Program Analysis of Google Chrome

Program Analysis of Google Chrome

Tested Android Application

The android Chrome application is taken as demonstration application originally developed by the Goolgle Team on Android platform. It features 4552 classes, 14184 methods and was written in Java code. The first method used is conversion of java codes in to soot’s intermediate representation Jimple files for each 4552 java classes and graphical representation for each 14184 methods which further converted in to control flow graph and call graph based on nodes and edges inside the method. Secondly, the generated Dalvik bytecode contains Dalvik instructions.

From the Dalvik bytecode of the Chrome application I generate Jimple code in one second (duration for the Dalvik to Jimple conversion only). Then I ask Soot to generate Java bytecode from the Jimple representation. I convert the Java bytecode back to Dalvik, repackage an Android application and launch it on the Android emulator. The application runs smoothly and the app is working.

Static Analysis on Chrome

I use Soot to generate a call graph of the Chrome application, portion of the control flow graph represented in Figure 2.

Control Flow analysis Graph (Call Graph) for  org.chromium.chrome.browser.preferences.website.WebsitemergePermissionInfoForTopLevelOrigin(org.chromium.chrome.browser.preferences. website.WebsiteAddress,java.util.List) Method Extracted from the Generated Jimple Representation. .36 seconds (duration from the launch time of Soot until Soot has finished). I perform this to check that the generated call graph and CFG correspond to the original code meaning that the conversion from Dalvik to Jimple is correct for this code.

I have successfully tested Soot as IR Jimple conversion to and another tool Dalvik bytecode to an Android application.

Figure 2: Partial Call graph for (chrome.browser.preferences.website) method

Process Analysis

Firstly, I used soot for conversion of Chrome.apk i.e. downloads from google play store to Soot’s Intermediate Representation Jimple and Soot’s CFG Viewer to produce graphical representation of all the methods from classes as dot files based on existing works of Droiddel[7].

Second Method, since there no existing tool directly converts Dalvik bytecode to Jimple. I either found tools to convert Dalvik bytecode to Java bytecode or tools to disassemble and/or assemble assemble Dalvik bytecode using an intermediate representation [4].

Dalvik to Java Bytecode Converter Ded is a Dalvik bytecode to Java bytecode converter. Once the Java bytecode is generated, Soot is used to optimize the code. Dex2jar also generates Java bytecode from Dalvik bytecode but no not use any external tool to optimize the resulting Java bytecode [5]. Undx is also a Dalvik to Java bytecode converter but seems to be unavailable. I on the other hand do not directly generate Java bytecode but Jimple code.

From there, since the Jimple code is within Soot, I can generate Java bytecode as well. Dalvik Assembler/Disassembler Smali or Androguard can be used to reverse engineer Dalvik bytecode. They use their own representation of the Dalvik bytecode: they cannot leverage existing analysis tools. This tool, use Soot’s internal representation which allows existing tools to analyze/transform the Dalvik bytecode [7].

Conclusion

Here we introduced a new analysis that integrates and enhances existing Android app static analyses. I have presented the phenomena of static analysis of android apps based on the control flow graphs by using soot. I successfully use conversion of an android app (java byte code) into dalvik bytecode (android app). And generate the control flow graphs from java methods and perform the static analysis.

This can further be used for static analysis of any android apps or java programs and computation of nodes and edges for the analysis of the complex algorithm. Finally, it is also can be used on static fields, implicit flow, distinguish different receive intents as well as other data channels.

Create Control Flow Graph from Android apk Using Soot

Control Flow Graph(Call graphs) Using Soot

Lets look at command to convert any android apk file into Control flow graph or call graphs using soot as a command line tool. This will creates Jimple files for all the classes from apk and dot files for all the methods which is graphical representation as Control Flow Graph (CFG) or call graphs.

For conversion, you need to:

> Download any .apk file

> Download android sdk from android developer site or download android jars

> Download Soot's nightly build version from Soot- Github

Before applied command, you need to know right path for android sdk -platforms directory, .apk file located directory and nightly build version of soot at right directory

Set CLASSPATH of Soot.jar or go to the directory that contains Soot.jar file then type following Command:

> java -Xmx2g -jar soot-trunk.jar soot.tools.CFGViewer -w -allow-phantom-refs       -android-jars "D:\sdk\platform" -src-prec apk -output-format dex         -process-dir "C:\apkpath\example.apk"

If you have already set CLASSPATH for jar then type following

>java -Xmx2g soot.tools.CFGViewer -w -allow-phantom-refs -android-jars "D:\sdk\platform" -src-prec apk -output-format dex -process-dir "C:\apkpath\example.apk"

Details: -Xmx2g it represents memory of 2GB which is normally sufficient for any apk process.

-jar can be replaced by -cp which means CLASSPATH or it represent command prompt's current directory.

-W stands for writing

-allow-phantom-refs creates phantom classes for missing or unprocessed classes

-android-jars leads to path for android sdk or jars to process apks

-src-prec represents the file format you are trying to process

-output-format dex is responsible for converting all the classes from apk into dex format

-process-dir shows the path for processing directory or apk located directory

   

This will generate Jimple and dot files in sootOutput directory. The dot files are further used to create control flow graphs by using tools like graphviz .(More about Grphviz click here) 

How to Convert any Android apk file into Soot's Intermediate Representation Jimple

How to Convert any Android apk file into Soot's Intermediate Representation Jimple

Lets look at command to convert any android apk file into Jimple. 

For conversion, you need to:

> Download any .apk file

> Download android sdk from android developer site or download android jars

> Download Soot's nightly build version from Soot- Github

Before applied command, you need to know right path for android sdk -platforms directory, .apk file located directory and nightly build version of soot at right directory

Set CLASSPATH of Soot.jar or go to the directory that contains Soot.jar file then type following Command:

> java -Xmx2g -jar soot-trunk.jar soot.Main -w -allow-phantom-refs       -android-jars "D:\sdk\platform" -src-prec apk -f jimple -process-dir "C:\apkpath\example.apk"

If you have already set CLASSPATH for jar then type following

>java -Xmx2g soot.Main -w -allow-phantom-refs -android-jars "D:\sdk\platform" -src-prec apk -f jimple -process-dir "C:\apkpath\example.apk"

Details: -Xmx2g it represents memory of 2GB which is normally sufficient for any apk process.

-jar can be replaced by -cp which means CLASSPATH or it represent command prompt's current directory.

-W stands for writing

-allow-phantom-refs creates phantom classes for missing or unprocessed classes

-android-jars leads to path for android sdk or jars to process apks

-src-prec represents the file format you are trying to process

-f jimple or -f J is responsible for converting all the classes from apk into jimple files

-process-dir shows the path for processing directory or apk located directory

Converting a java Class file to Soot's Intermediate Representation Jimple.

Converting a java Class file to Soot's Intermediate Representation Jimple.

Lets look at example to convert java files to Jimple. Here, I am using HelloWorld. java and convert it to class by using javac and Now i am converting HelloWorld.Class to Jimple file.

HelloWorld.Java Contains:

public class HelloWorld{

String output="";

static HelloWorld helloObj;

public HelloWorld(){

output ="Hello world";

}

public String printMessage(){

return output;

}

public static void main(String[] args)

{

helloObj = new HelloWorld();

System.out.println(helloObj.printMessage());

}

} 

Before try to convert into jimple file make sure the class file (HelloWorld.Class) is in the same directory as command line or you set the class-path properly.

Now, to convert class file to Jimple type following on your command line:

>Java soot.Main -f J HelloWorld

(J can be replaced by jimple)

>Java soot.Main -f jimple HelloWorld

(if your classpath is not set)

>Java -cp soot-2.5.0.jar soot.Main -f -J HelloWorld

If you got errors Like could not load class file, pool error at Line 31 etc.
 >Java -cp soot-2.5.0.jar soot.Main -f J -allow-phantom-refs HelloWorld

 -allow-phantom-refs : This option will generate phantom class of error codes and command. 
-f : represents the format for output 
-J: represents the jimple format
HelloWorld: Java class file
-cp: Classpath

Normally, in command works as: JAVA [JAVA OPTIONS]  SOOT[SOOT OPTIONS]

For result, go to soot directory where jar files are located, here soot automatically creates sootOutput directory and you can find HelloWorld.jimple file.

Testing Your Soot Installation

Testing Your Soot Installation

To test your soot installation as command line tools do following:

Open command Prompt and type following if you already set Soot's jar class-path :

Java soot.Main -version

If you haven't set classpath yet go to Soot jar located directory from command and type following

Java -cp soot-2.5.0.jar soot.Main -version

it will show following:

For help type --help instead of -version and it will show all the soot related commands for your help.

Soot Installation Guide - Command Line Tool

Soot Installation Guide

Download

Before you install soot your machine must have properly installed java. To install soot as command line tool you can download latest version of Jar file (Soot.Jar) or nightly build version(Soot-trunk.jar) from here. Latest version includes all other jar files so you don't need to download any other jars.

SET CLASSPATH

Before you are able to use soot you must set the classpath to various java jars and soot jar. To set jars on classpath for Windows users go to: 

Control Panel -> System -> Advance System Setting 

-> Environment Variables -> CLASSPATH

Find your Java installation folder Normally(C:\Program Files\Java\) and set following jars on classpath :

C:\Program Files\Java\jre7\lib\rt.jar;

C:\Program Files\Java\jdk1.8.0_25\jre\lib\jce.jar;

C:\Program Files\Java\jdk1.8.0_25\lib\tools.jar;

C:\Program Files\Java\jdk1.8.0_25\lib\dt.jar;

C:\soot\soot-2.5.0.jar (This contains your Soot jar file Directory).

soot jar file directory is not necessary, you can use soot jar file directly to your command line.

Static Analysis of Android Applications Using Soot

Soot

Soot has two fundamental uses; it can be used as a stand-alone command line tool or as a Java compiler framework. As a command line tool, Soot can:

1. Disassemble class-files

2. Assemble class-files

3. Optimize class-files

4. Android Apps Analysis

5. Davik bytecode