一句话:提出首个面向 Android 的动态切片工具 AndroidSlicer,支持异步回调、无需源码且开销低。
动态切片可用于测试、调试与安全,但已有方法面向桌面/服务器,难以应对 Android 的异步回调、IPC 密集、传感器驱动和时序敏感特性。本文提出 AndroidSlicer,首个 Android 动态切片方法:用异步切片建模回调下的数据/控制依赖,配合轻量精确插桩,可直接在真机运行且无需源码。在 60 个 Google Play 应用上,需检查指令降至执行指令的 0.3%,插桩与后处理共 31 秒,运行时开销仅 4%。作者还用于定位致错输入、故障定位和缩减回归测试集;另 18 个流行应用的实验表明其对 Android 测试与调试有效。
Dynamic program slicing is useful for a variety of tasks, from testing to debugging to security. Prior slicing approaches have targeted traditional desktop/server platforms, rather than mobile platforms such as Android. Slicing mobile, event-based systems is challenging due to their asynchronous callback construction and the IPC (interprocess communication)- heavy, sensor-driven, timing-sensitive nature of the platform. To address these problems, we introduce AndroidSlicer1, the first slicing approach for Android. AndroidSlicer combines a novel asynchronous slicing approach for modeling data and control dependences in the presence of callbacks with lightweight and precise instrumentation; this allows slicing for apps running on actual phones, and without requiring the app's source code. Our slicer is capable of handling a wide array of inputs that Android supports without adding any noticeable overhead. Experiments on 60 apps from Google Play show that AndroidSlicer is effective (reducing the number of instructions to be examined to 0.3% of executed instructions) and efficient (app instrumentation and post-processing combined takes 31 seconds); all while imposing a runtime overhead of just 4%. We present three applications of AndroidSlicer that are particularly relevant in the mobile domain: (1) finding and tracking input parts responsible for an error/crash, (2) fault localization, i.e., finding the instructions responsible for an error/crash, and (3) reducing the regression test suite. Experiments with these applications on an additional set of 18 popular apps indicate that AndroidSlicer is effective for Android testing and debugging.