Static Reference Analysis for GUI Objects in Android Software

45
Sta$c Reference Analysis for GUI Objects in Android So9ware PRESTO: Program Analyses and So5ware Tools Research Group, Ohio State University Atanas Rountev, Dacong (Tony) Yan Ohio State University
  • date post

    20-Oct-2014
  • Category

    Technology

  • view

    332
  • download

    4

description

The popularity of Android software has grown dramatically in the last few years. It is essential for researchers in programming languages and compilers to contribute new techniques in this increasingly important area. Such techniques require a foundation of program analyses for Android. The target of our work is static object reference analysis, which models the flow of object references. Existing reference analyses cannot be applied directly to Android because the software is component-based and event-driven. An Android application is driven by a graphical user interface (GUI), with GUI objects responding to user actions. These objects and the event handlers associated with them ultimately determine the possible flow of control and data. We propose the first static analysis to model GUI-related Android objects, their flow through the application, and their interactions with each other via the abstractions defined by the Android platform. A formal semantics for the relevant Android constructs is developed to provide a solid foundation for this and other analyses. Next, we propose a constraint-based reference analysis based on the semantics. The analysis employs a constraint graph to model the flow of GUI objects, the hierarchical structure of these objects, and the effects of relevant Android operations. Experimental evaluation on real-world Android applications strongly suggests that the analysis achieves high precision with low cost. The analysis enables static modeling of control/data flow that is foundational for compiler analyses, instrumentation for event/interaction profiling, static error checking, security analysis, test generation, and automated debugging. It provides a key component to be used by compile-time analysis researchers in the growing area of Android software.

Transcript of Static Reference Analysis for GUI Objects in Android Software

Page 1: Static Reference Analysis for GUI Objects in Android Software

Sta$c  Reference  Analysis  for  GUI  Objects  in  Android  So9ware    

PRESTO:  Program  Analyses  and  So5ware  Tools  Research  Group,  Ohio  State  University  

Atanas  Rountev,  Dacong  (Tony)  Yan    

Ohio  State  University      

Page 2: Static Reference Analysis for GUI Objects in Android Software

MoFvaFon  and  Background  •  Android  so5ware  is  used  by  millions  of  users  •  Requires  foundaFonal  program  analyses  for  improved  performance  and  quality  

•  StaFc  reference  analysis  for  Java  •  What  is  the  set  of  run-­‐Fme  objects?  •  Which  variables  contain  references  to  which  objects?  •  CriFcal  component  of  data-­‐  and  control-­‐flow  analysis  •  Prerequisite  for  many  other  techniques  

•  ExisFng  work  cannot  be  applied  directly  to  Android  •  Goal:  develop  a  precise  and  efficient  staFc  reference  analysis  for  Android-­‐specific  features  

   2  

Page 3: Static Reference Analysis for GUI Objects in Android Software

StaFc  Reference  Analysis  for  Android  Features  •  Android  applicaFon  •  Driven  by  a  graphical  user  interface  (GUI)  •  Ac#vity:  on-­‐screen  window  with  GUI  elements  (views)  •  Event  handlers:  defined  in  listeners  and  associated  with  views  to  respond  to  user  acFons    

•  Need  to  model  staFcally  •  Views  and  their  hierarchical  structure  •  AssociaFon  of  views  with  acFviFes  •  AssociaFon  of  views  with  listeners  •  Variables  that  refer  to  views,  acFviFes,  and  listeners  

   3  

Page 4: Static Reference Analysis for GUI Objects in Android Software

Example  MyActivity.java: ! 1 class MyActivity extends Activity { ! 2 void onCreate() { ! 3 this.setContentView(R.layout.main); // Inflate ! 4 View a = this.findViewById(R.id.my_btn); // FindView! 5 Button b = (Button) a; ! 6 ButtonListener c = new ButtonListener(); ! 7 b.setOnClickListener(c); // SetListener } } !!ButtonListener.java: ! 8 class ButtonListener implements OnClickListener { ! 9 void onClick(View d) { ... } } !!main.xml: ! 10 <RelativeLayout ...> ! 11 <Button android:id=“@+id/my_btn” ... /> ! 12 </RelativeLayout> !

4  

Page 5: Static Reference Analysis for GUI Objects in Android Software

Example  MyActivity.java: ! 1 class MyActivity extends Activity { ! 2 void onCreate() { ! 3 this.setContentView(R.layout.main); // Inflate ! 4 View a = this.findViewById(R.id.my_btn); // FindView! 5 Button b = (Button) a; ! 6 ButtonListener c = new ButtonListener(); ! 7 b.setOnClickListener(c); // SetListener } } !!ButtonListener.java: ! 8 class ButtonListener implements OnClickListener { ! 9 void onClick(View d) { ... } } !!main.xml: ! 10 <RelativeLayout ...> ! 11 <Button android:id=“@+id/my_btn” ... /> ! 12 </RelativeLayout> !

5  

Page 6: Static Reference Analysis for GUI Objects in Android Software

Example  MyActivity.java: ! 1 class MyActivity extends Activity { ! 2 void onCreate() { ! 3 this.setContentView(R.layout.main); // Inflate ! 4 View a = this.findViewById(R.id.my_btn); // FindView! 5 Button b = (Button) a; ! 6 ButtonListener c = new ButtonListener(); ! 7 b.setOnClickListener(c); // SetListener } } !!ButtonListener.java: ! 8 class ButtonListener implements OnClickListener { ! 9 void onClick(View d) { ... } } !!main.xml: ! 10 <RelativeLayout ...> ! 11 <Button android:id=“@+id/my_btn” ... /> ! 12 </RelativeLayout> !

6  

Page 7: Static Reference Analysis for GUI Objects in Android Software

Example  MyActivity.java: ! 1 class MyActivity extends Activity { ! 2 void onCreate() { ! 3 this.setContentView(R.layout.main); // Inflate ! 4 View a = this.findViewById(R.id.my_btn); // FindView! 5 Button b = (Button) a; ! 6 ButtonListener c = new ButtonListener(); ! 7 b.setOnClickListener(c); // SetListener } } !!ButtonListener.java: ! 8 class ButtonListener implements OnClickListener { ! 9 void onClick(View d) { ... } } !!main.xml: ! 10 <RelativeLayout ...> ! 11 <Button android:id=“@+id/my_btn” ... /> ! 12 </RelativeLayout> !

7  

RelativeLayout!

Button: my_btn!

child

Page 8: Static Reference Analysis for GUI Objects in Android Software

Example  MyActivity.java: ! 1 class MyActivity extends Activity { ! 2 void onCreate() { ! 3 this.setContentView(R.layout.main); // Inflate ! 4 View a = this.findViewById(R.id.my_btn); // FindView! 5 Button b = (Button) a; ! 6 ButtonListener c = new ButtonListener(); ! 7 b.setOnClickListener(c); // SetListener } } !!ButtonListener.java: ! 8 class ButtonListener implements OnClickListener { ! 9 void onClick(View d) { ... } } !!main.xml: ! 10 <RelativeLayout ...> ! 11 <Button android:id=“@+id/my_btn” ... /> ! 12 </RelativeLayout> !

8  

RelativeLayout!

Button: my_btn!

child

Page 9: Static Reference Analysis for GUI Objects in Android Software

Example  MyActivity.java: ! 1 class MyActivity extends Activity { ! 2 void onCreate() { ! 3 this.setContentView(R.layout.main); // Inflate ! 4 View a = this.findViewById(R.id.my_btn); // FindView! 5 Button b = (Button) a; ! 6 ButtonListener c = new ButtonListener(); ! 7 b.setOnClickListener(c); // SetListener } } !!ButtonListener.java: ! 8 class ButtonListener implements OnClickListener { ! 9 void onClick(View d) { ... } } !!main.xml: ! 10 <RelativeLayout ...> ! 11 <Button android:id=“@+id/my_btn” ... /> ! 12 </RelativeLayout> !

9  

RelativeLayout!

Button: my_btn!

child

Page 10: Static Reference Analysis for GUI Objects in Android Software

Example  MyActivity.java: ! 1 class MyActivity extends Activity { ! 2 void onCreate() { ! 3 this.setContentView(R.layout.main); // Inflate ! 4 View a = this.findViewById(R.id.my_btn); // FindView! 5 Button b = (Button) a; ! 6 ButtonListener c = new ButtonListener(); ! 7 b.setOnClickListener(c); // SetListener } } !!ButtonListener.java: ! 8 class ButtonListener implements OnClickListener { ! 9 void onClick(View d) { ... } } !!main.xml: ! 10 <RelativeLayout ...> ! 11 <Button android:id=“@+id/my_btn” ... /> ! 12 </RelativeLayout> !

10  

RelativeLayout!

Button: my_btn!

child

Page 11: Static Reference Analysis for GUI Objects in Android Software

Example  MyActivity.java: ! 1 class MyActivity extends Activity { ! 2 void onCreate() { ! 3 this.setContentView(R.layout.main); // Inflate ! 4 View a = this.findViewById(R.id.my_btn); // FindView! 5 Button b = (Button) a; ! 6 ButtonListener c = new ButtonListener(); ! 7 b.setOnClickListener(c); // SetListener } } !!ButtonListener.java: ! 8 class ButtonListener implements OnClickListener { ! 9 void onClick(View d) { ... } } !!main.xml: ! 10 <RelativeLayout ...> ! 11 <Button android:id=“@+id/my_btn” ... /> ! 12 </RelativeLayout> !

11  

Page 12: Static Reference Analysis for GUI Objects in Android Software

Example  MyActivity.java: ! 1 class MyActivity extends Activity { ! 2 void onCreate() { ! 3 this.setContentView(R.layout.main); // Inflate ! 4 View a = this.findViewById(R.id.my_btn); // FindView! 5 Button b = (Button) a; ! 6 ButtonListener c = new ButtonListener(); ! 7 b.setOnClickListener(c); // SetListener } } !!ButtonListener.java: ! 8 class ButtonListener implements OnClickListener { ! 9 void onClick(View d) { ... } } !!main.xml: ! 10 <RelativeLayout ...> ! 11 <Button android:id=“@+id/my_btn” ... /> ! 12 </RelativeLayout> !

12  

Page 13: Static Reference Analysis for GUI Objects in Android Software

Example  MyActivity.java: ! 1 class MyActivity extends Activity { ! 2 void onCreate() { ! 3 this.setContentView(R.layout.main); // Inflate ! 4 View a = this.findViewById(R.id.my_btn); // FindView! 5 Button b = (Button) a; ! 6 ButtonListener c = new ButtonListener(); ! 7 b.setOnClickListener(c); // SetListener } } !!ButtonListener.java: ! 8 class ButtonListener implements OnClickListener { ! 9 void onClick(View d) { ... } } !!main.xml: ! 10 <RelativeLayout ...> ! 11 <Button android:id=“@+id/my_btn” ... /> ! 12 </RelativeLayout> !

13  

Page 14: Static Reference Analysis for GUI Objects in Android Software

Example  MyActivity.java: ! 1 class MyActivity extends Activity { ! 2 void onCreate() { ! 3 this.setContentView(R.layout.main); // Inflate ! 4 View a = this.findViewById(R.id.my_btn); // FindView! 5 Button b = (Button) a; ! 6 ButtonListener c = new ButtonListener(); ! 7 b.setOnClickListener(c); // SetListener } } !!ButtonListener.java: ! 8 class ButtonListener implements OnClickListener { ! 9 void onClick(View d) { ... } } !!main.xml: ! 10 <RelativeLayout ...> ! 11 <Button android:id=“@+id/my_btn” ... /> ! 12 </RelativeLayout> !

14  

Page 15: Static Reference Analysis for GUI Objects in Android Software

Example  MyActivity.java: ! 1 class MyActivity extends Activity { ! 2 void onCreate() { ! 3 this.setContentView(R.layout.main); // Inflate ! 4 View a = this.findViewById(R.id.my_btn); // FindView! 5 Button b = (Button) a; ! 6 ButtonListener c = new ButtonListener(); ! 7 b.setOnClickListener(c); // SetListener } } !!ButtonListener.java: ! 8 class ButtonListener implements OnClickListener { ! 9 void onClick(View d) { ... } } !!main.xml: ! 10 <RelativeLayout ...> ! 11 <Button android:id=“@+id/my_btn” ... /> ! 12 </RelativeLayout> !

15  

Page 16: Static Reference Analysis for GUI Objects in Android Software

Modeled  Android  OperaFons  •  Inflate    •  Create  GUI  structure  from  XML  and  a\ach  to  acFvity/view  

•  CreateView  •  ProgrammaFcally  create  a  view  through  new  V  

•  FindView  •  Lookup  a  view  from  acFvity  or  ancestor  view  (e.g.,  by  ID)  

•  SetListener  •  Associate  view  and  listener  

•  AddView  •  Establish  parent-­‐child  relaFonship  between  two  views  

•  SetId  •  ProgrammaFcally  set  the  ID  of  a  view  

16  

Page 17: Static Reference Analysis for GUI Objects in Android Software

Our  Proposal  •  Define  formal  seman#cs  of  GUI-­‐related  Android  constructs  

•  Encode  semanFcs  of  an  Android  applicaFon  in  a  constraint  graph  

•  Perform  constraint-­‐based  staFc  reference  analysis  

17  

Page 18: Static Reference Analysis for GUI Objects in Android Software

Example   1 class MyActivity extends Activity { ! 2 void onCreate() { ! 3 this.setContentView(R.layout.main); // Inflate ! 4 View a = this.findViewById(R.id.my_btn); // FindView! 5 Button b = (Button) a; ! 6 ButtonListener c = new ButtonListener(); ! 7 b.setOnClickListener(c); // SetListener } } !

"... "... "... ! 9 void onClick(View d) { ... } } !!!!

18   Propaga$on  edges  and  relevant  nodes  

Page 19: Static Reference Analysis for GUI Objects in Android Software

Example   1 class MyActivity extends Activity { ! 2 void onCreate() { ! 3 this.setContentView(R.layout.main); // Inflate ! 4 View a = this.findViewById(R.id.my_btn); // FindView! 5 Button b = (Button) a; ! 6 ButtonListener c = new ButtonListener(); ! 7 b.setOnClickListener(c); // SetListener } } !

"... "... "... ! 9 void onClick(View d) { ... } } !!!!

19   Propaga$on  edges  and  relevant  nodes  

MyActivity!

Page 20: Static Reference Analysis for GUI Objects in Android Software

Example   1 class MyActivity extends Activity { ! 2 void onCreate() { ! 3 this.setContentView(R.layout.main); // Inflate ! 4 View a = this.findViewById(R.id.my_btn); // FindView! 5 Button b = (Button) a; ! 6 ButtonListener c = new ButtonListener(); ! 7 b.setOnClickListener(c); // SetListener } } !

"... "... "... ! 9 void onClick(View d) { ... } } !!!!

20   Propaga$on  edges  and  relevant  nodes  

MyActivity!

Page 21: Static Reference Analysis for GUI Objects in Android Software

Example   1 class MyActivity extends Activity { ! 2 void onCreate() { ! 3 this.setContentView(R.layout.main); // Inflate ! 4 View a = this.findViewById(R.id.my_btn); // FindView! 5 Button b = (Button) a; ! 6 ButtonListener c = new ButtonListener(); ! 7 b.setOnClickListener(c); // SetListener } } !

"... "... "... ! 9 void onClick(View d) { ... } } !!!!

21   Propaga$on  edges  and  relevant  nodes  

MyActivity! this2 !

Page 22: Static Reference Analysis for GUI Objects in Android Software

Example   1 class MyActivity extends Activity { ! 2 void onCreate() { ! 3 this.setContentView(R.layout.main); // Inflate ! 4 View a = this.findViewById(R.id.my_btn); // FindView! 5 Button b = (Button) a; ! 6 ButtonListener c = new ButtonListener(); ! 7 b.setOnClickListener(c); // SetListener } } !

"... "... "... ! 9 void onClick(View d) { ... } } !!!!

22   Propaga$on  edges  and  relevant  nodes  

MyActivity!

a

b

c

d

this2 ! this9 !

Page 23: Static Reference Analysis for GUI Objects in Android Software

Example   1 class MyActivity extends Activity { ! 2 void onCreate() { ! 3 this.setContentView(R.layout.main); // Inflate ! 4 View a = this.findViewById(R.id.my_btn); // FindView! 5 Button b = (Button) a; ! 6 ButtonListener c = new ButtonListener(); ! 7 b.setOnClickListener(c); // SetListener } } !

"... "... "... ! 9 void onClick(View d) { ... } } !!!!

23   Propaga$on  edges  and  relevant  nodes  

MyActivity!

a

b

c

Inflate !id:main!

this9 !

d

this2 !

Page 24: Static Reference Analysis for GUI Objects in Android Software

Example   1 class MyActivity extends Activity { ! 2 void onCreate() { ! 3 this.setContentView(R.layout.main); // Inflate ! 4 View a = this.findViewById(R.id.my_btn); // FindView! 5 Button b = (Button) a; ! 6 ButtonListener c = new ButtonListener(); ! 7 b.setOnClickListener(c); // SetListener } } !

"... "... "... ! 9 void onClick(View d) { ... } } !!!!

24   Propaga$on  edges  and  relevant  nodes  

MyActivity!

a

b

c

Inflate !id:main!

FindView!id:my_btn! d

this9 !this2 !

Page 25: Static Reference Analysis for GUI Objects in Android Software

Example   1 class MyActivity extends Activity { ! 2 void onCreate() { ! 3 this.setContentView(R.layout.main); // Inflate ! 4 View a = this.findViewById(R.id.my_btn); // FindView! 5 Button b = (Button) a; ! 6 ButtonListener c = new ButtonListener(); ! 7 b.setOnClickListener(c); // SetListener } } !

"... "... "... ! 9 void onClick(View d) { ... } } !!!!

25   Propaga$on  edges  and  relevant  nodes  

MyActivity!

a

b

c

Inflate !id:main!

FindView!id:my_btn! d

this9 !this2 !

Page 26: Static Reference Analysis for GUI Objects in Android Software

Example   1 class MyActivity extends Activity { ! 2 void onCreate() { ! 3 this.setContentView(R.layout.main); // Inflate ! 4 View a = this.findViewById(R.id.my_btn); // FindView! 5 Button b = (Button) a; ! 6 ButtonListener c = new ButtonListener(); ! 7 b.setOnClickListener(c); // SetListener } } !

"... "... "... ! 9 void onClick(View d) { ... } } !!!!

26   Propaga$on  edges  and  relevant  nodes  

MyActivity!

a

b

c

Inflate !id:main!

FindView!id:my_btn! d

this9 !this2 !

Page 27: Static Reference Analysis for GUI Objects in Android Software

Example   1 class MyActivity extends Activity { ! 2 void onCreate() { ! 3 this.setContentView(R.layout.main); // Inflate ! 4 View a = this.findViewById(R.id.my_btn); // FindView! 5 Button b = (Button) a; ! 6 ButtonListener c = new ButtonListener(); ! 7 b.setOnClickListener(c); // SetListener } } !

"... "... "... ! 9 void onClick(View d) { ... } } !!!!

27   Propaga$on  edges  and  relevant  nodes  

MyActivity!

a

b

c

Inflate !id:main!

FindView!id:my_btn!

ButtonListener!

d

this9 !this2 !

Page 28: Static Reference Analysis for GUI Objects in Android Software

Example   1 class MyActivity extends Activity { ! 2 void onCreate() { ! 3 this.setContentView(R.layout.main); // Inflate ! 4 View a = this.findViewById(R.id.my_btn); // FindView! 5 Button b = (Button) a; ! 6 ButtonListener c = new ButtonListener(); ! 7 b.setOnClickListener(c); // SetListener } } !

"... "... "... ! 9 void onClick(View d) { ... } } !!!!

28   Propaga$on  edges  and  relevant  nodes  

MyActivity!

Inflate !id:main!

FindView!id:my_btn! a

b SetListener!

ButtonListener! c

d

this9 !this2 !

Page 29: Static Reference Analysis for GUI Objects in Android Software

Example   1 class MyActivity extends Activity { ! 2 void onCreate() { ! 3 this.setContentView(R.layout.main); // Inflate ! 4 View a = this.findViewById(R.id.my_btn); // FindView! 5 Button b = (Button) a; ! 6 ButtonListener c = new ButtonListener(); ! 7 b.setOnClickListener(c); // SetListener } } !

"... "... "... ! 9 void onClick(View d) { ... } } !!!!

29   Propaga$on  edges  and  relevant  nodes  

MyActivity!

Inflate !id:main!

FindView!id:my_btn! a

b SetListener!

ButtonListener! c

d

this9 !this2 !

Page 30: Static Reference Analysis for GUI Objects in Android Software

Example  

30  

1 class MyActivity extends Activity { ! 2 void onCreate() { ! 3 this.setContentView(R.layout.main); // Inflate ! 4 View a = this.findViewById(R.id.my_btn); // FindView! 5 Button b = (Button) a; ! 6 ButtonListener c = new ButtonListener(); ! 7 b.setOnClickListener(c); // SetListener } } !

"... "... "... ! 10 <RelativeLayout ...> ! 11 <Button android:id=“@+id/my_btn” ... /> ! 12 </RelativeLayout> !

Property  edges  and  relevant  nodes  

RelativeLayout!

Button !

child

view id id:my_btn!

Page 31: Static Reference Analysis for GUI Objects in Android Software

Example  

31  

1 class MyActivity extends Activity { ! 2 void onCreate() { ! 3 this.setContentView(R.layout.main); // Inflate ! 4 View a = this.findViewById(R.id.my_btn); // FindView! 5 Button b = (Button) a; ! 6 ButtonListener c = new ButtonListener(); ! 7 b.setOnClickListener(c); // SetListener } } !

"... "... "... ! 10 <RelativeLayout ...> ! 11 <Button android:id=“@+id/my_btn” ... /> ! 12 </RelativeLayout> !

Property  edges  and  relevant  nodes  

RelativeLayout!

Button !

child

view id id:my_btn!

Inflate !inflater

Page 32: Static Reference Analysis for GUI Objects in Android Software

1 class MyActivity extends Activity { ! 2 void onCreate() { ! 3 this.setContentView(R.layout.main); // Inflate ! 4 View a = this.findViewById(R.id.my_btn); // FindView! 5 Button b = (Button) a; ! 6 ButtonListener c = new ButtonListener(); ! 7 b.setOnClickListener(c); // SetListener } } !

"... "... "... ! 10 <RelativeLayout ...> ! 11 <Button android:id=“@+id/my_btn” ... /> ! 12 </RelativeLayout> !

Example  

32   Property  edges  and  relevant  nodes  

RelativeLayout!

Button !

child

view id id:my_btn!

Inflate !inflater

MyActivity!

this2 !

Page 33: Static Reference Analysis for GUI Objects in Android Software

Example  

33   Property  edges  and  relevant  nodes  

RelativeLayout!

Button !

child

view id id:my_btn!

Inflate !inflater

MyActivity!root

1 class MyActivity extends Activity { ! 2 void onCreate() { ! 3 this.setContentView(R.layout.main); // Inflate ! 4 View a = this.findViewById(R.id.my_btn); // FindView! 5 Button b = (Button) a; ! 6 ButtonListener c = new ButtonListener(); ! 7 b.setOnClickListener(c); // SetListener } } !

"... "... "... ! 10 <RelativeLayout ...> ! 11 <Button android:id=“@+id/my_btn” ... /> ! 12 </RelativeLayout> !

Page 34: Static Reference Analysis for GUI Objects in Android Software

Example  

34  

1 class MyActivity extends Activity { ! 2 void onCreate() { ! 3 this.setContentView(R.layout.main); // Inflate ! 4 View a = this.findViewById(R.id.my_btn); // FindView! 5 Button b = (Button) a; ! 6 ButtonListener c = new ButtonListener(); ! 7 b.setOnClickListener(c); // SetListener } } !

"!

MyActivity! RelativeLayout!

Button !

root

child

view id id:my_btn!

Property  edges  and  relevant  nodes  

Inflate !inflater

Page 35: Static Reference Analysis for GUI Objects in Android Software

Example  

35  

1 class MyActivity extends Activity { ! 2 void onCreate() { ! 3 this.setContentView(R.layout.main); // Inflate ! 4 View a = this.findViewById(R.id.my_btn); // FindView! 5 Button b = (Button) a; ! 6 ButtonListener c = new ButtonListener(); ! 7 b.setOnClickListener(c); // SetListener } } !

"!

Property  edges  and  relevant  nodes  

MyActivity! RelativeLayout!

Button !

root

child

view id id:my_btn!

Inflate !inflater

Page 36: Static Reference Analysis for GUI Objects in Android Software

Example  

36  

1 class MyActivity extends Activity { ! 2 void onCreate() { ! 3 this.setContentView(R.layout.main); // Inflate ! 4 View a = this.findViewById(R.id.my_btn); // FindView! 5 Button b = (Button) a; ! 6 ButtonListener c = new ButtonListener(); ! 7 b.setOnClickListener(c); // SetListener } } !

"!

Property  edges  and  relevant  nodes  

MyActivity! RelativeLayout!

Button !

root

child

view id id:my_btn!

Inflate !inflater

lookup  performed  by  FindView  

Page 37: Static Reference Analysis for GUI Objects in Android Software

Example  

37   Property  edges  and  relevant  nodes  

MyActivity! RelativeLayout!

Button !

root

child

view id id:my_btn!

Inflate !inflater

1 class MyActivity extends Activity { ! 2 void onCreate() { ! 3 this.setContentView(R.layout.main); // Inflate ! 4 View a = this.findViewById(R.id.my_btn); // FindView! 5 Button b = (Button) a; ! 6 ButtonListener c = new ButtonListener(); ! 7 b.setOnClickListener(c); // SetListener } } !

"!

Page 38: Static Reference Analysis for GUI Objects in Android Software

Example  

38  

1 class MyActivity extends Activity { ! 2 void onCreate() { ! 3 this.setContentView(R.layout.main); // Inflate ! 4 View a = this.findViewById(R.id.my_btn); // FindView! 5 Button b = (Button) a; ! 6 ButtonListener c = ! 7 b.setOnClickListener(c); // SetListener } } !

"!

Property  edges  and  relevant  nodes  

ButtonListener!

MyActivity! RelativeLayout!

Button !

root

child

view id id:my_btn!

Inflate !inflater

Page 39: Static Reference Analysis for GUI Objects in Android Software

Example  

39  

1 class MyActivity extends Activity { ! 2 void onCreate() { ! 3 this.setContentView(R.layout.main); // Inflate ! 4 View a = this.findViewById(R.id.my_btn); // FindView! 5 Button b = (Button) a; ! 6 ButtonListener c = new ButtonListener(); ! 7 b.setOnClickListener(c); // SetListener } } !

"!

Property  edges  and  relevant  nodes  

MyActivity! RelativeLayout!

Button !

root

child

view id id:my_btn!

Inflate !inflater

ButtonListener!listener

Page 40: Static Reference Analysis for GUI Objects in Android Software

ImplementaFon  •  Input  •  Java  bytecode  of  the  applicaFon  •  Relevant  XML  files  

•  Output  •  Parent-­‐child  relaFonships  between  views  •  AssociaFon  of  acFviFes  with  root  views  •  AssociaFon  of  views  with  listeners  •  Variables  and  fields  referring  to  views,  acFviFes,  listeners  

•  Analysis  algorithm  1.  Create  iniFal  constraint  graph  from  app  code  2.  Solve  propagaFon  constraints  for  IDs,  acFviFes,  listeners  3.  Fixed-­‐point  computaFon  for  flow  of  views  between  

operaFon  nodes  40  

Page 41: Static Reference Analysis for GUI Objects in Android Software

EvaluaFon  •  Experiments  on  20  open-­‐source  Android  apps  •  Experiment  I  –  applicaFon  characterizaFon  •  Constraint  graph:  number  of  various  types  of  nodes  •  Result:  Android-­‐specific  features  are  widely  used    

•  Experiment  II  –  analysis  performance  and  precision  •  Running  Fme  to  perform  the  constraint  analysis  •  Less  than  5  seconds  for  each  app  

•  Average  number  of  objects  for  variables  at  relevant  operaFons  –  e.g.  •  v1.addChild(v2)  –  receiver  v1,  parameter  v2  •  v  =  x.findViewById(…)  –  result  v  •  v.setListener(m)  –  receiver  v,  listener  m  

41  

Page 42: Static Reference Analysis for GUI Objects in Android Software

Precision  Measurements  

42  Average  number  of  objects  for  variables  at  relevant  opera$ons    

Page 43: Static Reference Analysis for GUI Objects in Android Software

Precision  Measurements  

43  Average  number  of  objects  for  variables  at  relevant  opera$ons    

Imprecision?  

Page 44: Static Reference Analysis for GUI Objects in Android Software

Conclusions  •  First  staFc  analysis  to  focus  on  GUI-­‐related  Android  constructs  

•  Proposed  constraint-­‐based  algorithm  exhibits  high  precision  and  low  cost  

•  CriFcal  building  block  for  other  analyses  and  tools  for  Android  

●  So5ware  release  ●  GATOR:  Program  Analysis  Toolkit  For  Android  ●  h\p://www.cse.ohio-­‐state.edu/presto/so5ware/  

 44  

Page 45: Static Reference Analysis for GUI Objects in Android Software

                                 Thank    you  

45