Program Analysis of Google Chrome

Program Analysis of Google Chrome

Tested Android Application

The android Chrome application is taken as demonstration application originally developed by the Goolgle Team on Android platform. It features 4552 classes, 14184 methods and was written in Java code. The first method used is conversion of java codes in to soot’s intermediate representation Jimple files for each 4552 java classes and graphical representation for each 14184 methods which further converted in to control flow graph and call graph based on nodes and edges inside the method. Secondly, the generated Dalvik bytecode contains Dalvik instructions.

From the Dalvik bytecode of the Chrome application I generate Jimple code in one second (duration for the Dalvik to Jimple conversion only). Then I ask Soot to generate Java bytecode from the Jimple representation. I convert the Java bytecode back to Dalvik, repackage an Android application and launch it on the Android emulator. The application runs smoothly and the app is working.

Static Analysis on Chrome

I use Soot to generate a call graph of the Chrome application, portion of the control flow graph represented in Figure 2.

Control Flow analysis Graph (Call Graph) for  org.chromium.chrome.browser.preferences.website.WebsitemergePermissionInfoForTopLevelOrigin(org.chromium.chrome.browser.preferences. website.WebsiteAddress,java.util.List) Method Extracted from the Generated Jimple Representation. .36 seconds (duration from the launch time of Soot until Soot has finished). I perform this to check that the generated call graph and CFG correspond to the original code meaning that the conversion from Dalvik to Jimple is correct for this code.

I have successfully tested Soot as IR Jimple conversion to and another tool Dalvik bytecode to an Android application.

Figure 2: Partial Call graph for (chrome.browser.preferences.website) method

Process Analysis

Firstly, I used soot for conversion of Chrome.apk i.e. downloads from google play store to Soot’s Intermediate Representation Jimple and Soot’s CFG Viewer to produce graphical representation of all the methods from classes as dot files based on existing works of Droiddel[7].

Second Method, since there no existing tool directly converts Dalvik bytecode to Jimple. I either found tools to convert Dalvik bytecode to Java bytecode or tools to disassemble and/or assemble assemble Dalvik bytecode using an intermediate representation [4].

Dalvik to Java Bytecode Converter Ded is a Dalvik bytecode to Java bytecode converter. Once the Java bytecode is generated, Soot is used to optimize the code. Dex2jar also generates Java bytecode from Dalvik bytecode but no not use any external tool to optimize the resulting Java bytecode [5]. Undx is also a Dalvik to Java bytecode converter but seems to be unavailable. I on the other hand do not directly generate Java bytecode but Jimple code.

From there, since the Jimple code is within Soot, I can generate Java bytecode as well. Dalvik Assembler/Disassembler Smali or Androguard can be used to reverse engineer Dalvik bytecode. They use their own representation of the Dalvik bytecode: they cannot leverage existing analysis tools. This tool, use Soot’s internal representation which allows existing tools to analyze/transform the Dalvik bytecode [7].

Conclusion

Here we introduced a new analysis that integrates and enhances existing Android app static analyses. I have presented the phenomena of static analysis of android apps based on the control flow graphs by using soot. I successfully use conversion of an android app (java byte code) into dalvik bytecode (android app). And generate the control flow graphs from java methods and perform the static analysis.

This can further be used for static analysis of any android apps or java programs and computation of nodes and edges for the analysis of the complex algorithm. Finally, it is also can be used on static fields, implicit flow, distinguish different receive intents as well as other data channels.

Graphviz - Graph Visualization Software

Installation 

For installation, download latest version of "Graphviz"  from here. You can either download executable file directly and install or zip file and extract zip and put on command line directory.

To use any executable extension like dot from Graphviz you need to set the PATH after installation. For windows

Control panel -> System-> Advance System Setting -> Environment Variables -> PATH

Normally, file will install in Graphviz directory inside program files so path will looks like :

PATH   ->   C:\Program Files\Graphviz2.38\bin\

To test the installation type following from command line :

> dot -help

If you haven't the set path yet go to graphviz bin directory from command line and type following :

> dot -help

PROGRAM ANALYSIS OF SMART PHONE APPS

PROGRAM ANALYSIS OF SMART PHONE APPS

(A research based on program analysis of smart phone applications)

You can find complete tutorials

BY; CHALISE BIRENDRA

Abstract

Here, I am going to present the static analysis of an android app (Google Chrome) with the help of control flow graphs(CFGs) generated by using java bytecode analysis tool soot. For, control flow graphs, Soot converts the android application into its intermediate format(.jimple) and dot file of all methods which is further converted into control flow graphs through graph generated software i.e. Graphviz, before analyzing statically.

Additionally, the graphical representation of an app is created in the form of control flow graphs which is created for all possible java methods of the android app, and implemented to do static analysis of the app. I also generate and calculate the numbers of all java methods as CFG and classes as intermediate representation i.e.jimple.

Finally, I will introduce a new analysis that integrates and enhances existing Android app static analyses and successfully tests the static analysis of given android app by calculating the time span for extracting the methods from an app, number of all reachable classes and methods for the purpose of the CFG static analysis. 

Introduction

Here I am using Soot[1] to convert Android apk to Intermediate Representation mostly as Jimple (can be use baf, Shimple, Grimph etc) and produce Jimple files of each class that belongs to apk graphical representation of each method as dot file which further will generate Control flow graph for static analysis of android apk based on the process of java bytecode [6] (see in figure 1).

Figure 1: Java Bytecode

Moreover, I am using another technique to get similar results for static analysis with soot as Dalvik bytecode to Jimple. As Jimple is Soot’s main internal representation of code, the Dalvik bytecode can be manipulated with any Jimple based tool, for instance for performing point-to or flow analysis.

 Finally, I am able to convert any .java, .class, .apk and .jar files to its all intermediate representation jimple, baf, simple, grimph etc; Create Control Flow Graph, assemble/dissemble, .dex , .apk or delvik bytecode[1,2] which further helps to perform static analysis of all Java or Android files and apps for various security purpose as well[3].