[Soot-list] FlowDroid callback extraction in obfuscated library

Faridah Akinotcho faridath.akinotcho at yahoo.fr
Tue Jul 27 21:51:51 EDT 2021


Hi,
My name is Faridah Akinotcho and I am currently using FlowDroid to build static app models. For this purpose, there are specific callbacks which I need to parse and analyze. In particular, I extended the AndroidCallbacks.txt file, with 'android.support.design.widget.NavigationView$OnNavigationItemSelected' in order to obtain the callback 'boolean onNavigationItemSelected(MenuItem menuItem)'
The APK that I am working with obfuscate some of the library methods by renaming, as shown in the picture:

My understanding was that, since FlowDroid parses bytecode, it would find and parse NavigationView$OnNavigationItemSelected, then extract its interface methods. However, logs show that FlowDroid extract NavigationView$a (the obfuscated version of the interface), which results in callbacks not being found.
I was hoping I could get some clarification on whether this is the expected behavior and if so, I would greatly appreciate any pointers on how to solve this issue. Please note that, building an exhaustive list of all the obfuscated APIs and adding them to AndroidCallbacks.txt wouldn't be feasible, as the analysis I am trying to perform, will involve multiple apps, with potentially different obfuscated methods.
Best regards,Faridah Akinotcho
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://mailman.CS.McGill.CA/pipermail/soot-list/attachments/20210728/7efbba3e/attachment-0001.html>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: dataURI-1627437083268
Type: image/png
Size: 34581 bytes
Desc: not available
URL: <https://mailman.CS.McGill.CA/pipermail/soot-list/attachments/20210728/7efbba3e/attachment-0001.png>


More information about the Soot-list mailing list