search

secure-software-engineering / FlowDroid

FlowDroid Static Data Flow Tracker
GNU Lesser General Public License v2.1
1.04k stars 296 forks source link

Starting with FlowDroid #79

Open ezamorab opened 5 years ago

ezamorab commented 5 years ago

Hi, I'm so newbie with that... I'm trying to learn how to usea FlowDroid and then use it with some Android apps, but I'm having problems. I haven't found any clear guidelines.

If I want to use Eclipse IDE I have to download the latest release of Flowdroid (2.6.1), but I also have to add soot, heros or jasmin to the project? That's my first problem, because Eclipse reports some errors

'soot-infoflow-android' is missing required Java project: 'soot'
'soot-infoflow-summaries' is missing required Java project: 'soot'
I've tried, with no result, to add them as you say here https://github.com/secure-software-engineering/soot-infoflow-android/wiki

The easiest way of building is to import all respective projects into Eclipse. The brave of heart may also give the ant build scripts a try, but you need to manually configure dependencies in this case.

Once I have the project correctly, is it enough to execute the command as you teach?

True apologies if my questions are obviuos.

Thanks in advance

likaikoplee commented 5 years ago

You can try the cmd-line tool at the begining.

StevenArzt commented 5 years ago

If you want to import FlowDroid into Eclipse, you also need to have Soot, Heros and Jasmin in Eclipse. Ou can find those projects in the Sable group here on Github.

If you build FlowDroid using Maven, those dependencies should be resolved automatically.

arabin-android commented 5 years ago

I am thinking to import flowdroid in android. Is it possible? if possible can anyone give me some instructions to start with? @StevenArzt

StevenArzt commented 5 years ago

Do you want to run FlowDroid on an Android phone? I have never tried that and I don't think it's a good idea. An app that contains Soot and FlowDroid would be huge. Secondly, FlowDroid needs quite a bit of memory and CPU performance. A resource-constrained mobile device is not an ideal analysis platform for any sort of advanced static analysis.

arabin-android commented 5 years ago

No i want to run flowdroid in Android studio. Like we can improt in eclipse project the same way i want to import flowdroid in android studio. Is it possible if so what is instruction. @StevenArzt

StevenArzt commented 5 years ago

Android Studio is for creating Android apps. FlowDroid is not an Android app.

arabin-android commented 5 years ago

To anaylize debug apk in android studio. Is it possible to import the flowdroid in android studio? Like the way we use findsecurity bug in android studio? @StevenArzt

StevenArzt commented 5 years ago

Now I see. What you are looking for is a plugin for Android Studio that triggers a data flow analysis. We do not have such a plugin at the moment. However, feel free to create one and share it with the community.

arabin-android commented 5 years ago

Thank you so much ya like a plugin thanks for the information. @StevenArzt

ezamorab commented 5 years ago

Thanks for your answers @StevenArzt @likaikoplee

You can try the cmd-line tool at the begining.

I'm trying that but I get this error:

espe@espe:~/FlowDroidCMD$ java -jar soot-infoflow-cmd-jar-with-dependencies.jar \

-a Period.apk \ -p androidplatforms \ -s SourcesAndSinks.txt Exception in thread "main" java.lang.NoClassDefFoundError: javax/activation/UnsupportedDataTypeException at soot.jimple.infoflow.cmd.MainClass.run(MainClass.java:230) at soot.jimple.infoflow.cmd.MainClass.main(MainClass.java:196) Caused by: java.lang.ClassNotFoundException: javax.activation.UnsupportedDataTypeException at java.base/jdk.internal.loader.BuiltinClassLoader.loadClass(BuiltinClassLoader.java:582) at java.base/jdk.internal.loader.ClassLoaders$AppClassLoader.loadClass(ClassLoaders.java:190) at java.base/java.lang.ClassLoader.loadClass(ClassLoader.java:499) ... 2 more

I think I have all the files: captura

Do you know what the problem might be?

If you want to import FlowDroid into Eclipse, you also need to have Soot, Heros and Jasmin in Eclipse. Ou can find those projects in the Sable group here on Github.

If you build FlowDroid using Maven, those dependencies should be resolved automatically.

I have all that, but there is one import from soot that eclipse don't want to make...

Thanks in advanced!

keers2 commented 5 years ago

@StevenArzt Hello Sir! I am using flowdroid in my project. I need a clear idea about how to configure flowdroid in eclipse. i have downloaded all the necessary projects like soot,heores, jasmin projects but i feel confsed about what to do next ? I need your suggestions for proeceeding to the next step forhow to implement APK files in flowdroid for to detect and analyse the data flow and leakage and to identify senstive inputs within android applications.