一句话：反汇编 native 二进制并恢复 JNI 符号，静态建模 native 回调，使 Java 静态分析能健全地捕捉 native 代码中的 Java 调用。
现有 Java 静态分析器在源代码或字节码层面运行时，对包含 native 代码的程序存在不健全性。本文指出 JNI 规范足够规整，允许对 native 代码在回调方面对程序执行的影响进行静态推理。方法包括：反汇编 native 二进制，恢复与 Java 方法签名对应的静态符号信息，并生成模型，借助 mock 对象静态执行这些 native 回调。评估表明，该方法能恢复 native 代码中几乎所有 Java 调用：在大型 Android 应用（Chrome、Instagram）上达到 100% 的 native 到应用调用图召回率，并完整捕获 XCorpus 套件程序的 native 回调行为。
Current Java static analyzers, operating either on the source or bytecode level, exhibit unsoundness for programs that contain native code. We show that the Java Native Interface (JNI) specification, which is used by Java programs to interoperate with Java code, is principled enough to permit static reasoning about the effects of native code on program execution when it comes to call-backs. Our approach consists of disassembling native binaries, recovering static symbol information that corresponds to Java method signatures, and producing a model for statically exercising these native call-backs with appropriate mock objects. The approach manages to recover virtually all Java calls in native code, for both Android and Java desktop applications—(a) achieving 100% native-to-application call-graph recall on large Android applications (Chrome, Instagram) and (b) capturing the full native call-back behavior of the XCorpus suite programs.
DOI 原文 ·
@inproceedings{paperbot6061,
title = {Identifying Java calls in native code via binary scanning},
author = {George Fourtounis and Leonidas Triantafyllou and Yannis Smaragdakis},
booktitle = {ISSTA},
year = {2020},
doi = {10.1145/3395363.3397368}
}