search

arguslab / Argus-SAF

Argus static analysis framework
Apache License 2.0
181 stars 49 forks source link

False Positives in ICC Links #53

Open jyotigajrani opened 5 years ago

jyotigajrani commented 5 years ago

Hi,

I am using Amandroid Jar i.e. argus*.jar for finding ICC Links of our own constructed apps. For many cases, it gives false positives. For. e.g. in attached apk, there are 2 ICC calls from NumberActivity. One is to OTP and other is to Knumber. But the result of Amandroid says that it has 4 targets (attached the result file). And similar for other activities also....The code of NumberAvtivity is attached which shows that it has only 2 Intent Calls.

Please confirm the reason of this. Does it calculates some indirect ICC calls. I am running Amandroid as:-

java -jar /home/jyoti/argus.jar t -o . /home/jyoti/app-debug.apk

AppData-Electricity-Bill.txt NumberActivity.txt

Please check how can we avoid these false links. Thanks

fgwei commented 5 years ago

Please give me the apk to check.

jyotigajrani commented 5 years ago

Following are links of two apks

https://drive.google.com/file/d/1Os3iEG8sc9paHaOxxqIZgoCzb-no6XeQ/view?usp=drive_web

https://play.google.com/store/apps/details?id=com.ecajmer.combat&hl=en_IN

In both of these, we are getting false positives. Please check.

fgwei commented 5 years ago

I see the problem, For NumberAvtivity, it accidentally assigned the PaymentGateway$2 as the onClickListener which invokes an ICC. I will debug and see why.

jyotigajrani commented 5 years ago

Thanks for reply. Please do check and suggest can it be handled?