, Nankai University, Jiarui Che College of Computer Science, Nankai University, Yaqiong Qiao College of Cryptology and Cyber Science, Nankai University, Xiangyang Luo State Key Laboratory of Mathematical Engineering and Advanced Computing, Zheli Liu Nankai University | ||
12:00 10mTalk | Profile Coverage: Using Android Compilation Profiles to Evaluate Dynamic Testing Research Papers Pre-print | ||
12:10 10mTalk | NATE: A Network-Aware Testing Enhancer for Network-Related Fault Detection in Android Apps Research Papers Yuanhong Lan Nanjing University, Shaoheng Cao Nanjing University, Yifei Lu State Key Laboratory for Novel Software Technology, Nanjing University, China, Minxue Pan Nanjing University, Xuandong Li Nanjing University | ||
12:20 10mTalk | Automated Detection of Web Application Navigation Barriers for Screen Reader Users Research Papers Shubhi Jain University of California, Irvine, Syed Fatiul Huq University of California, Irvine, Ziyao He University of California, Irvine, Sam Malek University of California at Irvine | ||