search

marapapman / Violist

A String analysis framework for Java and Android apps
8 stars 2 forks source link

Can Violist analyze android-6.0 APKs? #2

Open moonZHH opened 8 years ago

moonZHH commented 8 years ago

@marapapman Hi! I wonder that can Violist analyze android-6.0 APKs?

marapapman commented 8 years ago

We did not try it, so we do not know.

On Sun, May 22, 2016, 2:25 PM njupt-moon notifications@github.com wrote:

@marapapman https://github.com/marapapman Hi! I wonder that can Violist analyze android-6.0 APKs?

— You are receiving this because you were mentioned. Reply to this email directly or view it on GitHub https://github.com/marapapman/Violist/issues/2

moonZHH commented 8 years ago

@marapapman Thanks for your reply! Maybe I need to try it myself.

moonZHH commented 8 years ago

@marapapman Hi! I have another problem. Here is my code snapshot in a test apk file. protected void onCreate(Bundle savedInstanceState) { super.onCreate(savedInstanceState); setContentView(R.layout.activity_main); String version = "java"; String seed = "_test"; String result = version; Logger.reportString(result,"1"); for(int i = 0; i < 5; i++) { result = result + seed; Logger.reportString(result,"2"); } } I just wonder why Violist can not get the result form the statement Logger.reportString(result,"2"); ? But when I move this code snapshot into a test java file, Violist works this time.

winsonlyu commented 8 years ago

Hi, Is there any results from Logger.reportString(result,"1") for the test apk file?

Yingjun

On Sat, May 28, 2016 at 1:01 AM, njupt-moon notifications@github.com wrote:

@marapapman https://github.com/marapapman Hi! I have another problem. Here is my code snapshot in a test apk file. protected void onCreate(Bundle savedInstanceState) { super.onCreate(savedInstanceState); setContentView(R.layout.activity_main); String version = "java"; String seed = "_test"; String result = version; Logger.reportString(result,"1"); for(int i = 0; i < 5; i++) { result = result + seed; Logger.reportString(result,"2"); } } I just wonder why Violist can not get the result form the statement Logger.reportString(result,"2"); ? But when I move this code snapshot into a test java file, Violist works this time.

— You are receiving this because you are subscribed to this thread. Reply to this email directly, view it on GitHub https://github.com/marapapman/Violist/issues/2#issuecomment-222296146, or mute the thread https://github.com/notifications/unsubscribe/AKAgkA7Dyig3Vtl4Zq59oLBDB1NlBtNOks5qF_ZggaJpZM4IkDhW .

moonZHH commented 8 years ago

@winsonlyu Hi! Actually, yes. Violist can get result from statement Logger.reportString(result,"1"), but statement Logger.reportString(result,"2") has no result.

moonZHH commented 8 years ago

Actually, if I annotate the following code snapshot, the previous problem can be solved. Will it cause any other problems by this annotation? //Android Crash / if(rd.getAllDef().get(n.getOffset().toString()).startsWith("$")) { vlist.add(v); continue; } /

winsonlyu commented 8 years ago

Yes, it might cause some runtime exception for some apps. But in the meanwhile, you can get more precise results from Violist. In our implementation, I try to make our tool as safe as possible. So I choose not to handle those cases. But you can adjust it. As long as it does not raise any exception, the analysis result will be correct.

Yingjun

On May 29, 2016, at 2:29 AM, njupt-moon notifications@github.com wrote:

Actually, if I annotate the following code snapshot, the previous problem can be solved. Will it cause any other problems by this annotation? //Android Crash / if(rd.getAllDef().get(n.getOffset().toString()).startsWith("$")) { vlist.add(v); continue; } /

— You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub, or mute the thread.