Create Control Flow Graph from Android apk Using Soot

Control Flow Graph(Call graphs) Using Soot

Lets look at command to convert any android apk file into Control flow graph or call graphs using soot as a command line tool. This will creates Jimple files for all the classes from apk and dot files for all the methods which is graphical representation as Control Flow Graph (CFG) or call graphs.

For conversion, you need to:

> Download any .apk file

> Download android sdk from android developer site or download android jars

> Download Soot's nightly build version from Soot- Github

Before applied command, you need to know right path for android sdk -platforms directory, .apk file located directory and nightly build version of soot at right directory

Set CLASSPATH of Soot.jar or go to the directory that contains Soot.jar file then type following Command:

> java -Xmx2g -jar soot-trunk.jar soot.tools.CFGViewer -w -allow-phantom-refs       -android-jars "D:\sdk\platform" -src-prec apk -output-format dex         -process-dir "C:\apkpath\example.apk"

If you have already set CLASSPATH for jar then type following

>java -Xmx2g soot.tools.CFGViewer -w -allow-phantom-refs -android-jars "D:\sdk\platform" -src-prec apk -output-format dex -process-dir "C:\apkpath\example.apk"

Details: -Xmx2g it represents memory of 2GB which is normally sufficient for any apk process.

-jar can be replaced by -cp which means CLASSPATH or it represent command prompt's current directory.

-W stands for writing

-allow-phantom-refs creates phantom classes for missing or unprocessed classes

-android-jars leads to path for android sdk or jars to process apks

-src-prec represents the file format you are trying to process

-output-format dex is responsible for converting all the classes from apk into dex format

-process-dir shows the path for processing directory or apk located directory

   

This will generate Jimple and dot files in sootOutput directory. The dot files are further used to create control flow graphs by using tools like graphviz .(More about Grphviz click here) 

Converting a java Class file to Soot's Intermediate Representation Jimple.

Converting a java Class file to Soot's Intermediate Representation Jimple.

Lets look at example to convert java files to Jimple. Here, I am using HelloWorld. java and convert it to class by using javac and Now i am converting HelloWorld.Class to Jimple file.

HelloWorld.Java Contains:

public class HelloWorld{

String output="";

static HelloWorld helloObj;

public HelloWorld(){

output ="Hello world";

}

public String printMessage(){

return output;

}

public static void main(String[] args)

{

helloObj = new HelloWorld();

System.out.println(helloObj.printMessage());

}

} 

Before try to convert into jimple file make sure the class file (HelloWorld.Class) is in the same directory as command line or you set the class-path properly.

Now, to convert class file to Jimple type following on your command line:

>Java soot.Main -f J HelloWorld

(J can be replaced by jimple)

>Java soot.Main -f jimple HelloWorld

(if your classpath is not set)

>Java -cp soot-2.5.0.jar soot.Main -f -J HelloWorld

If you got errors Like could not load class file, pool error at Line 31 etc.
 >Java -cp soot-2.5.0.jar soot.Main -f J -allow-phantom-refs HelloWorld

 -allow-phantom-refs : This option will generate phantom class of error codes and command. 
-f : represents the format for output 
-J: represents the jimple format
HelloWorld: Java class file
-cp: Classpath

Normally, in command works as: JAVA [JAVA OPTIONS]  SOOT[SOOT OPTIONS]

For result, go to soot directory where jar files are located, here soot automatically creates sootOutput directory and you can find HelloWorld.jimple file.

Testing Your Soot Installation

Testing Your Soot Installation

To test your soot installation as command line tools do following:

Open command Prompt and type following if you already set Soot's jar class-path :

Java soot.Main -version

If you haven't set classpath yet go to Soot jar located directory from command and type following

Java -cp soot-2.5.0.jar soot.Main -version

it will show following:

For help type --help instead of -version and it will show all the soot related commands for your help.

PROGRAM ANALYSIS OF SMART PHONE APPS

PROGRAM ANALYSIS OF SMART PHONE APPS

(A research based on program analysis of smart phone applications)

You can find complete tutorials

BY; CHALISE BIRENDRA

Abstract

Here, I am going to present the static analysis of an android app (Google Chrome) with the help of control flow graphs(CFGs) generated by using java bytecode analysis tool soot. For, control flow graphs, Soot converts the android application into its intermediate format(.jimple) and dot file of all methods which is further converted into control flow graphs through graph generated software i.e. Graphviz, before analyzing statically.

Additionally, the graphical representation of an app is created in the form of control flow graphs which is created for all possible java methods of the android app, and implemented to do static analysis of the app. I also generate and calculate the numbers of all java methods as CFG and classes as intermediate representation i.e.jimple.

Finally, I will introduce a new analysis that integrates and enhances existing Android app static analyses and successfully tests the static analysis of given android app by calculating the time span for extracting the methods from an app, number of all reachable classes and methods for the purpose of the CFG static analysis. 

Introduction

Here I am using Soot[1] to convert Android apk to Intermediate Representation mostly as Jimple (can be use baf, Shimple, Grimph etc) and produce Jimple files of each class that belongs to apk graphical representation of each method as dot file which further will generate Control flow graph for static analysis of android apk based on the process of java bytecode [6] (see in figure 1).

Figure 1: Java Bytecode

Moreover, I am using another technique to get similar results for static analysis with soot as Dalvik bytecode to Jimple. As Jimple is Soot’s main internal representation of code, the Dalvik bytecode can be manipulated with any Jimple based tool, for instance for performing point-to or flow analysis.

 Finally, I am able to convert any .java, .class, .apk and .jar files to its all intermediate representation jimple, baf, simple, grimph etc; Create Control Flow Graph, assemble/dissemble, .dex , .apk or delvik bytecode[1,2] which further helps to perform static analysis of all Java or Android files and apps for various security purpose as well[3].