search

setting-defect-fuzzing / home

GNU General Public License v3.0
35 stars 6 forks source link

readme

SetDroid Prototype

Publication

[1] "Understanding and Finding System Setting-Related Defects in Android Apps" by Jingling Sun, Ting Su, Junxin Li, Zhen Dong, Geguang Pu, Tao Xie and Zhendong Su. The 30th ACM SIGSOFT International Symposium on Software Testing and Analysis (ISSTA 2021)

@inproceedings{SetDroid,
   author = {Sun, Jingling and Su, Ting and Li, Junxin and Dong, Zhen and Pu, Geguang and Xie, Tao and Su, Zhendong},
   title = {Understanding and Finding System Setting-Related Defects in Android Apps},
   year = {2021},
   doi = {10.1145/3460319.3464806},
   booktitle = {Proceedings of the 30th ACM SIGSOFT International Symposium on Software Testing and Analysis},
   pages = {204–215},
   numpages = {12},
   keywords = {Testing, Setting, Empirical study, Android},
   location = {Virtual, Denmark},
   series = {ISSTA 2021}
}

[2] "Characterizing and Finding System Setting-Related Defects in Android Apps" by Jingling Sun, Ting Su, Kai Liu, Chao Peng, Zhao Zhang, Geguang Pu, Tao Xie, Zhendong Su. IEEE Transactions on Software Engineering (TSE 2023)

@article{SetDroid2,
  author       = {Jingling Sun and
                  Ting Su and
                  Kai Liu and
                  Chao Peng and
                  Zhao Zhang and
                  Geguang Pu and
                  Tao Xie and
                  Zhendong Su},
  title        = {Characterizing and Finding System Setting-Related Defects in Android
                  Apps},
  journal      = {{IEEE} Trans. Software Eng.},
  volume       = {49},
  number       = {4},
  pages        = {2941--2963},
  year         = {2023},
  doi          = {10.1109/TSE.2023.3236449}
}

You can find more about our work on testing/analyzing Android apps at this website.

Getting Started

Running SetDroid via Virtual Machine

Requirements

Setting up (video tutorial)

Run (video tutorial)

Building and Running SetDroid From Scratch

Requirements

Setting up

You can create an emulator before running SetDroid. See this link for how to create avd using avdmanager. The following sample command will help you create an emulator, which will help you to start using SetDroid quickly：

sdkmanager "system-images;android-26;google_apis;x86"
avdmanager create avd --force --name Android8.0 --package 'system-images;android-26;google_apis;x86' --abi google_apis/x86 --sdcard 512M --device "pixel_xl"

Next, you can start two identical emulators and assign their port numbers with the following commands:

emulator -avd Android8.0 -read-only -port 5554
emulator -avd Android8.0 -read-only -port 5556

Run

If you have downloaded our project and configured the environment, you only need to enter download_path/tool to execute our sample app with the following command:

python3 start.py -app_path /home/setdroid/SetDroid/App/a2dp.Vol.apk -append_device emulator-5554 -append_device emulator-5556 -android_system emulator8 -append_strategy display_immediate_1 -testcase_count 1

SetDroid provides several ways to test android apps by command lines. You need to view configuration help through the following commands and change them.

python3 start.py --help

Detailed Description

All Optional Parameters of SetDroid

Strategy name Setting Oracle rule Injection strategy Pair of events for setting changes
network_immediate_1 Network I Immediate ⟨turn on airplane, turn off airplane⟩
network_lazy_1 Network I Lazy ⟨turn on airplane, turn off airplane⟩
network_lazy_2 Network I Lazy ⟨switch to mobile data, switch to Wi-Fi⟩
location_lazy_1 Location I Lazy ⟨turn off location, turn on location⟩
location_lazy_2 Location I Lazy ⟨switch to "device only", switch to "high accuracy"⟩
sound_lazy_1 Sound I Lazy ⟨turn on "do not disturb", turn off "do not disturb"⟩
battery_immediate_1 Battery I Immediate ⟨turn on the power saving mode, add the app into the whitelist⟩
battery_lazy_1 Battery I Lazy ⟨turn on the power saving mode, turn off the power saving mode⟩
display_immediate_1 Display I Immediate ⟨switch to landscape, switch to portrait⟩
display_immediate_2 Display I Immediate ⟨turn on multi-window, turn off multi-window⟩
permssion_lazy_1 Permission I Lazy ⟨turn off permission, turn on permission⟩
developer_lazy_1 Developer I Lazy ⟨turn on "Don’t keep activities", turn off "Don’t keep activities"⟩
language Language II - ⟨change system language, -⟩
time Time II - ⟨change hour format, -⟩

Description of Output Files (video tutorial)

error_realtime.txt

This file records the sequences that trigger the setting defects, which start with Start::x::run_count::y (x means the x-th error and Y means the error was captured during the y-th round of execution), and end with End::

wrong_realtime.txt

This file records the sequences that trigger the suspected setting defects.

read_trace.txt

This file records the execution sequence of SetDroid, which is easy for SetDroid users to read.

trace.txt

This file records the execution sequence of SetDroid, which can be read and replayed by SetDroid.

i_trace.html

This file records the sequence of screenshots after each step, which is arranged horizontally. The events executed at each step are marked on the screenshot. After opening the file in the browser, there is a drag bar at the bottom, which can drag horizontally to view the whole sequence. When the error is captured, the screenshot is marked with a red frame. When the two interfaces are different, the screen capture is marked with a yellow frame.

Tool Extension

If someone wants to extend the artifact, they can modify it in the following position of the tool.

Add settings change strategy

Add a new setting change function in injector.py, and add calls to it to change_setting_before_run or inject_setting_during_run as needed.

Add seed test generation policy

Add a new exploration class according to RandomPolicy class in policy.py, and inherit the Policy class

Add a new check condition

Add a new check function in check.py and call it in the corresponding position in the executor.py

Main Maintainers